CVE-2024-24862

A concrete CVE-2024-24862-related entry is present through connected sources describing a Linux kernel vulnerability. The issue is a potential null pointer dereference in the pci1xxxx_spi_probe function, likely triggered by a failed devm_kzalloc memory allocation. Affected software: Linux kernel ...

CVE-2024-3737

CVE-2024-3737 affects cym1102 nginxWebUI up to 3.9.9. The vulnerability is a path traversal in the function findCountByQuery in /adminPage/www/addOver, triggered by manipulation of the dir argument. The issue can be exploited remotely and had publicly disclosed exploits. Affected versions: up to ...

CVE-2024-3735

CVE-2024-3735 affects Smart Office (up to 20240405), targeting the Main.aspx file where manipulating the New Password/Confirm Password argument (input 1) results in weak password requirements. The vulnerability can be triggered remotely with high attack complexity; several sources indicate public...

CVE-2024-3721

CVE-2024-3721 is an OS command injection affecting TBK DVR-4104 and DVR-4216 (firmware up to 20240412). The flaw stems from unsanitized parameters mdb/mdc in HTTP requests to /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX . Successful exploitation allows unauthenticated remote command execution and ha...

CVE-2024-26817

CVE-2024-26817 affects the Linux kernel amdkfd component. The vulnerability arises from using kzalloc with a multiplication that can overflow; the fix replaces kzalloc with calloc to avoid integer overflow. Descriptions in connected Nessus advisories (Unity Linux UTSA advisories) reiterate the sa...

CVE-2024-3719

The CVE-2024-3719 entry pertains to Campcodes House Rental Management System 1.0, with a vulnerability in the ajax.php file where modifying the id parameter enables SQL injection. The affected component is the id parameter in ajax.php; root cause is improper handling of input leading to SQL injec...

CVE-2024-3662

CVE-2024-3662 affects the WPZOOM Social Feed Widget & Block plugin for WordPress. The vulnerability is due to a missing capability check in the function wpzoom_instagram_clear_data(), present in all versions up to and including 2.1.13. This allows authenticated attackers with subscriber-level acc...

CVE-2024-2583

The CVE-2024-2583 entry concerns the WordPress plugin Shortcodes Ultimate (versions before 7.0.5). The vulnerability is a Stored XSS flaw caused by insufficient escaping of certain shortcode attributes before echoing back to users. Impactful for users with the Contributor role; requires user inte...

CVE-2024-32005

CVE-2024-32005 : Local File Inclusion in NiceGUI’s leaflet component allows reading any backend file accessible to the web server via requests to /_nicegui/{version }/resources/{key}/{path:path}. Affected upstream: NiceGUI before 1.4.21. Impact: arbitrary file read on the server. Remediation: upg...

CVE-2024-3697

CVE-2024-3697 concerns Campcodes House Rental Management System 1.0. The vulnerability is an SQL injection in the file manage_tenant.php (parameter id ), enabling remote exploitation. The issue is described as critical with potential for unauthenticated or low-privilege access depending on contex...

CVE-2024-22359

CVE-2024-22359 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. A cross-site scripting vulnerability exists in the Web UI that can allow embedding arbitrary JavaScript to alter functionality and potentially disclose credentials within a trusted session. Affected versions are UCD 7.0–7.0....

CVE-2024-3691

CVE-2024-3691 affects PHPGurukul Small CRM 3.0, specifically the Registration Page. The vulnerability is a SQL injection caused by lack of input validation on the Registration Page, with a network-based, remotely exploitable attack. Public exploit information exists. Potential impact concerns con...

CVE-2024-30398

CVE-2024-30398 – Juniper Junos OS SRX4600 PFE DoS . An improper restriction of operations within the bounds of a memory buffer in the Packet Forwarding Engine (PFE) allows an unauthenticated, network-based attacker to cause a DoS when processing a high amount of specific traffic on SRX4600 device...

CVE-2024-30387

CVE-2024-30387 describes a Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710. When an interface flaps while the system gathers statistics, two processes access a shared resource concurrently, causing a PFE crash and rest...

CVE-2024-31069

CVE-2024-31069 affects IOSiX IO-1020 Micro ELD, where the web server uses a default credential. The ICSA advisory confirms the vulnerability in IO-1020 Micro ELD (versions prior to 360) and notes that exploitation requires only adjacent access with low complexity, potentially allowing an attacker...

CVE-2024-30210

IOSiX IO-1020 Micro ELD is affected by CVE-2024-30210 due to default WIFI credentials in versions prior to 360. The vulnerability allows an adjacent attacker to connect to the device over wireless, with an attacker-adjacent access vector and low attack complexity, potentially yielding high confid...

CVE-2024-30388

CVE-2024-30388 (Junos OS, PFE) : An improper isolation vulnerability in the Packet Forwarding Engine on QFX5000 Series and EX Series allows an unauthenticated adjacent attacker to trigger an LACP flap by receiving a specific malformed LACP packet, causing traffic loss (DoS). Affected: Junos OS on...

CVE-2024-30395

CVE-2024-30395 describes an improper validation of a BGP tunnel encapsulation attribute in Junos OS and Junos OS Evolved RPD, leading to an unauthenticated, network-based DoS. A BGP update containing a specifically malformed TLV can cause Routing Protocol Daemon (rpd) to crash and restart. Affect...

CVE-2024-30405

CVE-2024-30405 is an input but not a generic vulnerability; the connected docs confirm an issue in Juniper Networks Junos OS SRX 5000 Series with SPC2 line cards when ALGs are enabled. The root cause is an incorrect calculation of the buffer size in the ALG module, which lets an attacker send spe...

CVE-2024-30407

The CVE-2024-30407 entry details a vulnerability in Juniper Networks JCNR and containerized routing Protocol Daemon (cRPD) caused by hard-coded cryptographic keys and SSH host keys in containers, enabling Man-in-the-Middle attacks and potentially complete container compromise. Affected versions: ...