CVE-2024-2868

CVE-2024-2868 affects the ShopLentor (WooCommerce Builder) WordPress plugin. The vulnerability is stored XSS via the slitems parameter in the WL Special Day Offer Widget, present in all versions up to 2.8.3 due to insufficient input sanitization and output escaping. Exploitation requires authenti...

CVE-2024-3022

BookingPress for WordPress (all versions

CVE-2024-25568

CVE-2024-25568 is an OS command injection vulnerability in ELECOM wireless LAN routers. Affected: WRC-X3200GST3-B (v1.25 and earlier), WRC-G01-W (v1.24 and earlier), and WMC-X1800GST-B (v1.41 and earlier; included in e-Mesh Starter Kit “WMC-2LX-B”). A network-adjacent, unauthenticated attacker ca...

CVE-2024-29167

The CVE-2024-29167 entry concerns SVR-116 firmware from SEEnergy, specifically version 1.6.0.30028871. Affected component: the firmware allows a remote authenticated attacker with administrative privileges to execute arbitrary OS commands by sending a specially crafted request. The Red Hat and JV...

CVE-2023-36645

The CVE-2023-36645 entry concerns ITB-GmbH TradePro v9.5 with a SQL injection via the oordershow component in the customer function. Connected PT-2024-12574 details show the root cause as an access-control weakness allowing remote exploitation to execute SQL queries. Affects ITB-GmbH TradePro 9.5...

CVE-2024-31025

CVE-2024-31025 concerns ECshop 4.x. The vulnerability is a SQL injection in the file/article.php component, allowing an attacker to obtain sensitive information from the backend database. Affected software is ECshop 4.x; the root cause is lack of input validation in the SQL statements executed by...

CVE-2024-29386

Summary: Projeqtor versions up to 11.2.0 are affected by a SQL injection via the component /view/criticalResourceExport.php. The vulnerability originates in that resource export path and affects the SQL query handling, with CVSS 3.1 base score 5.4 (Medium) and impacts confined to confidentiality ...

CVE-2024-28520

CVE-2024-28520 is a file upload vulnerability in Byzoro Networks’ Smart multi-service security gateway intelligent management platform, version S210. The issue stems from the uploadfile.php component, enabling an attacker to obtain sensitive information. The vulnerability has a CVSSv3.1 vector of...

CVE-2023-36644

CVE-2023-36644 affects ITB-GmbH TradePro v9.5. The issue stems from Incorrect Access Control in the printmail plugin, enabling remote attackers to retrieve all order confirmations from the online shop. Connected sources corroborate the affected product (TradePro v9.5) and the vulnerability class ...

Concrete CMS Stored XSS in the Custom Class page editing

Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The...

CVE-2024-28870

Suricata (IDS/IPS/NSM) is affected when parsing an overly long SSH banner, which can cause excessive CPU usage and log volume. The issue is a result of banner parsing inefficiency and has been fixed in Suricata 6.0.17 and 7.0.4. If deploying affected lines prior to those patches, upgrade to one o...

CVE-2024-3181

Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS...

CVE-2024-3180

Concrete CMS CVE-2024-3180 describes a Stored XSS in blocks of type file. A rogue administrator can inject malicious code into the link-text field when creating a file block, affecting Concrete CMS versions 9.0.0–9.2.7 and 8.5.15 and earlier. Root cause is insufficient input sanitization in the f...

CVE-2024-0335

CVE-2024-0335 concerns ABB Symphony Plus S+ products (Operations, Engineering, Analyst) with a vulnerability in the ABB VPNI feature of the S+ Control API. The issue stems from errors in processing relative paths within VPNI, which can enable denial of service. Affected versions include S+ Operat...

CVE-2024-3179

Concrete CMS is affected by a Stored XSS vulnerability in the Custom Class page editing. Versions affected are 9.x before 9.2.8 and 8.x before 8.5.16, where insufficient validation of administrator-provided data allows a rogue administrator to inject malicious code. Impact details are limited to ...

CVE-2024-3178

Concrete CMS is affected by a Cross-site Scripting (XSS) vulnerability in the Advanced File Search Filter. Versions below 9.2.8 and below 8.5.16 fail to validate administrator-provided data, allowing a rogue administrator with file-manager access to inject malicious code via a search filter. Impa...

CVE-2024-2653

CVE-2024-2653 affects the AMPHP HTTP stack: amphp/http will accumulate HTTP/2 CONTINUATION frames in an unbounded buffer and only enforces a limit when END_HEADERS is seen, causing an out-of-memory crash. The issue also indirectly impacts amphp/http-client and amphp/http-server if used with an un...

CVE-2024-2758

CVE-2024-2758 concerns Tempesta FW. The vulnerability stems from how HTTP/2 CONTINUATION frames are handled when rate limits are not enabled by default, enabling potential denial-of-service via excessive CONTINUATION traffic (OOM/CPU exhaustion depending on implementation). The initial descriptio...

CVE-2024-26774

CVE-2024-26774 — Linux kernel ext4 fix for zero-division risk . The vulnerability arises in ext4_mb_update_avg_fragment_size() when the block bitmap is corrupted, potentially causing a divide-by-zero if bb_fragments is 0 and the code uses bb_free. The fix changes the check to determine bb_fragmen...

CVE-2024-26772

CVE-2024-26772: In the Linux kernel, the fix prevents allocating blocks from a corrupted ext4 group. The patch moves the block bitmap integrity check under the group lock in ext4_mb_find_by_goal(), ensuring blocks are not allocated from a group with a corrupted bitmap. This mitigates a local-priv...