CVE-2024-21979

CVE-2024-21979 affects AMD Radeon DirectX 11 Shader functionality via atidxx64.dll (Radeon DirectX 11 Driver). The root cause is an out-of-bounds/write vulnerability in shader handling that can be triggered by a malformed shader, potentially allowing arbitrary code execution. Affected version ide...

CVE-2024-28130

CVE-2024-28130 affects OFFIS DCMTK 3.6.8 (DVPSSoftcopyVOI_PList::createFromImage) with a malformed file enabling arbitrary code execution. Public references in Debian (DCMTK 3.6.5-1+deb11u1 fix), Ubuntu security advisory USN-7010-1, and Fedora dcmtk 3.6.9-2.fc42 indicate multiple distributions ha...

CVE-2024-2477

CVE-2024-2477 affecting wpDiscuz for WordPress: Stored XSS via the image Alt text in image uploads exists in all versions up to 7.6.15 due to insufficient input sanitization/output escaping. The Red Hat advisory and Wordfence note describe the vulnerability as present in wpDiscuz and detail that ...

CVE-2023-47731

IBM QRadar Suite Software (1.10.12.0–1.10.19.0) and IBM Cloud Pak for Security (1.10.0.0–1.10.11.0) are affected by a stored cross-site scripting flaw in the Web UI. The issue allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Remediatio...

CVE-2024-3911

Welotec SMART EMS WebUI is affected by CVE-2024-3911 (clickjacking) due to improper restriction of rendered UI layers or frames. An unauthenticated remote attacker can deceive users into unintended actions. Affected versions are prior to 3.1.4. Remediation: upgrade to 3.1.4 or later where fixed. ...

CVE-2024-2493

CVE-2024-2493 : A session hijacking vulnerability affects Hitachi Op s Center Analyzer (versions 10.0.0-00 up to, but not including, 11.0.1-00). The root cause is a flaw allowing an attacker to hijack an active session, compromising access control. Impact details are described as a session hijack...

CVE-2024-31077

CVE-2024-31077 affects Forminator (WordPress plugin) prior to 1.29.3. The issue is an SQL Injection in the admin-facing form handling that can be triggered by an authenticated admin, enabling access/alteration of database data and potential DoS. Remediation is to upgrade Forminator to 1.29.3 or l...

CVE-2024-1241

CVE-2024-1241 affects Watchdog Antivirus v1.6.415. The vulnerability allows a Denial of Service by triggering the 0x80002014 IOCTL in the wsdk-driver.sys driver, leading to availability impact (CVSS 3.1 indicates Availability Impact = High). Existing connected sources corroborate the DoS effect a...

CVE-2024-2760

Summary: CVE-2024-2760 affects Bkav Home v7816 (build 2403161130). A kernel memory information leak can be triggered via the 0x222240 IOCTL code of the BkavSDFlt.sys driver, exposing memory contents. Affected component: BkavSDFlt.sys driver in Bkav Home. Impact: local attacker could disclose memo...

openSUSE: Security Advisory for the Linux Kernel (SUSE-SU-2024:1332-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-48183

CVE-2023-48183 affects QuickJS prior to commit c4cdd61. The vulnerability stems from an erroneous lexical scope of the value of this with eval, causing a NULL pointer dereference in build_for_in_iterator. Documented impact includes possible crashes/denial of service and potential arbitrary code e...

CVE-2024-30886

Issue summary: CVE-2024-30886 is a stored XSS in HadSky v7.6.3, specifically in the remotelink function where an attacker can inject a crafted payload into the url parameter to execute arbitrary web scripts/HTML. Affected component: HadSky, version 7.6.3, remotelink functionality. Root cause & im...

CVE-2024-33217

CVE-2024-33217 affects Tenda FH1206 (1.2.0.8(8155) EN). A stack-based buffer overflow exists in the ip/goform/addressNat endpoint, triggered via the page parameter in fromAddressNat. The root cause is improper input validation leading to potential overflow. Documented impacts include possible den...

CVE-2024-32258

The CVE-2024-32258 entry concerns FCEUX 2.7.0’s network server (NetPlay). A path traversal vulnerability exists due to inadequate filtering of ROM file names, allowing an unauthenticated attacker to overwrite arbitrary files on the server by sending a crafted ROM load request. Documentation in th...

CVE-2024-32656

CVE-2024-32656 affects Ant Media Server (versions 2.6.0–2.8.2). The issue arises because JMX is enabled and unauthenticated on localhost:5599/TCP, allowing an unprivileged user to exploit the MLet bean to load a remote MBean and execute code in the antmedia process, effectively escalating to root...

CVE-2024-27349

CVE-2024-27349 (Apache HugeGraph-Server) is an Authentication Bypass by Spoofing vulnerability affecting 1.0.0–1.0.x up to but not including 1.3.0. The issue allows bypassing authentication (network access, no user interaction) and has high impact on confidentiality and integrity with a CVSS v3.1...

CVE-2024-32681

CVE-2024-32681 is a Missing Authorization vulnerability affecting BdThemes Prime Slider – Addons For Elementor. Reported to affect Prime Slider – Addons For Elementor versions from n/a up to 3.13.2. The connected sources corroborate the issue but do not provide detailed technical reproduction, CV...

CVE-2024-32684

CVE-2024-32684 is a Missing Authorization vulnerability in the WordPress plugin “WP Ultimate Review.” The vulnerability affects WP Ultimate Review versions 2.2.5 and earlier (per the CVE entry: “from n/a through 2.2.5”). Public records in the initial document indicate a high-severity impact with ...

CVE-2024-32688

CVE-2024-32688 is a Missing Authorization vulnerability in the MyRewards plugin for WooCommerce (MyRewards). Affected range: up to version 5.3.0. The issue is documented by Red Hat and Wordfence, with Patch/Patched status indicating a fix has been released. CVSS 3.1 score is 6.5 (Network, Low com...

CVE-2024-32698

CVE-2024-32698 affects WordPress Happy Addons for Elementor plugin up to version 3.10.4 (Leevio) and is caused by improper neutralization of input during web page generation, leading to Stored Cross-Site Scripting (XSS). The issue is documented across multiple sources (NVD, Red Hat, CVE List) wit...