CVE-2024-29161

CVE-2024-29161 affects HDF5 up to version 1.14.3. The vulnerability is a heap buffer overflow in H5A__attr_release_table that can corrupt the instruction pointer, potentially causing denial of service or code execution. Public sources in the connected documents confirm the issue and indicate a fi...

CVE-2024-29160

HDF5 CVE-2024-29160 affects the H5HG__cache_heap_deserialize path in HDF5 up to version 1.14.3, causing a heap-based buffer overflow that can corrupt the instruction pointer and lead to denial of service or potential code execution. The connected IBM Security Bulletin confirms multiple related Ze...

CVE-2024-29158

The CVE-2024-29158 entry affects HDF5 up to version 1.14.3, where a stack buffer overflow in H5FL_arr_malloc can corrupt the instruction pointer, leading to denial of service and potential code execution. The impact is localized (LOCAL) with high confidentiality and integrity/availability concern...

CVE-2024-29157

CVE-2024-29157 affects HDF5 1.14.3 and earlier, with a heap buffer overflow in H5HG_read that can corrupt the instruction pointer and cause denial of service or potential code execution. The IBM/NVD entry notes a fix in 1.14.4 (and references the HDF Group advisory). Practical impact is DoS or po...

CVE-2024-33454

CVE-2024-33454 affects Espressif ESP-IDF 5.1 Bluetooth stack. A buffer overflow in the Bluetooth component allows a remote attacker to execute arbitrary code by sending a crafted script. The vulnerability is documented with CVSS v3.1: Network attack, high privileges required, no user interaction,...

CVE-2024-32737

CyberPower PowerPanel Enterprise

CVE-2024-3727

CVE-2024-3727 affects the containers/image library and enables attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, leading to resource exhaustion and local path traversal. Multiple connected advisories (e.g., container-tools updates and package-specific pat...

CVE-2024-34074

CVE-2024-34074 affects Frappe, a full‑stack web framework. The vulnerability concerns the login page accepting a redirect argument, enabling redirects to untrusted external URLs and phishing risk. Affected versions before 14.74.0 and before 15.26.0 are fixed in 14.74.0 and 15.26.0, respectively. ...

CVE-2024-34210

CVE-2024-34210 affects TOTOLINK outdoor CPE CP450 (version 4.1.0cu.747_B20191224). The root cause is a command injection in CloudACMunualUpdate via the FileName parameter, enabling potential remote code execution over the network. Public exploit details are not provided in the documents; CVSS ind...

CVE-2024-34212

TOTOLINK CP450 is affected by CVE-2024-34212 due to a stack buffer overflow in the CloudACMunualUpdate function. The vulnerability stems from improper validation of input data length in CloudACMunualUpdate, allowing a potential denial-of-service condition. Affected software/version: TOTOLINK CP45...

CVE-2024-31803

A vulnerability (CVE-2024-31803) affects emp-ot v0.2.4, described as a Buffer Overflow in the FerretCOT::read_pre_data128_from_file function that could allow a remote attacker to execute arbitrary code. The threat details in connected documents confirm the affected software and the vulnerable fun...

CVE-2024-4676

The vulnerability CVE-2024-4676 affects Campcodes Complete Web-Based School Management System 1.0. The issue is a cross-site scripting (XSS) flaw arising from manipulation of the count argument in the /view/range_grade_text.php endpoint. Attack vector is remote and public exploit appears to have ...

CVE-2024-4317

The CVE-2024-4317 issue affects PostgreSQL built-ins pg_stats_ext and pg_stats_ext_exprs, where missing authorization checks allow an unprivileged user to read statistics (e.g., most common values) from other users’ CREATE STATISTICS data. Affected versions are within major series 14–16, specific...

CVE-2024-23473

CVE-2024-23473 affects SolarWinds Access Rights Manager (ARM). The connected documents describe a hard-coded credential authentication bypass that allows remote access to the RabbitMQ management console. The vulnerability arises from the RabbitMQ configuration using hard-coded credentials, enabli...

CVE-2024-28075

Summary: CVE-2024-28075 affects SolarWinds Access Rights Manager (ARM). The connected ZDI advisory and Nessus plugin confirm a deserialization flaw in the JsonSerializationBinder class that allows an authenticated, potentially bypassing authentication, attacker to execute arbitrary code on affect...

CVE-2024-32712

CVE-2024-32712: Missing Authorization in Podlove Podlove Podcast Publisher affects Podlove Podcast Publisher up to version 4.0.14. Root cause is a broken access-control pathway that allows unauthorized actions on the plugin’s resources. Public sources in Connected Documents corroborate this as a ...

CVE-2024-32724

CVE-2024-32724 describes a Missing Authorization vulnerability in the SharkDropship dropshipping WordPress/WooCommerce plugin (SharkDropshipped for AliExpress, eBay, Amazon, Etsy) up to version 2.1.1. The connected data indicates this flaw permits arbitrary content deletion and is associated with...

CVE-2024-34549

CVE-2024-34549: Exposure of Sensitive Information to an Unauthorized Actor in Automattic WP Job Manager (affecting WP Job Manager up to version 2.2.2). The connected Red Hat and Wordfence entries confirm the issue is an Information Exposure vulnerability, exploitable by unauthenticated actors, wi...

CVE-2024-34433

CVE-2024-34433 is a PHP Object Injection/deserialization vulnerability in the One Click Demo Import plugin for WordPress (versions

CVE-2024-34557

CVE-2024-34557 : CSRF vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager (WordPress plugin). Affected: Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.4. Description in connected sources confirms CSRF risk; exploitation could allow unauthorized action...