CVE-2024-32316

CVE-2024-32316 affects Tenda AC500 firmware V2.0.1.9(1307). The issue is a stack overflow in the fromDhcpListClient function, caused by inadequate handling of input data. Several sources describe a buffer/stack overflow via the LISTLEN parameter exposed at the /goform/DhcpListClient API endpoint;...

CVE-2024-30952

PESCMS-TEAM v2.3.6 contains a stored XSS vulnerability exploitable via a crafted payload in the domain input field at /youdoamin/?g=Team&m=Setting&a=action. Affected component: domain input handling in the API endpoint; impact: execution of arbitrary web scripts/HTML. Some sources mention a tempo...

CVE-2024-31452

OpenFGA CVE-2024-31452 affects OpenFGA v1.5.0+ with an authorization bypass when calling Check or ListObjects APIs. The root cause relates to exclusion or intersection models (e.g., a but not b, or a and b). The issue is fixed in v1.5.3; remediation is to upgrade to v1.5.3 (or later) to mitigate....

CVE-2024-21118

CVE-2024-21118 affects Oracle Outside In Technology (Outside In Core) in Oracle Fusion Middleware. Affected are Oracle Outside In Technology versions 8.5.6 and 8.5.7. The root cause is insufficient input validation in Outside In Core, enabling a local, low-privileged attacker with logon to the in...

CVE-2024-21103

CVE-2024-21103 concerns Oracle VM VirtualBox (Core) on Linux hosts. Affected are versions prior to 7.0.16; vulnerability allows a local, low-privilege attacker with logon to the host to compromise VirtualBox, potentially leading to takeover. The CVSS v3.1 base score is 7.8 (High impact on confide...

CVE-2024-21102

CVE-2024-21102 affects Oracle MySQL Server (component: Server: Thread Pooling). Affected versions are 8.0.36 and earlier, and 8.3.0 and earlier. The description states an easily exploitable vulnerability that, with network access via multiple protocols and a high-privilege attacker, can lead to a...

CVE-2024-21040

CVE-2024-21040 affects Oracle E-Business Suite, specifically the LOV component in Oracle Complex Maintenance, Repair, and Overhaul (12.2.3–12.2.13). The issue allows an unauthenticated attacker with network access over HTTP to read and modify data, with human interaction required for exploitation...

CVE-2024-21036

CVE-2024-21036 affects Oracle E-Business Suite, specifically the LOV component in Complex Maintenance, Repair, and Overhaul. Affected versions are 12.2.3–12.2.13. The issue stems from insufficient input validation in LOV, enabling an unauthenticated attacker with network access via HTTP to compro...

CVE-2024-21032

CVE-2024-21032 affects Oracle E-Business Suite, specifically the LOV component within Complex Maintenance, Repair, and Overhaul. Affected versions are 12.2.3–12.2.13. The vulnerability can be exploited remotely over HTTP by an unauthenticated attacker; however, successful exploitation requires us...

CVE-2024-21022

CVE-2024-21022 affects Oracle E-Business Suite, specifically the Oracle Complex Maintenance, Repair, and Overhaul component (LOV). Affected versions are 12.2.3–12.2.13. The root cause is insufficient input validation in LOV, leading to an unauthenticated attacker with network access via HTTP bein...

CVE-2024-21020

CVE-2024-21020 affects Oracle E-Business Suite, specifically the Complex Maintenance, Repair, and Overhaul (LOV) component. Affected are versions 12.2.3–12.2.13. The vulnerability allows an unauthenticated, network-based attacker (HTTP) to manipulate data and potentially read sensitive data, with...

CVE-2024-21004

CVE-2024-21004 affects Oracle Java SE (JavaFX) with affected versions Oracle Java SE: 8u401 and Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Root cause: vulnerability in the JavaFX deployment path that loads untrusted code. Impact: can lead to unauthorized update/insert/delete of data i...

CVE-2024-21001

CVE-2024-21001 affects Oracle BI Enterprise Edition (OBIEE) 7.0.0.0.0, with a vulnerability in the BI Platform Security component that allows a low-privileged, network-accessing attacker (HTTP) to potentially modify or read data after user interaction. The issue is described as easily exploitable...

CVE-2024-20994

CVE-2024-20994 affects Oracle MySQL Server, component Server: Information Schema. Affected versions are 8.0.36 and prior, and 8.3.0 and prior. The vulnerability allows a low-privilege, network-accessing attacker to cause a hang or complete DoS of MySQL Server. No exploitation details are provided...

CVE-2024-20954

CVE-2024-20954 affects Oracle GraalVM for JDK (versions 17.0.10, 21.0.2, 22) and Oracle GraalVM Enterprise Edition (20.3.13, 21.3.9) with the Compiler component. It allows an unauthenticated attacker with network access to read data from affected GraalVM instances. Exploitation requires network a...

CVE-2024-31887

The CVE-2024-31887 issue affects IBM Security Verify Privilege On-Premises v11.6.25, where an unauthenticated actor could obtain sensitive information via the SOAP API, representing an information disclosure risk (CVSS v3.1 base score 7.5). The Red Hat/IBM bulletin confirms the affected version a...

CVE-2024-30380

CVE-2024-30380 affects Junos OS and Junos OS Evolved. An adjacent, unauthenticated attacker can trigger a DoS by sending a specific TLV that crashes the l2cpd process, reinitializing STP/RSTP/MSTP/VSTP, MVRP and ERP. Affected versions are: Junos OS: before 20.4R3-S9; 21.2 before 21.2R3-S7; 21.3 b...

CVE-2024-3879

CVE-2024-3879 concerns the Tenda W30E router (firmware 1.0.1.25(633)). The vulnerability is a stack-based overflow in the function formSetCfm of the file /goform/setcfm, triggered by manipulating the funcpara1 parameter. It allows remote exploitation and has been publicly disclosed. Connected sou...

CVE-2024-25911

CVE-2024-25911: WordPress MoveTo plugin

CVE-2023-45000

CVE-2023-45000 is a Missing Authorization vulnerability affecting LiteSpeed Cache (WordPress) up to version 5.7, allowing unauthorized access via the API. The available documents confirm the issue and affected range but do not provide concrete exploitation details, affected sub-components, or a c...