CVE-2024-4240

CVE-2024-4240 affects Tenda W9 1.0.0.7(4456). The vulnerability is in the function formQosManageDouble_user where manipulating the argument ssidIndex causes a stack-based buffer overflow . This can be triggered remotely, per multiple sources, indicating a network-delivered risk with potential arb...

CVE-2022-48611

CVE-2022-48611 is tied to Apple iTunes on Windows, where a logic issue could allow a local attacker to elevate privileges. The issue is addressed in iTunes 12.12.4 for Windows, per multiple sources (NVD, Red Hat, CVE lists, and Apple security content). The Red Hat and NVD descriptions concur that...

CVE-2024-32884

The CVE-2024-32884 issue affects gitoxide’s gix-transport component. A crafted clone URL can bypass checking the username portion of the URL, allowing characters that the external SSH program would interpret as options, which can smuggle SSH options and, in a malicious context (e.g., with a malic...

CVE-2024-4236

CVE-2024-4236 affects Tenda AX1803 1.0.0.1. The vulnerability resides in the function formSetSysToolDDNS of the file /goform/SetDDNSCfg, where manipulation of the arguments serverName, ddnsUser, ddnsPwd, and ddnsDomain leads to a stack-based buffer overflow. It is described as exploitable remotel...

CVE-2023-41290

CVE-2023-41290 is a path-traversal vulnerability in QNAP’s QuFirewall. It affects versions prior to 2.4.1 and, if exploitable, could allow an authenticated administrator to read contents of unexpected files and expose sensitive data over the network. A fix is available in QuFirewall 2.4.1 (2024-0...

CVE-2023-41291

CVE-2023-41291 is a path traversal vulnerability in QuFirewall affecting versions prior to 2.4.1. The issue could allow authenticated administrators to read contents of unexpected files and expose sensitive data via a network. QuFirewall 2.4.1 (2024-02-01) and later fixes the flaw. The CVE detail...

CVE-2023-50362

CVE-2023-50362 affects QNAP QTS and QuTS Hero. A buffer copy without input size checking enables authenticated users to execute code over the network. Affected versions are QTS 5.1.6.2722 build 20240402 and later and QuTS Hero h5.1.6.2734 build 20240414 and later. Mitigation: upgrade to the fixed...

CVE-2023-50363

CVE-2023-50363 affects QNAP QTS and QuTS hero. An incorrect/ improper authorization vulnerability could allow authenticated users to bypass access restrictions over the network. Fixed in QTS 5.1.6.2722 build 20240402+ and QuTS hero h5.1.6.2734 build 20240414+. Affects multiple QNAP OS versions; r...

CVE-2024-21905

CVE-2024-21905 is an integer overflow/wraparound vulnerability affecting QNAP QTS, QuTS Hero, and QuTScloud. The issue could allow an attacker to compromise the system remotely over the network. Affected/confirmed versions include QTS 5.1.3.2578 build 20231110 and later, QuTS Hero h5.1.3.2578 bui...

CVE-2024-27124

CVE-2024-27124 is an OS command injection vulnerability affecting QNAP QTS, QuTS hero, and QuTScloud. Exploitation could allow an attacker to execute arbitrary commands over the network, with no required privileges and user interaction needed. The issue has been fixed in: QTS 5.1.3.2578+ (build 2...

CVE-2024-32764

Summary: CVE-2024-32764 affects QNAP’s myQNAPcloud Link. The issue is a missing authentication for a critical function accessible over the network, potentially allowing a user with existing functional privileges to exploit it. Affected product/version: myQNAPcloud Link prior to 2.4.51 (vulnerable...

CVE-2024-32766

CVE-2024-32766 is an OS command injection affecting QNAP QTS (5.1.3.2578+), QTS (4.5.4.2627+), QuTS hero (h5.1.3.2578+, h4.5.4.2626+), and QuTScloud (c5.1.5.2651+). Root cause: insufficient input sanitization allowing network-executed commands. Affected versions are listed; fixes are provided in ...

CVE-2022-40975

The CVE-2022-40975 entry concerns the WordPress Post Slider plugin, affected versions

CVE-2024-3076

CVE-2024-3076 affects the MM-email2image WordPress plugin (versions up to 0.2.5). Public Red Hat/NVD entries describe lack of CSRF checks in some areas and missing sanitisation/escaping, enabling a logged-in admin to store XSS payloads via CSRF. Public sources corroborate Stored XSS via CSRF in M...

CVE-2024-4234

CVE-2024-4234 affects WordPress Filterable Portfolio plugin; stored XSS due to improper input neutralization in web page generation. Affected versions: 1.6.4 and earlier (n/a–1.6.4). Root cause: improper neutralization of inputs leading to stored cross-site scripting. No public details on a fixed...

CVE-2024-33688

Extend Themes Teluro WordPress theme, versions 1.0.0–1.0.31, are affected by a Cross-Site Request Forgery (CSRF) vulnerability. The issue allows unauthenticated or authenticated actions to be executed on behalf of a user (per Patchstack: unauthenticated privilege; user interaction required). Root...

CVE-2024-33690

Technical details about CVE-2024-33690 (Jegstudio Financio CSRF, affected up to 1.1.3) are not provided in the connected documents. Monitor for official advisories for affected versions, impact, and remediation.

CVE-2024-33691

CVE-2024-33691 is a Cross-Site Request Forgery (CSRF) vulnerability in the OptinMonster Popup Builder for WordPress (Plugin: Popup Builder by OptinMonster) tracked across multiple sources. Affected versions are listed as up to 2.15.3 (n/a through 2.15.3). The connected data describe exploitation ...

CVE-2024-33697

CVE-2024-33697 is a Stored XSS in the CF7 File Download – File Download for CF7 plugin (Rimes Gold CF7 File Download). The connected Red Hat entry specifies the root cause as Improper Neutralization of Input During Web Page Generation and states that the vulnerability affects CF7 File Download – ...

CVE-2024-32822

Technical details for CVE-2024-32822 are not provided in the supplied documents. No affected product/version or remediation details are disclosed here. Monitor for official advisories to obtain exact impact and fixes.