CVE-2024-3536

CVE-2024-3536 affects Campcodes Church Management System 1.0. The vulnerability is a SQL injection in the /admin/delete_log.php file caused by unsafely handling the selector parameter. Exploitation is possible remotely, and public exploit information has been disclosed. Impact is described variab...

CVE-2024-3535

CVE-2024-3535 describes a critical SQL injection in Campcodes Church Management System 1.0, arising from the password parameter in /admin/index.php. The vulnerability permits remote exploitation and has publicly disclosed exploits (VDB-259905). Multiple sources corroborate the issue and its linka...

CVE-2024-3534

CVE-2024-3534 affects Campcodes Church Management System 1.0. The issue is a SQL injection in login.php via the password parameter, enabling remote exploitation. Several connected sources confirm a critical risk (network vector, low attack complexity, no privileges required) and that the vulnerab...

CVE-2024-3531

CVE-2024-3531 affects Campcodes Complete Online Student Management System 1.0, with a vulnerability in the file courses_view.php where manipulating the argument FirstRecord enables cross-site scripting (XSS). The issue can be exploited remotely, and public exploits have been disclosed. Multiple c...

CVE-2024-3529

The CVE-2024-3529 entry concerns Campcodes Complete Online Student Management System 1.0. The vulnerability affects an unknown portion of the file students_view.php, where manipulation of the FirstRecord argument enables cross-site scripting. It is possible to initiate the attack remotely, and th...

CVE-2024-3528

CVE-2024-3528 affects Campcodes Complete Online Student Management System 1.0. Affected component: units_view.php. Root cause: manipulation of the FirstRecord argument leads to cross-site scripting (XSS). Impact: enables remote exploitation with arbitrary script execution; exploit disclosed publi...

CVE-2024-3526

CVE-2024-3526 affects Campcodes Online Event Management System 1.0. An XSS flaw exists in the index.php file where the msg parameter is not properly filtered/escaped, allowing remote injection of arbitrary script code. Several connected sources describe the issue and confirm that the vulnerabilit...

CVE-2023-40148

CVE-2023-40148 is a PingFederate SSRF vulnerability. The issue: an unauthenticated attacker can make forged HTTP POST requests to trigger server-side requests, potentially reaching internal network resources and consuming server-side resources. Documents identify PingFederate as affected; root ca...

CVE-2024-27474

Leantime 3.0.6 has a CSRF vulnerability allowing an attacker to perform unauthorized actions with admin privileges. Exploitation evidence exists (PoC repo) and multiple sources confirm the issue. No publicly documented fix version is provided in the connected documents; some sources indicate no i...

CVE-2024-29500

CVE-2024-29500 concerns the Secure Lockdown Multi Application Edition (Inteset) v2.00.219, where the kiosk mode permits an attacker to execute arbitrary code by running a ClickOnce application instance. The initial description and connected sources consistently state this is tied to the kiosk mod...

CVE-2024-29460

CVE-2024-29460 affects PX4 Autopilot v1.14.0, specifically the mission_block.cpp component. The issue enables an attacker with local access to manipulate the flight path via the home point, potentially causing a drone crash. Multiple connected sources (NVD, Red Hat) corroborate that the vulnerabi...

CVE-2024-23083

Time4J Base v5.9.3 is described as containing a NullPointerException in net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). The description notes this finding is disputed by third parties and that there may be insufficient evidence to determine a vulnerability. No explicit exploi...

CVE-2024-30724

CVE-2024-30724 entry rejected; this candidate was withdrawn and does not represent an active vulnerability.

CVE-2024-23080

CVE-2024-23080 involves Joda-Time 2.12.5 with a denial-of-service condition caused by a NullPointerException in org.joda.time.format.PeriodFormat::wordBased(Locale). IBM bulletin confirms affected product: IBM watsonx Orchestrate Cartridge (and IBM Cloud Pak for Business Automation components) wi...

CVE-2024-29447

ROS2 Humble Hawksbill (version 2) is identified in connected sources as having an issue where default configurations allow unauthenticated access via default credentials. This vulnerability surface is tied to the default credential behavior, enabling unauthorized access if defaults are not change...

CVE-2024-29504

CVE-2024-29504 affects Summernote up to v0.8.18 (and earlier). The root cause described across connected sources is improper sanitization of the codeview parameter, leading to Cross Site Scripting (XSS) that can allow execution of arbitrary JavaScript in the context of the affected page. Impact d...

CVE-2024-30727

CVE-2024-30727 is rejected/not used; does not represent an active vulnerability entry.

CVE-2023-52070

CVE-2023-52070 concerns JFreeChart v1.5.4 with an alleged ArrayIndexOutOfBounds in setSeriesNeedle(int index, int type). The description on multiple sources notes that the vulnerability’s existence is disputed by third parties, and that the submission may rely on an insufficiently robust identifi...

CVE-2024-23077

JFreeChart v1.5.4 is reported to have an ArrayIndexOutOfBounds issue in /chart/plot/CompassPlot.java. The affected component is the CompassPlot class within JFreeChart, with the vulnerability described as an array index out-of-bounds access. Several connected sources (Red Hat, SUSE, Ubuntu, NVD, ...

CVE-2024-3523

CVE-2024-3523 is a reported SQL injection in Campcodes Online Event Management System v1.0, triggered by manipulating the ID parameter in the /views/index.php file. The vulnerability is exploitable remotely, with the exploit publicly disclosed. Affects unknown code paths in the identified file; i...