CVE-2024-4166

CVE-2024-4166 affects Tenda 4G300, vulnerable in version 1.01.42. The vulnerability lies in the function sub_41E858, where improper handling of the GO/page argument causes a stack-based buffer overflow. Exploitation is described as remotely possible over a network, with high impact on confidentia...

CVE-2024-1347

CVE-2024-1347 affects GitLab CE/EE: all versions before 16.9.6, and 16.10 before 16.10.4, and 16.11 before 16.11.1. Under certain conditions, an attacker can bypass domain-based restrictions using a crafted email address. Root cause: insufficient validation of email-based domain restrictions as d...

CVE-2024-32676

The CVE-2024-32676 entry concerns LoginPress Pro prior to version 3.0.0, with documented details in connected sources indicating a Captcha Bypass in LoginPress Pro (|Captcha Bypass|) and related authorization issues. The vulnerability is categorized as Improper Restriction of Excessive Authentica...

CVE-2024-4164

CVE-2024-4164 affects Tenda G3, specifically the function /goform/ModifyPppAuthWhiteMac::formModifyPppAuthWhiteMac. The parameter pppoeServerWhiteMacIndex can cause a stack-based buffer overflow, enabling a remote attacker to execute arbitrary code on version 15.11.0.17(9502). Publicly disclosed ...

CVE-2023-52220

CVE-2023-52220 is a Missing Authorization/Broken Access Control vulnerability in the WordPress plugin Google Analytics by Monster Insights (versions

CVE-2024-25917

CVE-2024-25917 affects the WordPress WP Setup Wizard plugin prior to version 1.0.8.2, exposing an authentication/authorization bypass that allows an authenticated subscriber or higher to perform an unauthenticated-like action: full database download. Root cause identified as a missing capability ...

CVE-2024-22144

The CVE-2024-22144 entry relates to the WordPress plugin “Anti-Malware Security and Brute-Force Firewall” ≤ 4.21.96, where an improper control of code generation enables unauthenticated code execution (RCE) via a predictable nonce/brute-force approach. Affected component: the plugin’s nonce/autho...

CVE-2023-51484

CVE-2023-51484 is an Improper Authentication vulnerability in the WordPress plugin Login as User or Customer (User Switching) that allows Privilege Escalation. Affected: wp-buy Login as User or Customer (User Switching) up to version 3.8. CVSS 3.1/3.1. Overall risk: 9.8 (CRITICAL) per the CVSS me...

CVE-2023-51482

CVE-2023-51482 is an Improper Authentication vulnerability in WordPress Eazy Plugin Manager (affected: versions n/a through 4.1.2). The flaw allows accessing functionality not properly constrained by ACLs, with references explicitly noting an Arbitrary Options Update leading to Remote Code Execut...

CVE-2023-51478

CVE-2023-51478 (Build App Online) is substantiated by connected PT-secure sources: an improper authentication flaw allows unauthenticated privilege escalation leading to potential account takeover in Build App Online versions 1.0.19 and earlier. The affected software is Build App Online; exploita...

CVE-2023-6237

The CVE-2023-6237 entry concerns OpenSSL EVP_PKEY_public_check() performing an expensive verification on RSA public keys. The issue causes long delays (potential DoS) when keys of untrusted provenance are checked, notably when using the OpenSSL pkey tool with -pubin/-check. The impact is describe...

CVE-2024-33663

CVE-2024-33663 concerns python-jose up to version 3.3.0, where an algorithm confusion occurs between OpenSSH ECDSA keys and other key formats. The issue, described across multiple feeds (CNNVD, Debian tracker, CVE lists), is analogous to CVE-2022-29217 and is framed as a key-format/algorithm conf...

CVE-2024-33661

CVE-2024-33661 affects Portainer prior to 2.20.0, allowing open redirects when the target is not index.yaml. Multiple sources (NVD/OSV/NVD mirrors, Red Hat, Veracode, PT Security) confirm that the vulnerability enables redirection to arbitrary sites, with PT Security additionally describing an SS...

CVE-2024-32236

CmsEasy CVE-2024-32236 affects CmsEasy v7.7 and earlier. The issue resides in the update function of the index.php component, enabling a remote attacker to obtain sensitive information (information disclosure). Affected versions should be updated to a version later than 7.7 to resolve the issue. ...

CVE-2024-32358

CVE-2024-32358 affects JPress v5.1.0. The issue allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, indicating a code execution risk originating from the plug‑in handling path. No remediation patch/version details are provided in the supp...

CVE-2024-33247

CVE-2024-33247 affects Sourcecodester Employee Task Management System v1.0, with a SQL injection vulnerability in the file/admin page admin-manage-user.php. The vulnerability is documented across multiple sources and targets the admin input handling, but the connected documents provide no public ...

CVE-2023-20249

CVE-2023-20249 affects Cisco TelePresence Management Suite (TMS) web-based management interface. Affected component: the TMS web UI; root cause: insufficient input validation in the interface allows an authenticated, remote attacker to perform cross-site scripting (XSS). Impact: attacker can exec...

CVE-2023-20248

CVE-2023-20248 concerns Cisco TelePresence Management Suite (TMS) — Web-based management interface. The issue is an XSS vulnerability caused by insufficient input validation, exploitable by an authenticated, remote attacker who can insert malicious data in a specific data field in the interface. ...

CVE-2024-20313

CVE-2024-20313 affects Cisco IOS XE Software, specifically the OSPFv2 feature. The issue arises from improper validation of OSPF updates, allowing an unauthenticated, adjacent attacker to send a malformed OSPF update that can cause the device to reload and trigger a DoS. Connected sources corrobo...

CVE-2024-20295

CVE-2024-20295 describes a command-injection vulnerability in the Cisco Integrated Management Controller (IMC) CLI. The issue stems from insufficient validation of user-supplied input, allowing an authenticated, local attacker with read-only or higher privileges to submit crafted CLI commands and...