CVE-2024-34484

The CVE-2024-34484 issue concerns Faucet SDN Ryu 4.34. In OFPBucket (parser.py), processing an OpenFlow action with length 0 (action.len=0) can trigger an infinite loop, leading to a Denial of Service. The vulnerability affects the parser’s handling of the OFPBucket construct, and the impact is a...

CVE-2024-34527

SolidUI 0.4.0 is affected by CVE-2024-34527 due to an unnecessary print statement in spaces_plugin/app.py that prints an OpenAI key, which could be logged. Core impact is potential exposure of sensitive information (OpenAI keys) via logs. Root cause: leaking sensitive value through a verbose prin...

CVE-2024-34507

MediaWiki suffers an XSS vulnerability in CommentFormatter/CommentParser.php. Affected are MediaWiki core versions before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1, due to mishandling of the 0x1b character (examples: Special:RecentChanges#%1b0000000). Impact is client-side script exe...

CVE-2024-34487

CVE-2024-34487 affects Faucet SDN Ryu 4.34, where OFPFlowStats in parser.py is vulnerable. The root cause is inadequate input handling in the OFPFlowStats path, allowing an attacker to trigger a denial of service by setting inst.length = 0, potentially causing an infinite loop. The DoS impact is ...

CVE-2024-34524

OpenAgents (XLANG) prior to/through commit fe73ac4 contains a vulnerability in the allowed_file protection mechanism that can be bypassed by uploading content with an incorrect file extension for the content type. The issue affects Software OpenAgents as described by multiple sources (Red Hat, NV...

CVE-2024-34474

CVE-2024-34474 affects Clario for Desktop up to 2024-04-11. The issue is weak permissions for %PROGRAMDATA%\Clario and attempts to load DLLs from that directory with SYSTEM privileges, enabling local privilege escalation if exploited. CVSS v3.1: LOCAL, LOW PR, NONE UI, with high impact on confide...

CVE-2024-34511

CVE-2024-1561 (Gradio) is a local file read vulnerability affecting Gradio 4.3–4.12 where the /component_server endpoint allows invoking arbitrary methods on a Component class with attacker-controlled arguments, enabling local file access. Impact: read arbitrary server files; risk increases when ...

CVE-2024-34490

CVE-2024-34490 affects Maxima up to 5.47.0 before 51704c. The plotting facilities (e.g., plot2d) use predictable file names under /tmp, allowing a local attacker to pre-create files and influence contents. This is a local-impact condition as described in multiple connected sources (Red Hat, NVD/o...

CVE-2024-34525

CVE-2024-34525 affects FileCodeBox 2.0, where a cleartext environment file stores sensitive credentials (OneDrive password and AWS key). Root cause is storing credentials in an unencrypted env file, enabling potential unauthorized access if the file is exposed. Documented remediation/recommendati...

CVE-2024-34508

DCMTK component dcmnet is affected by a segmentation fault caused by an invalid DIMSE message in versions before 3.6.9. The CVE-2024-34508 entry documents this issue with a network-facing DIMSE processing fault that can lead to a crash. The connected advisories consistently indicate remediation b...

CVE-2024-34510

Summary: CVE-2024-34510 affects Gradio prior to 4.20 and allows credential leakage on Windows. The CVSS v3.1 metrics indicate a HIGH severity (base score 7.5) with network attack vector, low attack complexity, no privileges required, and no user interaction. The impact is limited to confidentiali...

CVE-2024-34529

CVE-2024-34529 affects Nebari up to 2024.4.1; the vulnerability arises from printing the temporary Keycloak root password to the console during project initialization, causing sensitive information disclosure. CVSSv3.1 base score 4.8 (Medium); network access, high attack complexity, no privileges...

CVE-2024-34478

CVE-2024-34478 affects btcd before 0.24.0, where the software does not correctly implement BIP 68/BIP 112 consensus rules. The core issue is treating the transaction version as a signed integer instead of unsigned, which can cause consensus failures, potentially leading to a chain split and loss ...

CVE-2024-3237

CVE-2024-3237 affects ConvertPlug/ConvertPlus for WordPress: all versions up to 3.5.25 lack a capability check in cp_dismiss_notice(), enabling authenticated users with subscriber-level access and higher to modify arbitrary options to true. Red Hat and Wordfence references confirm the vulnerabili...

CVE-2024-34473

CVE-2024-34473 affects the appmgr component of the O-RAN Near-RT RIC I-Release. The root cause is that an attacker could register an unintended RMR message type during xApp registration, which can disrupt other service components. The available documents describe the vulnerability and impact but ...

CVE-2024-34475

Open5GS prior to 2.7.1 is affected by a reachable assertion that can cause an AMF crash via NAS messages from a UE. The root cause is in gmm_state_authentication within amf/gmm-sm.c for != OGS_ERROR. Affected software: Open5GS before 2.7.1. Impact is an AMF crash (service disruption). Remediation...

CVE-2022-22364

CVE-2022-22364 affects IBM Controller: 10.4.1, 10.4.2, and 11.0.0. The issue is an External Service Interaction vulnerability caused by improper validation of user-supplied input, allowing a remote attacker to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary...

CVE-2022-48704

CVE-2022-48704 affects the Linux kernel’s DRM/Radeon path. The vulnerability stems from a race/flush issue where the radeon lockup work queue may not be fully flushed before the system enters D3hot, potentially leading to a kernel Oops and a stall in GPU work processing. The described fix adds a ...

CVE-2022-48695

CVE-2022-48695 is a Linux kernel vulnerability in the scsi: mpt3sas driver that results in a use-after-free (refcount_t underflow) observed during controller reset. The issue is fixed in the kernel by the referenced commits listed in the connected sources. The vulnerability is described as a loca...

CVE-2023-28952

Summary: CVE-2023-28952 affects IBM Controller (IBM Cognos Controller) versions 10.4.1, 10.4.2, and 11.0.0. The issue is an injection in application logging caused by not sanitizing user-provided data, with a base CVSS v3.1 score of 5.3 (Medium). The underlying problem is unsanitized input in log...