CVE-2023-26793

CVE-2023-26793 affects libmodbus v3.1.10 with a heap-based buffer overflow in read_io_status (src/modbus.c). The CVSS v3.1 base score is 9.8 (CRITICAL). Connected sources indicate the vulnerability is unpatched in some environments (Nessus entry notes no vendor patch available); monitor for updat...

CVE-2024-33428

CVE-2024-33428 affects stsaz phiola v2.0-rc22. A buffer overflow in conv.c:68 could allow remote code execution via a crafted .wav file. Impacted component is the wav-file handling in phiola; CVSSv3.1 base score 8.8 (High). No official patch/version is specified in the provided documents. Some so...

CVE-2024-33766

Lunasvg v2.3.9 contains a Floating Point Exception (FPE) in the function blend_transformed_tiled_argb.isra.0, as reported for CVE-2024-33766. The CVE entry documents the vulnerability and notes an impact limited to availability (low) with no confidentiality or integrity impact, and a network atta...

CVE-2024-33775

CVE-2024-33775 affects the Autodiscover component in Nagios XI 2024R1.01 , allowing a remote attacker with low privileges (NAGIOS or APACHE account) to escalate to root by injecting arbitrary code into a crafted Dashlet and executing autodiscover_new.php via sudo. The vulnerability yields full co...

CVE-2024-33424

CMSimple v5.15 is affected by an XSS in the Settings menu, via the Downloads parameter under Language. The vulnerability allows arbitrary web scripts/HTML to run in the user context when a crafted payload is used. Documented by multiple sources (CVE-2024-33424; RH; CNVD/CNNVD variants) with no ex...

CVE-2023-46294

The CVE-2023-46294 issue affects Teledyne FLIR M300 firmware version 2.00–19. Local passwords are stored encrypted but can be decrypted to plaintext using the umSetup utility, which requires root privileges. The risk is that an attacker with local access could decrypt user account passwords via u...

CVE-2024-33304

CVE-2024-33304 affects SourceCodester Product Show Room 1.0. A Cross Site Scripting (XSS) vulnerability exists via the "Last Name" field under Add Users, enabling script injection. The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD/CVE list/PT-Security/Vulnrichment). The pr...

CVE-2024-24312

Summary : CVE-2024-24312 is a SQL injection vulnerability in Vaales Technologies’ V_QRS (version 2024-01-17) affecting the Models/UserModel.php component. The issue can allow a remote attacker to obtain sensitive information. Multiple connected sources corroborate the vulnerability details (produ...

CVE-2024-32213

The CVE-2024-32213 entry concerns the LoMag WareHouse Management application. Affected software: LoMag WareHouse Management v1.0.20.120 and older. Root cause: by default, the system allows hard-coded passwords of 10 characters with little or no complexity, enabling weak authentication. Impact: we...

CVE-2024-33431

The CVE-2024-33431 issue affects phiola v2.0-rc22, where a flaw in phiola/src/afilter/conv.c:115 can be triggered by processing a crafted WAV file, enabling a remote attacker to cause a denial of service. Multiple connected sources (Red Hat, CVE lists, CNNVD, PT Security) corroborate the same des...

CVE-2024-4369

OpenShift OpenShift Container Platform cluster-image-registry-operator is affected by CVE-2024-4369. The flaw exposes AZURE_CLIENT_SECRET via an environment variable in a pod definition on Azure environments. An attacker who can obtain pod information from the openshift-image-registry namespace a...

CVE-2024-4349

CVE-2024-4349 affects SourceCodester Pisay Online E-Learning System 1.0. The vulnerability lies in the /lesson/controller.php file where manipulating the file parameter leads to unrestricted uploads. It can be exploited remotely, and publicly disclosed exploit information exists (VDB-262489). Rem...

CVE-2023-38002

CVE-2023-38002 — IBM Storage Scale : Affected versions are 5.1.0.0 through 5.1.9.2. An authenticated user could steal or manipulate an active session to gain access to the system. Root cause is described as session-related vulnerability affecting GUI/authenticated sessions (no details on underlyi...

CVE-2024-25938

CVE-2024-25938 affects Foxit Reader 2024.1.0.23997 and is a use-after-free vulnerability in the Barcode widget. According to Talos, a specially crafted JavaScript in a malicious PDF can trigger reuse of a freed object, leading to memory corruption and potentially arbitrary code execution. Exploit...

CVE-2024-4340

CVE-2024-4340 is a denial-of-service vulnerability in the Python sqlparse library, caused by passing a heavily nested list to sqlparse.parse() which can trigger a RecursionError. Public documentation in the connected items confirms widespread impact across products that bundle sqlparse (e.g., IBM...

CVE-2024-2378

CVE-2024-2378 affects Hitachi Energy SDM600 web-authentication (privilege escalation). Public sources confirm: vulnerable component is the SDM600 web-auth/auth mechanism; exploitation leads to elevated privileges on affected installations. Several advisories reference remediation with a newer SDM...

CVE-2024-2663

CVE-2024-2663 : ZD YouTube FLV Player plugin for WordPress is affected. All versions up to 1.2.6 are vulnerable to Server-Side Request Forgery via the $_GET['image'] parameter. This SSRF allows unauthenticated attackers to issue web requests from the vulnerable web application to arbitrary destin...

CVE-2024-33371

CVE-2024-33371 affects DedeCMS v5.7.113. The vulnerability is a Cross Site Scripting flaw in the makehtml_list_action.php component, exploitable via the typeid parameter to trigger arbitrary code execution. Documents consistently identify the affected software/version and the vulnerable parameter...

CVE-2023-36268

The connected PT-2024-12555 entry links CVE-2023-36268 to The Document Foundation LibreOffice, describing a denial-of-service vulnerability in LibreOffice 7.4.7 triggered by processing a crafted .ppt file. It notes that version 7.4.7 is affected and, as of the entry, no patch information is avail...

CVE-2023-46304

Vtiger CRM 7.5.0 contains a vulnerability in modules/Users/models/Module.php where an unprotected endpoint allows a remote authenticated attacker to write arbitrary PHP code to config.inc.php, which is then executed on every page load. The issue enables remote code execution by leveraging this pa...