CVE-2024-25938

CVE-2024-25938 affects Foxit Reader 2024.1.0.23997 and is a use-after-free vulnerability in the Barcode widget. According to Talos, a specially crafted JavaScript in a malicious PDF can trigger reuse of a freed object, leading to memory corruption and potentially arbitrary code execution. Exploit...

CVE-2024-4340

CVE-2024-4340 is a denial-of-service vulnerability in the Python sqlparse library, caused by passing a heavily nested list to sqlparse.parse() which can trigger a RecursionError. Public documentation in the connected items confirms widespread impact across products that bundle sqlparse (e.g., IBM...

CVE-2024-2378

CVE-2024-2378 affects Hitachi Energy SDM600 web-authentication (privilege escalation). Public sources confirm: vulnerable component is the SDM600 web-auth/auth mechanism; exploitation leads to elevated privileges on affected installations. Several advisories reference remediation with a newer SDM...

CVE-2024-2663

CVE-2024-2663 : ZD YouTube FLV Player plugin for WordPress is affected. All versions up to 1.2.6 are vulnerable to Server-Side Request Forgery via the $_GET['image'] parameter. This SSRF allows unauthenticated attackers to issue web requests from the vulnerable web application to arbitrary destin...

CVE-2024-33371

CVE-2024-33371 affects DedeCMS v5.7.113. The vulnerability is a Cross Site Scripting flaw in the makehtml_list_action.php component, exploitable via the typeid parameter to trigger arbitrary code execution. Documents consistently identify the affected software/version and the vulnerable parameter...

CVE-2023-46304

Vtiger CRM 7.5.0 contains a vulnerability in modules/Users/models/Module.php where an unprotected endpoint allows a remote authenticated attacker to write arbitrary PHP code to config.inc.php, which is then executed on every page load. The issue enables remote code execution by leveraging this pa...

CVE-2023-36268

The connected PT-2024-12555 entry links CVE-2023-36268 to The Document Foundation LibreOffice, describing a denial-of-service vulnerability in LibreOffice 7.4.7 triggered by processing a crafted .ppt file. It notes that version 7.4.7 is affected and, as of the entry, no patch information is avail...

CVE-2020-5200

Minerbabe through V4.16 ships with SSH host keys baked into the installation image, enabling MITM attacks and enabling identification of public IPv4 nodes via Shodan. Affected: Minerbabe versions through V4.16. Root cause: SSH host keys embedded in the image. Impact: local access risk with potent...

CVE-2024-29384

CVE-2024-29384 affects CSS Exfil Protection v1.1.0. The vulnerability resides in the functions content.js and parseCSSRules , enabling a remote attacker to obtain sensitive information. The NVD entry lists CVSSv3.1: 7.5 (High) with NETWORK attack vector, no privileges required, no user interactio...

CVE-2023-45385

CVE-2023-45385 affects PrestaShop ProQuality pqprintshippinglabels; a Directory Traversal vulnerability exists in the pqprintshippinglabels module for versions prior to 4.15.0. Root cause: directory traversal via the module. Remediation: update to version 4.15.0 or later. Exploitation details are...

CVE-2024-33273

SQL injection in shipup prior to v3.3.0 allows remote attacker to escalate privileges via the getShopID function. Root cause: unsafely constructed SQL through getShopID leads to high-impact compromise (C, I, A) with network attacker and no user interaction. Affected: shipup versions before 3.3.0....

CVE-2023-50914

CVE-2023-50914 is a local privilege escalation in GOG Galaxy (Beta) IPC between GalaxyClient.exe and GalaxyClientService.exe. From 2.0.67.2 through 2.0.71.2, an authenticated user can forge IPC packets via FixDirectoryPrivileges, altering the DACL of arbitrary system directories to grant Everyone...

CVE-2024-0840

CVE-2024-0840 affects Grandstream UCM Series IP PBX firmwares prior to 1.0.20.52 (UCM6202/6204/6208/6510). A parameter injection vulnerability in the HTTP interface allows a remote, authenticated attacker to execute arbitrary code by sending a crafted HTTP request; authentication may be possible ...

CVE-2024-34011

CVE-2024-34011 affects Acronis Cyber Protect Cloud Agent on Windows prior to build 37758. The vulnerability is caused by insecure folder permissions that enable local privilege escalation. Exploitation details are not provided in the connected documents. The Red Hat and NVD entries corroborate lo...

CVE-2023-48684

Technical details about CVE-2023-48684 are not publicly available in the provided connected documents. Monitor for updated advisories or vendor advisories for affected versions and fixes.

CVE-2023-48683

CVE-2023-48683 affects Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758 and Acronis Cyber Protect 16 before build 39169. Root cause: missing authorization enabling sensitive information disclosure and manipulation. CVSSv3.0 base score 7.1 (HIGH) with LOCAL attack vecto...

CVE-2024-33585

CVE-2024-33585 is described as a Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce, affecting versions up to 2.12.1. Public metrics report CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N with a base score of 4.3 (Medium). Exploita...

CVE-2024-33587

CVE-2024-33587: Missing Authorization in Copy Content Protection and Content Locking (Secure Copy Content Protection). Affects Secure Copy Content Protection and Content Locking versions up to 3.9.0. The initial description identifies a missing authorization issue but does not provide details on ...

CVE-2024-4307

HubBank’s CVE-2024-4307 affects HubBank v1.0.2. The issue is an SQL injection in the id parameter across endpoints /accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /accounts/view_cards.php?id=1, /accounts/wire-transfer.php?id=1 and /accounts/wiretransfer-pending.php?id=1, enabling ...

CVE-2024-4308

CVE-2024-4308 describes a SQL injection vulnerability in HubBank v1.0.2. The affected component is the HubBank application, with the root cause identified as improper handling of the id parameter in multiple admin endpoints (e.g., /admin/view_users.php?id=1, /admin/viewloan-trans.php?id=1, /admin...