CVE-2024-1588

The CVE CVE-2024-1588 affects the WordPress plugin “SendPress Newsletters” up to version 1.23.11.6. The issue is an Admin+ Stored XSS via Settings vulnerability caused by insufficient sanitisation/escaping of certain settings, enabling stored cross-site scripting by high-privilege users (e.g., ad...

CVE-2024-1589

The CVE-2024-1589 issue affects the WordPress SendPress Newsletters plugin up to version 1.23.11.6. The root cause is that certain settings are not properly sanitised/escaped, enabling Stored Cross-Site Scripting (stored XSS) by high-privilege users (e.g., admins), even when unfiltered_html is di...

CVE-2023-52536

CVE-2023-52536 involves a vulnerability in the faceid service where a missing bounds check allows an out-of-bounds read, potentially causing local denial of service with System execution privileges. Affected software is the faceid service in UNISOC chipsets; records cite a CVSS v3.1 base score of...

CVE-2023-52535

The CVE-2023-52535 issue affects the vsp driver (Unisoc/UNISOC-chipset context) and is caused by missing verification for an incorrect input. It is described as potentially enabling local denial of service with no additional privileges required. Publicly cited details come from PT-2024-14607 (Vsp...

CVE-2023-52534

This CVE concerns the ngmm component. The root cause is incorrect error handling that can lead to undefined behavior, resulting in remote denial of service. Affected software is ngmm; the exact versions are not specified in the provided documents. Impact is limited to availability (DoS) with no u...

CVE-2023-52533

The CVE-2023-52533 entry concerns the modem-ps-nas-ngmm component, where incorrect error handling may cause undefined behavior. This could enable remote information disclosure without additional privileges. Public sources (NVD/Red Hat/CVE records) state the impact as information disclosure with n...

CVE-2023-52343

CVE-2023-52343 concerns UNISOC chipsets with a vulnerability in the SecurityCommand message after security is activated. The root cause is improper input validation, which could lead to remote information disclosure without requiring additional execution privileges. Documents do not specify affec...

CVE-2023-52344

CVE-2023-52344 affects UNISOC’s modem-ps-nas-ngmm. The issue is an undefined behavior caused by incorrect error handling in the module, potentially enabling remote information disclosure over a network with no additional execution privileges required. CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/...

CVE-2023-52345

The CVE-2023-52345 entry concerns a vulnerability in the modem driver where improper input validation can cause a system crash, potentially enabling local information disclosure with System execution privileges. Affected component: modem driver (details on vendor/product not explicitly enumerated...

CVE-2023-52341

Technical details (affected products, versions, root cause, impact, and mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-3437

CVE-2024-3437 affects SourceCodester Prison Management System 1.0, specifically the Avatar Handler in /Admin/add-admin.php. The avatar parameter can be manipulated to achieve unrestricted file upload, enabling remote exploitation. Multiple sources confirm a remote, unauthenticated impact with pub...

CVE-2024-28066

CVE-2024-28066 affects Unify CP IP Phone firmware 1.10.4.3. The root cause is a hardcoded root password enabling weak credentials, rated CVSSv3.1: 8.8 (HIGH) with Adjacent access, no user interaction required. The Red Hat/NVD/CVE entries corroborate the issue; exploitation status is not documente...

CVE-2024-30665

CVE-2024-30665 has been withdrawn; the initial entry states “Rejected reason: DO NOT USE THIS CANDIDATE NUMBER” and notes no evidence of a vulnerability. Connected sources (NVD, CNNVD) repeat that this candidate was withdrawn/not applicable. The PT security entry about ROS Melodic Morenia and rel...

CVE-2024-30661

CVE-2024-30661 is rejected/not used and does not represent an active vulnerability entry.

CVE-2024-23078

Summary: CVE-2024-23078 affects JGraphT Core 1.5.2 due to a potential NullPointerException in the function ToleranceDoubleComparator::compare(Double, Double) , which (per IBM’s bulletin) could allow a remote attacker to cause a denial of service. The IBM Security Bulletin lists this CVE among mul...

CVE-2024-23081

CVE-2024-23081 concerns ThreeTen Backport v1.6.8 with a NullPointerException in org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). IBM/Red Hat/Ubuntu notices confirm this vulnerability pattern across OSS used in various products; IBM’s Security Bulletin for Log Analysis (v1.3.7.2/1.3.8 path) ...

CVE-2024-23085

Apfloat v1.10.1 is associated with a NullPointerException in org.apfloat.internal.DoubleScramble::scramble(double[], int, int[]). The description explicitly notes that the vulnerability existence is disputed by third parties, and public evidence is not conclusive. Several sources list the affecte...

CVE-2024-30666

This CVE entry is rejected/not used and does not represent an active vulnerability.

CVE-2024-31813

Summary: CVE-2024-31813 affects TOTOLINK EX200 (version 4.0.3c.7646_B20201211). The root cause is that the device ships without an authentication mechanism by default, per Red Hat/NVD/CNVD/CNNVD entries and industry disclosures. Impact as stated: high confidentiality, integrity, and availability ...

CVE-2024-27630

CVE-2024-27630 affects GNU Savane v3.12 and earlier where an Insecure Direct Object Reference (IDOR) exists in the trackers_data_delete_file function, enabling remote deletion of arbitrary files. Exploitation details are not fully enumerated in the provided sources, but risk is described as remot...