CVE-2024-32697

Technical details about CVE-2024-32697 (HelloAsso) are not provided in the supplied documents. Monitor official advisories and vendor/security partner updates for full technical specifics and remediation.

CVE-2023-7252

CVE-2023-7252 affects the Tickera WordPress Event Ticketing plugin (before 3.5.2.5). Multiple sources confirm an Insecure Direct Object Reference (IDOR) condition that permits leakage of other users’ tickets due to insufficient access controls. The issue is tracked in public CVE records with the ...

CVE-2024-27574

SQL Injection vulnerability in Trainme Academy, version Ichin v.1.3.2, allows remote attackers to retrieve sensitive information via the parameters informational, idcurso, and tit. The issue is rooted in improper handling of input leading to unauthorized data exposure. Affected component is Train...

CVE-2024-22815

CVE-2024-22815 affects the Tormach xsTECH CNC Router with PathPilot Controller v2.9.6, where a vulnerability in the communication protocol can be triggered by crafted commands to cause a Denial of Service. The issue is described across multiple sources without extensive exploit details; the Red H...

CVE-2024-31545

CVE-2024-31545 affects Computer Laboratory Management System v1.0 and is caused by a vulnerable SQL path in the admin interface: the endpoint "/admin/?page=user/manage_user&id=6" can be exploited via the id parameter to perform SQL Injection. The CVSS 3.1 base score is 9.4 (CRITICAL) with network...

CVE-2023-38293

CVE-2023-38293 concerns Nokia C200/C100 devices with a pre-installed com.tracfone.tfstatus app. It allows local third-party apps to inject and execute arbitrary AT commands in the radio context by exploiting two input/injection techniques via a broadcast to com.tracfone.tfstatus/.TFStatus, with n...

CVE-2022-34562

CVE-2022-34562 is a cross-site scripting (XSS) vulnerability in PHPFox v4.8.9. The flaw enables attackers to run arbitrary web scripts/HTML through a crafted payload injected into the status box. Affected software: PHPFox 4.8.9. Underlying cause: XSS in the status box (no additional technical det...

CVE-2024-28722

CVE-2024-28722 affects Innovaphone myPBX v12r2–14r1. A cross-site scripting flaw allows a remote attacker to trigger arbitrary code execution via the query parameter to /CMD0/xml_modes.xml. Impact notes from sources indicate web UI/scriptable context with potential credential concerns in related ...

CVE-2024-29376

Summary: CVE-2024-29376 affects Sylius 1.12.13 with a Cross Site Scripting (XSS) flaw in the Province field of the Address Book (and Checkout flow). The public advisories confirm an XSS payload risk when saving/entering the Province value, enabling script execution on affected pages. Root cause d...

CVE-2024-28717

CVE-2024-28717 affects OpenStack Storlets (yoga-eom) with a remote code execution risk through the gateway.py component. The connected documents consistently describe arbitrary code execution via gateway.py, but do not provide concrete vendor/version details beyond OpenStack Storlets yoga-eom, no...

CVE-2024-32394

CVE-2024-32394 affects Ruijie RG-RSR10-01G-T(WA)-S devices (RSR 3.0(1)B9P2 and RSR10-01G-TW-S 07150910). The issue permits remote code execution via a crafted HTTP request, with CVSSv3.1 metrics indicating adjacent access, no privileges required, and user interaction not needed; impact is High on...

CVE-2024-29733

CVE-2024-29733 describes an Improper Certificate Validation in the Apache Airflow FTP Provider. The FTP hook does not perform complete certificate validation for FTP_TLS connections, which could be leveraged to bypass trust checks. The documented mitigation is to pass a proper SSL context (contex...

CVE-2024-4022

KCVEs: CVE-2024-4022 affects Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 up to version 4.1.2.15, with information disclosure via the Version Data Handler’s /version.js file. Root cause: improper handling/exposure of service data enables remote exploitation; attack vector is NETWORK with low ...

CVE-2024-4021

CVE-2024-4021 affects Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 up to version 4.1.2.15. The vulnerability is in /ndmComponents.js of the Configuration Setting Handler, where manipulation of an unknown function leads to information disclosure. The issue is exploitable remotely and the explo...

CVE-2024-4020

The connected documents confirm CVE-2024-4020 affects Tenda FH1206 firmware version 1.2.0.8(8155). The vulnerability targets the fromAddressNat function in /goform/addressNat, where improper handling of the entrys parameter leads to a buffer overflow. Exploitation is described as remote and has b...

CVE-2024-1480

Summary: CVE-2024-1480 affects Unitronics Vision Legacy PLCs (Vision 230, 280, 290, 530, 120). Affected component is the Information Mode password handling, where passwords can be retrieved in plaintext without authentication. The root cause is storing passwords in a recoverable format (CWE-257)....

CVE-2024-32652

Summary: CVE-2024-32652 affects the Node.js adapter @hono/node-server. Before version 1.10.1, handling of invalid Host header values (e.g., empty strings or values not parseable as a hostname) could cause the application to hang via an Invalid URL error. The advisory states that 1.10.1 fixes the ...

CVE-2024-2440

A race condition in GitHub Enterprise Server allowed an existing admin to retain permissions on a detached repository by issuing a GraphQL mutation to alter repository permissions while the repository was detached. Affected: all GitHub Enterprise Server versions prior to 3.13. Fixes are available...

CVE-2023-37397

IBM Aspera Faspex versions 5.0.0–5.0.7 have a trust/encryption issue where data is improperly encrypted, allowing a local user to obtain or modify sensitive information. This vulnerability is documented across multiple sources (IBM bulletin, NVD, CNVD/CNNVD) with the affected product/version rang...

CVE-2024-29991

CVE-2024-29991 affects Microsoft Edge (Chromium-based). The entry describes a Security Feature Bypass vulnerability in Edge with CVSS v3.1 base score 5.0 (Network, High attack complexity, Privileges None, User Interaction Required, Confidentiality/Integrity/Availability Low to None). Connected so...