CVE-2024-20867

Samsung Email prior to 6.1.91.14 has an improper privilege management vulnerability (CVE-2024-20867) that allows local attackers to access sensitive information. Affected component: Samsung Email; root cause: privilege mismanagement enabling unauthorized local access. Remediation: update to versi...

CVE-2024-20862

CVE-2024-20862 affects SveService on Samsung Mobile devices prior to SMR May-2024 Release 1. The vulnerability is an out-of-bounds write that enables local privileged attackers to execute arbitrary code. Exploitation details are not provided in the sources, and no in-the-wild exploit information ...

CVE-2024-20857

CVE-2024-20857 affects CocktailBarService: startListening exposes information due to improper access control, with affected versions prior to SMR May-2024 Release 1. Exploitation details are not provided in the documents. PT-Security lists a workaround to disable startListening as a temporary mea...

CVE-2024-33781

MP-SPDZ v0.3.8 is affected by a stack overflow in octetStream::get_bytes (Tools/octetStream.cpp), enabling DoS via a crafted message. No exploit details are provided in the documents. Some sources suggest temporary workarounds: disable the octetStream::get_bytes function and restrict access to /T...

CVE-2024-33147

CVE-2024-33147 affects the J2EEFAST project, specifically version 2.7.0, with a SQL injection vulnerability in the authRoleList function exposed via the sql_filter parameter. The root cause is lack of input validation for external SQL statements in that function, enabling attackers to execute arb...

CVE-2024-29150

The CVE affects Alcatel-Lucent ALE NOE deskphones (86x8 NOE-R300.1.40.12.4180 and earlier) and SIP deskphones (86x8_SIP-R200.1.01.10.728 and earlier). The root cause is improper privilege management that allows an authenticated attacker to create symbolic links to sensitive files in debugging dat...

CVE-2024-33144

CVE-2024-33144 affects J2EEFAST v2.7.0. The vulnerability is a SQL injection in the sql_filter parameter of the findApplyedTasksPage function in BpmTaskMapper.xml. The underlying issue is lack of validation of external input in that parameter, enabling an attacker to craft SQL statements that cou...

SUSE: Security Advisory (SUSE-SU-2023:2232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-25508

RuvarOA is affected in v6.01–v12.01 by a SQL injection via the id parameter in the bulletin_template_show.aspx endpoint. Root cause: lack of input validation on id leading to arbitrary SQL execution that can read/modify data. References from multiple sources confirm the vulnerable versions and th...

CVE-2024-33120

CVE-2024-33120 affects Roothub v2.5, where an arbitrary file upload vulnerability in the upload() function via the customPath parameter allows remote code execution through a crafted JSP file. Reported impact is full confidentiality, integrity, and availability compromise (high). Connected source...

CVE-2024-33146

CVE-2024-33146 affects J2EEFAST v2.7.0. A SQL injection flaw exists in the export function via the sql_filter parameter, enabling manipulation of SQL statements and potential data exposure. The CVSS v3.1 base score is 9.1 (CRITICAL) with network access, no user interaction, and no privileges requ...

CVE-2024-33149

CVE-2024-33149 affects J2EEFAST v2.7.0, where a SQL injection vulnerability exists in the myProcessList function via the sql_filter parameter. Root cause described in CNVD-2024-33145 as lack of validation of externally provided SQL statements, enabling execution of arbitrary SQL commands and pote...

CVE-2024-33783

MP-SPDZ v0.3.8 contains a segmentation violation in osuCrypto::SilentMultiPprfReceiver::expand (SilentPprf.cpp), enabling a Denial of Service via a crafted message. Impact: DoS. Affected component: SilentMultiPprfReceiver::expand in MP-SPDZ 0.3.8. Mitigation/workaround: PT-2024-25478 recommends d...

CVE-2024-33859

Summary: CVE-2024-33859 affects Logpoint versions prior to 7.4.0. The vulnerability arises from HTML code in logs not being escaped in the “Interesting Field” Web UI, enabling cross‑site scripting (XSS). Affected software: Logpoint before 7.4.0. Root cause: insufficient escaping in the Interestin...

CVE-2024-33748

CVE-2024-33748 affects Maven net.mingsoft MS Basic 2.1.13.4 and earlier. The issue is a Cross-site Scripting (XSS) vulnerability in the search function caused by insufficient input sanitization in the affected product, enabling injection of script code in users’ browsers. The CVE entry reports a ...

CVE-2024-34517

Summary: CVE-2024-34517 affects the Cypher component in Neo4j 5.0.0–5.19.0, where IMMUTABLE privileges can be mishandled in certain scenarios if an attacker already has admin access. The issue is documented across multiple sources (CVE entry, RH advisory, GHSA, OSV references). Impact (as stated)...

openSUSE Security Advisory (SUSE-SU-2024:1480-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-25511

CVE-2024-25511 affects RuvarOA v6.01 and v12.01, where an SQL injection can be triggered via the id parameter in /AddressBook/address_public_new.aspx. The underlying issue is lack of validation of external SQL statements, enabling attackers to execute arbitrary SQL commands and potentially access...

CVE-2024-25514

RuvarOA versions 6.01 and 12.01 are affected by a SQL injection vulnerability in the template_id parameter of /SysManage/wf_template_child_field_list.aspx. The issue originates from lack of input validation in the affected endpoint. Documented impact includes potential data exposure or manipulati...

CVE-2024-34314

CmsEasy v7.7.7.9 contains a local file inclusion vulnerability exploitable through file_get_contents in the fetch_action() of /admin/template_admin.php, enabling reading arbitrary files. The issue is documented across multiple feeds (NVD, Red Hat, CVE databases). The available sources do not prov...