CVE-2020-36829

CVE-2020-36829 affects the Mojolicious Perl module prior to 8.65, with the secure_compare timing attack enabling an attacker to infer the length of a secret string (only versions after 1.74 are affected). Connected advisories confirm affected software and fixes: Debian LTS advisory DLA-3846-1 sta...

CVE-2024-0406

CVE-2024-0406 concerns the mholt/archiver package. The connected Nessus/SUSE entries confirm a path-traversal flaw in tar unpacking that can cause writing to restricted files or directories when extracting archives. The remediation path shown in the connected docs includes upgrading the affected ...

CVE-2024-3156

CVE-2024-3156 affects Chromium/Google Chrome via an inappropriate implementation in V8, allowing remote memory-out-of-bounds access through a crafted HTML page on versions prior to 123.0.6312.105. Debian security advisory confirms the fix is in chromium 123.0.6312.105-1~deb12u1 for stable (bookwo...

CVE-2024-24746

CVE-2024-24746: Apache NimBLE's GATT server is vulnerable to a Denial of Service via a specially crafted GATT operation that causes an infinite loop. Affected software: NimBLE up to version 1.6.0; impact is denial of service to the Bluetooth stack/device. Remediation: upgrade to NimBLE 1.7.0 (fix).

CVE-2024-22328

CVE-2024-22328 affects IBM Maximo Application Suite (MAS) Manage component in MAS 8.10 and 8.11. A remote attacker can perform path traversal by sending a URL with dot-dot sequences (/../) to view arbitrary files, leading to arbitrary file disclosure. Root cause: CWE-22 (path traversal). CVSS v3....

CVE-2024-3366

Xuxueli XXL-Job up to 2.4.1 contains a Template Handler deserialization vulnerability in com/xxl/job/core/util/JdkSerializeTool.java that enables template-injection via manipulated byte arrays. The flaw allows injection due to lack of sanitization in deserialize(), with exploitation disclosed pub...

CVE-2024-3363

SourceCodester Online Library System 1.0 contains a SQL injection vulnerability in admin/borrowed/index.php, triggered by manipulating the BookPublisher/BookTitle parameters. The issue affects an unknown part of that file and can be exploited remotely; the vulnerability has been publicly disclose...

CVE-2024-2458

CVE-2024-2458 affects the Powerkit – Supercharge your WordPress Site plugin for WordPress. It is a Stored XSS via shortcode attributes, present in all versions up to and including 2.9.1 due to insufficient input sanitization and output escaping. Exploitation requires authentication at contributor...

CVE-2024-0837

Technical details beyond the initial description are not provided in the attached documents. Monitor for updates to confirm affected versions, impact, and fixes.

CVE-2024-3362

CVE-2024-3362 affects SourceCodester Online Library System 1.0. The vulnerability is a SQL injection in the IBSN parameter of admin/books/controller.php. The issue can be triggered remotely and exploits have been publicly disclosed. Connected sources confirm the vulnerable component and the root ...

CVE-2024-2471

CVE-2024-2471 affects the FooGallery WordPress plugin. Affected versions are

CVE-2024-21506

CVE-2024-21506 entry is rejected/not active and duplicates CVE-2024-5629.

CVE-2024-3360

The CVE-2024-3360 entry concerns SourceCodester Online Library System 1.0. The vulnerability is in the admin/books/index.php file, where manipulating the id parameter enables SQL injection and can be exploited remotely. Multiple sources confirm the affected file and parameter, and describe the im...

CVE-2024-3359

CVE-2024-3359 affects SourceCodester Online Library System 1.0. The vulnerability is in the admin/login.php file where the user_email parameter is manipulated, causing a SQL injection due to unsanitized input. Documents indicate the attack is remotely executable and that an exploit has been discl...

CVE-2024-3358

CVE-2024-3358 affects SourceCodester Aplaya Beach Resort Online Reservation System v1.0. The vulnerability is a cross-site scripting (XSS) in the /index.php file caused by unsafely manipulated arguments (likely the to parameter). It can be exploited remotely, and public disclosure exists. Several...

CVE-2024-27909

The CVE-2024-27909 vulnerability affects Lenovo Printers, impacting the HTTPS service. Multiple connected sources describe a denial of service that could cause a system reboot, attributed to a buffer overflow in the HTTPS service (as per CNNVD-2024-404713 and related PT-2024-22125 notes). This is...

CVE-2024-23592

CVE-2024-23592 describes an authentication bypass in Lenovo devices equipped with Synaptics fingerprint readers, enabling an attacker with physical access to replay fingerprints and bypass Windows Hello authentication. The vulnerability arises in the fingerprint authentication mechanism and could...

CVE-2024-29752

In CVE-2024-29752, the flaw resides in the function tmu_set_tr_num_thresholds inside tmu.c. It enables an out-of-bounds write due to a missing bounds check in this routine, which could allow a local escalation of privilege. The impact is described as local privilege escalation with no additional ...

CVE-2024-29755

CVE-2024-29755 affects the tmu_get_pi function in tmu.c, causing an out-of-bounds read due to improper input validation. This can lead to local information disclosure without extra privileges or user interaction. The issue is addressed by Pixel updates; patch level 2024-04-05 or later is indicate...

CVE-2024-29757

The CVE-2024-29757 vulnerability is an Elevation of Privilege issue in Google Android Pixel firmware, caused by whitelisting of debugging certificates. Affected component (Pixel Companion) can bypass certain permissions, enabling local escalation of privilege without additional execution privileg...