CVE-2024-29800

CVE-2024-29800 describes a PHAR deserialization vulnerability in Timber WordPress Timber plugin <= 1.23.0. The flaw arises from unvalidated inputs in the Timber run/toJpg.php path, allowing deserialization via phar:// and potentially remote code execution when attackers upload crafted files an...

CVE-2024-34415

CVE-2024-34415 affects Thim Elementor Kit (WordPress plugin). The vulnerability is a Stored XSS due to improper input neutralization during web page generation, affecting Thim Elementor Kit versions up to 1.1.8 (inclusive). Red Hat and Wordfence entries corroborate the issue and classify it as St...

CVE-2024-34420

CVE-2024-34420 is a stored XSS in the WordPress plugin Comments Evolved (gplus-comments) affecting versions n/a through 1.6.3. The Red Hat and CVE descriptions confirm improper input neutralization in web page generation leading to stored XSS. The Wordfence entry notes this vulnerability as authe...

CVE-2024-34426

CVE-2024-34426 refers to a Stored XSS in the Brozzme Scroll Top WordPress plugin (Brozzme Scroll Top) affecting versions up to 1.8.5. The connected data indicates this is an authenticated, admin‑level vulnerability with the issue being present and currently Unpatched; no vendor patch/version reme...

CVE-2024-34431

CVE-2024-34431 corresponds to a Reflected XSS in the WordPress plugin WP etracker , affecting versions up to 1.0.2. The connected sources corroborate a cross‑site scripting vulnerability in WP etracker, with no public exploit data in the provided documents. The Wordfence listing notes the patch s...

CVE-2024-32672

CVE-2024-32672 describes a segmentation fault in Samsung Open Source Escargot JavaScript engine (Escargot 4.0.0) that can be triggered by crafted input to cause a denial of service. Connected sources confirm the affected product and version (Escargot 4.0.0) and the underlying issue is a segmentat...

CVE-2024-3903

CVE-2024-3903 (Add Custom CSS and JS for WordPress) is associated with stored XSS via CSRF due to missing CSRF checks, sanitization, and escaping in multiple areas of the plugin up to version 1.20. Attacker must be authenticated (logged in as a user with at least author privileges) and can trigge...

CVE-2023-5971

The CVE-2023-5971 entry concerns the WordPress plugin Save as PDF by Pdfcrowd (versions before 3.2.0). The issue is that several plugin settings were not properly sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in mult...

CVE-2024-3590

CVE-2024-3590 – LetterPress WordPress Plugin : The vulnerability is due to missing CSRF checks in LetterPress versions

CVE-2024-4672

The CVE-2024-4672 entry describes a cross-site scripting vulnerability in Campcodes Complete Web-Based School Management System 1.0, affecting the file /view/show_student_subject.php. The vulnerability is triggered by manipulating the id parameter, enabling a remote attacker to exploit XSS. Publi...

CVE-2024-30172

CVE-2024-30172 refers to a vulnerability in Bouncy Castle Java Cryptography APIs prior to 1.78 where an Ed25519 verification path can enter an infinite loop when processing a crafted signature and public key. The connected IBM security bulletin confirms the same CVE-ID and recommends upgrading to...

CVE-2024-26517

CVE-2024-26517 is a SQL injection vulnerability in School Task Manager v1.0, exploitable via the delete-task.php component, allowing a remote attacker to obtain sensitive information. The linked documents consistently identify the affected software and component (School Task Manager 1.0, delete-t...

CVE-2024-27281

CVE-2024-27281 affects Ruby/RDoc: parsing .rdoc_options as YAML allows object injection and remote code execution due to unrestrained class restoration (and also if a crafted cache is loaded). Affected RDoc versions are 6.3.3–6.6.2; fixed in RDoc 6.6.3.1 (and vendor-specific bumps: Ruby 3.0 users...

CVE-2024-27280

CVE-2024-27280 describes a buffer-overread in StringIO. The ungetbyte/ungetc methods can read past end, causing StringIO.gets to return memory values. Affected: Ruby 3.0.x up to 3.0.6 and 3.1.x up to 3.1.4; fixed in Ruby 3.0.x by stringio 3.0.1.1 for 3.0 users, and in Ruby 3.1.x by stringio 3.0.1...

CVE-2024-27282

CVE-2024-27282 affects Ruby 3.x through 3.3.0: attacker-supplied data in the Ruby regex compiler may read arbitrary heap data from the start of the text, including pointers and sensitive strings. Fixed versions: 3.0.7, 3.1.5, 3.2.4, and 3.3.1. Multiple connected advisories reference this CVE and ...

CVE-2024-24908

Dell PowerProtect DM5500 (versions 5.15.0.0 and earlier) is affected by CVE-2024-24908 through a directory/path traversal that can allow a remote attacker with high privileges to delete arbitrary files on the server filesystem. Affected component: file system handling within the DM5500 appliance....

CVE-2024-24788

CVE-2024-24788: A malformed DNS message in response to a query can cause the Lookup functions to loop infinitely. Connected docs explicitly reference this issue under Go/Golang components (e.g., container-tools and related advisories) as causing an infinite loop in DNS handling. The initial descr...

CVE-2024-32761

CVE-2024-32761 affects BIG-IP TMM tenants on VELOS and rSeries. The issue is a data leakage in the TMM that can randomly expose up to 64 bytes of non-contiguous randomized data; under rare conditions it may trigger a TMM restart, impacting availability. Affected versions are 15.1.0 through 15.1.9...

CVE-2024-26026

CVE-2024-26026: SQL injection in BIG-IP Next Central Manager API (URI) allows an unauthenticated remote attacker to execute malicious SQL statements. Affected: BIG-IP Next Central Manager versions 20.0.1–20.1.0. Remediation: upgrade to 20.2.0 or later as specified by K000138733; Nessus/K0- querie...

CVE-2024-21793

CVE-2024-21793 : An OData injection vulnerability exists in the BIG-IP Next Central Manager API. Affected: BIG-IP Next Central Manager versions 20.0.1 to 20.1.0. Impact: unauthenticated remote attackers can execute malicious SQL statements via the API, potentially bypassing authentication or exfi...