CVE-2024-26329

CVE-2024-26329 affects Chilkat before v9.5.0.98. The vulnerability arises from a predictable PRNG in ChilkatRand::randomBytes, enabling an attacker to obtain sensitive information. Reported impact includes local exploitation with high confidentiality impact. Affected software is the Chilkat libra...

CVE-2024-30849

CVE-2024-30849 affects Sourcecodester Complete E-Commerce Site v1.0. An arbitrary file upload vulnerability exists in admin/products_photo.php via the filename parameter, allowing remote attackers to execute arbitrary code. The CVSSv3.1 vector indicates Network access, Low attack complexity, No p...

CVE-2024-28065

CVE-2024-28065 affects Unify CP IP Phone firmware 1.10.4.3. The issue arises because files are not encrypted and contain sensitive data such as the root password hash. CVSS 3.1 vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N, base score 5.9 (Medium). Exploitation status is not provided in the documen...

CVE-2024-31852

CVE-2024-31852 affects LLVM/Clang with an ARM backend miscompile: LLVM before 18.1.3 can overwrite LR register without saving to stack, enabling an exploitable flow-control issue in some cases. The vulnerability is demonstrated using Clang; vendor notes suggest the miscompile is likely to crash o...

CVE-2024-30977

Secnet Security Network Intelligent AC Management System v1.02.040 contains a local privilege escalation via the password component. The issue is documented across multiple sources (NVD/Red Hat/CVE listings) with CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, score 7.8. No patch/version with fi...

CVE-2024-29049

CVE-2024-29049 describes a spoofing vulnerability in Microsoft Edge (Chromium-based) that involves the Edge WebView2 component. Connected sources consistently identify the affected element as the WebView2 surface used by Edge’s Chromium-based browser, resulting in spoofing of the user interface. ...

CVE-2024-29981

CVE-2024-29981 affects Microsoft Edge (Chromium-based). The vulnerability is a spoofing flaw in the browser’s UI surface that could enable spoofed user interfaces. CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base score 4.3 (Medium); exploitation requires user interaction and the attack vector i...

CVE-2024-3316

The CVE-2024-3316 entry concerns SourceCodester Computer Laboratory Management System 1.0. Affected functionality is the file /admin/category/view_category.php where manipulating the id parameter causes SQL injection. The issue is exploitable remotely and the exploit has been publicly disclosed, ...

CVE-2024-3315

The CVE-2024-3315 flaw affects SourceCodester Computer Laboratory Management System 1.0, specifically an unknown function in classes/user.php where manipulating the id parameter enables SQL injection. The issue can be exploited remotely, and exploitation has been disclosed publicly (VDB-259386). ...

CVE-2024-3314

CVE-2024-3314 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability is due to SQL injection in the file /classes/Users.php, enabling remote exploitation. Documented impact includes high confidentiality, integrity, and availability concerns. Multiple sources (NVD, Red...

CVE-2024-30270

The CVE-2024-30270 entry pertains to mailcow: dockerized prior to the 2024-04 release. A vulnerability combines path traversal and arbitrary code execution targeting the rspamd_maps() function, allowing an authenticated admin to overwrite any file writable by the www-data user due to improper pat...

CVE-2024-22052

Technical details about CVE-2024-22052 are not publicly provided in the supplied documents. Monitor for updates from authoritative sources.

CVE-2024-27316

CVE-2024-27316 affects the mod_http2 component used with Apache httpd; the issue occurs when HTTP/2 headers exceed the configured limit, causing nghttp2 to buffer headers and potentially leading to memory exhaustion if the client continues sending headers. Connected sources identify affected pack...

CVE-2024-24795

CVE-2024-24795 (httpd) describes HTTP response splitting in multiple Apache HTTP Server modules when malicious response headers can be injected into backend applications, enabling HTTP desynchronization. The vulnerability is mitigated by upgrading to Apache HTTP Server 2.4.59, as indicated across...

CVE-2023-38709

CVE-2023-38709 describes HTTP response splitting in the core of Apache HTTP Server caused by faulty input validation. It affects Apache HTTP Server up to version 2.4.58; multiple advisories (e.g., Astra Linux, AlmaLinux, Alpine Linux) note that upgrading to 2.4.64 fixes the issue. Some sources in...

CVE-2024-30254

MesonLSP prior to version 4.1.4 is vulnerable to a directory traversal issue that can overwrite arbitrary files if a victim runs the language server within a crafted project or with mesonlsp --full. Version 4.1.4 includes a patch. Workarounds include avoiding --full and setting others.neverDownlo...

CVE-2024-30249

CVE-2024-30249 affects Cloudburst Network (RakNet-based components) prior to version 1.0.0.CR1-20240330.101522-15. The root cause is a DoS/UDP amplification vulnerability in RakNet connection handling that can be leveraged to attack a third party or trigger host service suspension. A fix exists i...

CVE-2024-25705

CVE-2024-25705 describes a cross-site scripting issue in Esri Portal for ArcGIS Experience Builder versions 11.1 and below. The CVE record states exploitation requires basic authenticated access (low-privilege), while a PT-Security entry notes a remote, unauthenticated attacker scenario; there is...

CVE-2024-2660

CVE-2024-2660 : HashiCorp Vault and Vault Enterprise TLS cert authentication method did not correctly validate OCSP responses when multiple OCSP sources were configured, per the CVE entry. The issue affects Vault and Vault Enterprise 1.14.0 and newer and is fixed in Vault 1.16.0 and Vault Enterpr...

CVE-2024-25696

CVE-2024-25696 is a cross-site scripting vulnerability in Esri Portal for ArcGIS affecting versions 11.0 and earlier. An attacker with remote access and high privileges (authenticated) can construct a link that causes the page editor to render an image in the victim’s browser, implying a stored/r...