CVE-2024-33260

CVE-2024-33260 concerns Jerryscript: a segmentation fault in the JS parser component, specifically in parser_parse_class within jerry-core/parser/js/js-parser-expr.c, tied to commit cefd391. The entry names a vulnerability in that commit; exploitation details are not provided in the documents. Mu...

CVE-2024-25343

The CVE-2024-25343 entry concerns the Tenda N300 F3 router. Affected product: Tenda N300 F3 router. Vulnerability: allows bypass of the intended security policy and enables creation of weak passwords. Root cause details are not provided in the connected documents beyond the high-severity impact (...

CVE-2024-28322

CVE-2024-28322 affects PuneethReddyHC Event Management 1.0. Affected component: the /event-management-master/backend/register.php endpoint, vulnerable via the event_id parameter in a crafted POST request, enabling SQL injection. Root cause: improper input handling leading to arbitrary SQL executi...

CVE-2024-28328

The connected Red Hat/NVD/Other sources confirm a CSV Injection vulnerability in ASUS RT-N12+ (B1) routers. The flaw stems from insufficient input sanitization in the client name parameter, which, when exporting data to CSV, can allow an administrator to inject commands or formulas that may execu...

CVE-2023-51794

FFmpeg vulnerability CVE-2023-51794 is a local, buffer overflow in FFmpeg built from v.N113007-g8d24a28d06 that allows arbitrary code execution via libavfilter/af_stereowiden.c:120:69. The issue affects the FFmpeg component responsible for audio/video filtering, demonstrated by the specific line ...

CVE-2024-33263

CVE-2024-33263 affects QuickJS; the issue stems from commit 3b45d15, where an Assertion Failure can occur via JS_FreeRuntime(JSRuntime *) in quickjs.c. Public sources (NVD, OSV, Red Hat, Ubuntu/NASL) consistently describe a crash that could lead to denial of service or potential code execution pa...

CVE-2023-26603

Summary: JumpCloud Agent before 1.178.0 creates a temporary file in a directory with insecure permissions, enabling privilege escalation to SYSTEM via a repair action in the installer. This is evidenced across multiple sources (NVD/Red Hat/CNNVD/PT-Security/vulnrichment), which consistently descr...

CVE-2024-30804

The affected product is ASUS Fan Xpert (versions prior to 10013). The vulnerability lies in the DeviceIoControl handling, with a likely buffer overflow in the AsInsHelp64.sys driver that enables arbitrary code execution via crafted IOCTL requests. Exploitation details are present in connected doc...

CVE-2024-33672

CVE-2024-33672 affects Veritas NetBackup prior to 10.4. The Multi-Threaded Agent can be used to perform arbitrary file deletion on protected files, per multiple connected sources. Reported impact includes high confidentiality/availability implications (C/I = HIGH, A = HIGH) with local attack vect...

CVE-2024-31741

MiniCMS v1.11 has a Cross-Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted string in the URL after login. Exploitation may require user interaction per CVSS metrics (UI:R) and is classified with MEDIUM impact. Public sources (CNVD/CNNVD/NVD) descr...

The private sector probably isn’t coming to save the NVD

I wrote last week about the problems arising from the massive backlog of vulnerabilities at the U.S. National Vulnerability Database. Thousands of CVEs are still without analysis data, and the once-reliable database of every single vulnerability thats disclosed and/or patched is now so far behind...

CVE-2024-3624

CVE-2024-3624 concerns Quay’s mirror-registry where database credentials are stored in plain-text in the Jinja config.yaml. The issue, documented in multiple sources, states that a malicious actor with access to that file can gain access to Quay’s database. The connected PT-2024-3593 advisory con...

DoS (Denial of Service) org.apache.struts:struts2-core Dependency in Crowd Data Center and Server

This High severity org.apache.struts:struts2-core Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This org.apache.struts:struts2-core Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-2467

CVE-2024-2467 is a timing-based side-channel vulnerability in the perl-Crypt-OpenSSL-RSA package affecting legacy PKCS#1 v1.5 padding. The issue can enable plaintext recovery over a network under a Bleichenbacher-style attack if an attacker can send many trial messages. Publicly documented fixes ...

CVE-2024-1657

CVE-2024-1657 : A flaw in Red Hat Ansible Automation Platform involves an insecure WebSocket used when interacting with the EDA server during installation from the Ansible rulebook. An attacker with access to any machine in the CIDR block could download all rulebook data, impacting confidentialit...

CVE-2023-6717

CVE-2023-6717 affects Keycloak SAML, where unvalidated assertion-consumer-service (ACS) POST URLs can let a malicious admin inject JavaScript, causing XSS across realms/app contexts. CVSS v3.1 base score 6.0 (Medium) with high impact on confidentiality/integrity, low availability; required admin ...

CVE-2024-33592

CVE-2024-33592: SSRF in the SoftLab Radio Player WordPress plugin (Radio Player) affects versions up to 2.0.73. Public references confirm an SSRF issue; the vulnerability has been patched in a later release. No exploit details are provided in the available documents. If you use Radio Player, veri...

CVE-2024-25569

CVE-2024-25569 affects Grassroots DiCoM (GDCM) 3.0.23. The RAWCodec::DecodeBytes path allows an attacker to supply a crafted DICOM file that can trigger an out-of-bounds read. Affected product/version: Grassroots DICOM 3.0.23 (GDCM). Impact, per sources: out-of-bounds read potentially enabling in...

CVE-2024-4006

CVE-2024-4006 affects GitLab CE/EE: personal access scopes were not honored by GraphQL subscriptions, exposing authorization checks to GraphQL-based access. Affected versions are 16.7 up to 16.9.6 (pre-16.9.6), 16.10 up to 16.10.4 (pre-16.10.4), and 16.11 up to 16.11.1 (pre-16.11.1). The issue ha...

CVE-2024-4175

The CVE-2024-4175 entry concerns Hyperion Web Server (version 2.0.15) with a Unicode transformation vulnerability. The underlying issue allows a attacker-supplied payload using Unicode characters that will be replaced by ASCII characters, potentially affecting data integrity and confidentiality (...