CVE-2024-29753

CVE-2024-29753 describes an out-of-bounds write in the function tmu_set_control_temp_step of tmu.c , caused by a missing bounds check. The issue enables local privilege escalation with no extra privileges and without user interaction. Connected sources identify this vulnerability within Google Pi...

CVE-2024-29746

CVE-2024-29746 affects the lpm_req_handler in lpm.c, with a possible out-of-bounds write caused by improper input validation. This can enable local elevation of privilege without user interaction. Connected sources (Red Hat, NVD, CVE lists, and Android Pixel bulletin) confirm the issue exists in ...

CVE-2024-29747

CVE-2024-29747 affects the dvfs_get_lv function in dvfs.c, where a missing null check enables an out-of-bounds read. This can lead to local information disclosure with no additional privileges and no user interaction required. The connected records consistently describe the same issue, but none p...

CVE-2024-29748

CVE-2024-29748 is an Android Pixel privilege-escalation vulnerability affecting Pixel firmware. Root cause described as a logic error allowing local escalation of privilege without extra execution privileges; exploitation requires user interaction. CVSSv3.1 base score 7.8 (HIGH) with LOCAL access...

CVE-2024-29739

CVE-2024-29739 affects Google Android’s kernel component involved in tmu_get_temp_lut in tmu.c, where a missing bounds check enables an out-of-bounds read. This can cause local information disclosure without extra privileges or user interaction. Public exploit details are not provided in the supp...

CVE-2024-29738

CVE-2024-29738 affects the gov_init component and is described across Red Hat, NVD, CVE listings, and OSV as a possible out-of-bounds read caused by a missing bounds check. The exploitation vector is local (attack vector: LOCAL) with no user interaction required, and the impact is local informati...

CVE-2024-27231

The provided connected documents confirm a concrete vulnerability: in function tmu_get_tr_stats() of tmu.c there is a missing bounds check causing an out-of-bounds read, enabling local information disclosure with no additional privileges or user interaction required. Affected software/versions ar...

CVE-2024-3353

CVE-2024-3353 affects SourceCodester Aplaya Beach Resort Online Reservation System v1.0. The vulnerability is a SQL injection in admin/mod_reports/index.php via the categ/end parameter, enabling remote exploitation. Multiple sources confirm the issue; CVSS metrics indicate high severity with LOW ...

CVE-2024-3352

CVE-2024-3352 affects SourceCodester Aplaya Beach Resort Online Reservation System 1.0. The vulnerability is an SQL injection in the admin/mod_comments/index.php file, triggered by manipulating the id parameter. It is a remote issue with public disclosure of the exploit. Platforms: SourceCodester...

CVE-2024-3351

SourceCodester Aplaya Beach Resort Online Reservation System 1.0 is affected by a SQL injection in the admin/mod_roomtype/index.php file via the id parameter. Exploitation can be performed remotely and has been disclosed publicly. The CVE entry notes a critical impact (NVD CVSSv3.1: 9.8) with hig...

CVE-2024-31848

CVE-2024-31848 affects the Java version of CData API Server

CVE-2024-3349

CVE-2024-3349 affects SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected component: admin/login.php where the email parameter is injectable, leading to remote SQL injection. Root cause: improper handling of the email input in login logic. Impact: high confidentiality, inte...

CVE-2024-2380

CVE-2024-2380 affects Checkmk prior to version 2.3.0b4, with a stored XSS vulnerability in the graph rendering component. The root cause is an XSS flaw in how graphs are rendered, potentially allowing an attacker to inject script via graph data. Mitigation is to upgrade to 2.3.0b4 or later (per d...

CVE-2024-31083

CVE-2024-31083 is a use-after-free in the X.Org X11 server, specifically ProcRenderAddGlyphs. When AllocateGlyph() stores client-sent glyphs, multiple pointers to non-refcounted glyphs may exist, allowing a local authenticated attacker to trigger use-after-free and potentially execute arbitrary c...

CVE-2023-6523

CVE-2023-6523 corresponds to an Authorization Bypass Through User-Controlled Key in ExtremePacs Extreme XDS, enabling Authentication Abuse in affected versions before 3914. The connected sources specify Extreme XDS prior to 3914 as vulnerable; remediation guidance from PT-2024-14991 recommends up...

CVE-2024-27437

CVE-2024-27437 — Linux kernel (vfio/pci) intrinsic IRQ handling: The issue arises from auto-enabling of exclusive INTx IRQs during masking/unmasking, creating a window where an interrupt could fire and double-increment the disable depth. The fix in the sources inlines the kernel logic to never au...

CVE-2024-26812

VFIO PCI: Create persistent INTx handler. The described issue allowed signaling an INTx eventfd with a NULL context via SET_IRQS or unmask irqfd even when the IRQ handler was unregistered. The connected documents state that the fix moves INTx interrupt handler configuration to track the lifetime ...

CVE-2024-29221

CVE-2024-29221 (Mattermost Server) describes improper access control in the /api/v4/users/me/teams endpoint, where a team admin could obtain the team invite ID and invite users despite lacking the Add Members permission. Affected versions include 8.1.x before 8.1.11, 9.x before 9.3.3/9.4.4/9.5.2....

CVE-2024-2509

The CVE-2024-2509 issue affects the WordPress plugin Gutenberg Blocks by Kadence Blocks (versions

CVE-2023-5973

Brocade Fabric OS Web Interface (v9.x and prior to v9.2.0) is affected by CVE-2023-5973 where portName values containing reserved characters are not represented correctly in the UI. An authenticated user could see altered port displays due to this handling issue. The CVE description and related a...