CVE-2024-29208

The CVE-2024-29208 vulnerability affects UniFi Connect EV Station (≤ v1.1.18), EV Station Pro (≤ v1.1.18), Display (≤ v1.9.324), and Display Cast (≤ v1.6.225). Root cause: unverified password change via API could allow a malicious actor with API access to change the system password without knowin...

CVE-2024-4596

CVE-2024-4596 affects Kimai up to 2.15.0, with information disclosure via manipulation of PHPSESSIONID in the Session Handler. The issue may be exploited remotely; attack complexity is reported as high and exploitation is considered difficult. Upgrading to Kimai 2.16.0 addresses the vulnerability...

CVE-2024-4595

Summary: CVE-2024-4595 affects SEMCMS up to version 4.8, with the vulnerability located in the locate function of function.php. The issue enables SQL injection due to improper validation of external input, and can be exploited remotely. Multiple connected sources corroborate the vulnerable compon...

CVE-2024-32663

Summary: CVE-2024-32663 affects Suricata prior to 7.0.5 and 6.0.19, where a small amount of HTTP/2 traffic can cause Suricata to allocate a large amount of memory. The issue has been fixed in Suricata 7.0.5 and 6.0.19. Impact (as stated): Memory exhaustion under HTTP/2 traffic can lead to degrade...

CVE-2024-34084

CVE-2024-34084 concerns Minder’s HandleGithubWebhook. Multiple connected records confirm a DoS condition caused by untrusted HTTP requests, where the code path reads the entire request body into memory before validation (notably in readerFromRequest/handle_githubwebhooks.go), enabling memory exha...

CVE-2024-31456

GLPI before version 10.0.15 is vulnerable to an authenticated SQL injection via the map search function. The root cause is improper handling of SQL queries in the map search feature, allowing disclosure of protected information. The issue is fixed in GLPI 10.0.15. Mitigation: upgrade to 10.0.15 o...

CVE-2024-29889

Affected software: GLPI (Free Asset and IT Management Software). Vulnerability: SQL injection in the saved searches feature, exploitable by an authenticated user to alter another user’s data and take control of the account. Root cause / details: The issue exists in GLPI versions before 10.0.15; t...

CVE-2023-31234

CVE-2023-31234: Tilda Publishing WordPress plugin

CVE-2024-4538

CVE-2024-4538 is an IDOR vulnerability in Janto Ticketing Software, affecting version 4.3r10. The issue allows a remote attacker to obtain a user’s event ticket by crafting a request using the ticket reference ID, resulting in exposure of sensitive user data. The provided metrics indicate a CVSS ...

CVE-2024-4583

CVE-2024-4583 affects Faraday GM8181 and GM828x up to 20240429, with the vulnerability located in an unknown functionality of the Request Handler that leads to information disclosure. The issue is exploitable remotely, and the public exploit has been disclosed. Upgrading the affected component is...

CVE-2024-4346

The CVE-2024-4346 entry concerns the Startklar Elementor Addons for WordPress, which allows unauthenticated arbitrary file deletion due to improper path validation during file handling. The vulnerability affects all versions up to 1.7.13 and can delete critical files (including wp-config.php), en...

CVE-2024-4345

CVE-2024-4345 is an unauthenticated arbitrary file-upload vulnerability in Startklar Elementor Addons for WordPress (up to version 1.7.13). The StartklarDropZoneUploadProcess::process function validates file types insufficiently, allowing attackers to upload arbitrary files to the server and pote...

CVE-2024-3759

CVE-2024-3759 affects OpenHarmony v4.0.0 and earlier. The vulnerability is a use-after-free in TCB that enables a local attacker to achieve arbitrary code execution. The available sources describe a local threat with high-impact implications (confidentiality, integrity, and availability could be ...

CVE-2024-3758

OpenHarmony CVE-2024-3758 affects OpenHarmony v4.0.0 and earlier. The vulnerability is a heap buffer overflow in the TCB that allows a local attacker to achieve arbitrary code execution. In practice, impact is local, with high confidentiality/integrity/availability concerns per the linked sources...

CVE-2024-3757

OpenHarmony shows a local integer overflow vulnerability (CVE-2024-3757) affecting v4.0.0 and earlier. The issue allows a local attacker to crash the service due to an overflow in a component used by Arkcompiler runtime, with no public exploit details provided in the sources. Affected versions: O...

CVE-2024-31078

OpenHarmony suffers a local vulnerability (CVE-2024-31078) in v4.0.0 and earlier where a NULL pointer dereference can crash a service. The issue is described across multiple sources as a local attack leading to a service crash, with the OpenHarmony lineage prior to 4.0.0 implicated. Root cause de...

CVE-2024-27217

The CVE-2024-27217 entry concerns OpenHarmony v4.0.0 and earlier, where a use-after-free vulnerability in pre-installed apps could allow a local attacker to achieve arbitrary code execution. • Affected product: OpenHarmony (version 4.0.0 and before). • Root cause: use-after-free in pre-installed ...

CVE-2024-3628

The connected Patchstack entry for EasyEvent indicates a Stored XSS vulnerability in EasyEvent WordPress plugin versions

CVE-2024-20869

CVE-2024-20869 affects Samsung Internet prior to 25.0.0.41. The flaw is described as an improper privilege management issue that allows local attackers to bypass protection for cookies, enabling access to sensitive information. The connected sources (NVD/Red Hat PT-Security) confirm the vulnerabl...

CVE-2024-20868

Samsung Notes CVE-2024-20868 affects versions before 4.4.15. The root cause is improper input validation, enabling a local attacker to delete files with Samsung Notes privileges under certain conditions. Remediation: upgrade to Samsung Notes 4.4.15 or later. This information is supported by PT-20...