CVE-2024-30340

CVE-2024-30340 describes a Foxit PDF Reader annotation handling vulnerability where inadequate validation of user-supplied data in Annotation objects can cause an out-of-bounds read, leading to information disclosure. The flaw allows remote disclosure of sensitive data when a user visits a malici...

CVE-2024-30339

CVE-2024-30339 describes a remote code execution in Foxit PDF Reader caused by an AcroForm Use-After-Free flaw. The vulnerability stems from not validating the existence of an object before performing operations on AcroForm-related objects, enabling an attacker to execute code in the target proce...

CVE-2024-30338

CVE-2024-30338 is a Foxit PDF Reader Use-After-Free vulnerability in the handling of Doc objects. The flaw stems from not validating the existence of a Doc object before performing operations, enabling an attacker to execute code in the current process. Exploitation requires user interaction (e.g...

CVE-2024-30337

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution (CVE-2024-30337) affects Foxit PDF Reader; it stems from not validating the existence of an object before performing operations on AcroForm objects. An attacker can trigger code execution in the target process by convincing a user to ...

CVE-2024-30173

CVE-2024-30173 maps to an authentication bypass in the TYPO3 OpenID Connect Authentication extension. The TYPO3 extension’s authentication service does not verify the OpenID Connect authentication state from the user lookup chain and instead authenticates every valid frontend user whose tx_oidc f...

CVE-2024-24888

CVE-2024-24888 is a Server-Side Request Forgery (SSRF) in Gutenberg Blocks powered by Kadence Blocks. The vulnerability affects the Kadence Blocks Gutenberg Blocks plugin for WordPress, specifically versions up to 3.2.25. According to the connected Red Hat advisory, the flaw enables a server-side...

CVE-2024-31105

CVE-2024-31105 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Tax Rate Upload that enables Reflected XSS. The entry lists affected software as Tax Rate Upload (n/a) up to version 2.4.5. Reported metrics (CVSS v3.1 base score 7.1, HIGH) indicate network attack vector,...

CVE-2024-31109

CVE-2024-31109 describes a CSRF-driven stored XSS vulnerability in Toastie Studio Woocommerce Social Media Share Buttons (affecting builds up to 1.3.0). The Red Hat entry confirms CSRF as the vulnerability type and Stored XSS as the impact, affecting the specified plugin. The provided documents d...

CVE-2024-2435

This CVE affects Temporal UI Server (github.com/temporalio/ui-server). The vulnerability is an XSS in the timeline page that displays workflow execution details, triggered when an attacker sends a signal to a workflow with a crafted signal name. The root cause is insufficient sanitization of the ...

CVE-2024-22247

CVE-2024-22247 — VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access during activation could potentially access BIOS configuration and exploit the default boot priority. The issue is documented with a moderate base sc...

CVE-2024-22246

CVE-2024-22246 affects VMware SD-WAN Edge with an unauthenticated command injection that can lead to remote code execution. The issue requires local access to the Edge Router UI during activation and could allow an attacker to gain full control of the router. The CVSSv3 base score is 7.4 (HIGH) w...

CVE-2023-50313

Summary: CVE-2023-50313 affects IBM WebSphere Application Server 8.5 and 9.0, including variants used with IBM Tivoli/Maximo, DevOps ClearCase, or other IBM products. The vulnerability could yield weaker outbound TLS security due to a failure to honor user configuration, potentially elevating the...

CVE-2023-6951

CVE-2023-6951 concerns a Use of Weak Credentials affecting DJI drone Wi‑Fi networks (Mavic 3 Pro <= v01.01.0300, Mavic 3 <= v01.00.1200, Mavic 3 Classic <= v01.00.0500, Mavic 3 Enterprise <= v07.01.10.03, Matrice 300 <= v57.00.01.00, Matrice M30 <= v07.01.0022, Mini 3 Pro

CVE-2024-1732

CVE-2024-1732 : The Sharkdropship Dropshipping & Affiliate for AliExpress WordPress plugin is vulnerable to unauthenticated data loss via a missing capability check in wads_removeProductFromShop(), affecting all versions up to 2.2.4. Impact is unauthorized deletion of posts; CVSS indicates networ...

CVE-2024-20799

CVE-2024-20799 affects Adobe Experience Manager (AEM) 6.5.19 and earlier, with a stored XSS vulnerability in vulnerable form fields that can cause arbitrary JavaScript execution in a victim’s browser when the page containing the field is visited. The issue is confirmed in multiple sources, includ...

CVE-2024-1300

CVE-2024-1300 affects the Eclipse Vert.x toolkit. The issue causes a memory leak in TLS/SNI-enabled TCP servers when processing an unknown SNI, leading to SSL context caching in the server name map and potential JVM out-of-memory. Public details in the provided documents specify the vulnerability...

CVE-2024-26684

CVE-2024-26684 relates to the Linux kernel net/stmmac/xgmac path. The root cause is unhandled Data Path Parity Errors (DPP) for DMA channels, which can trigger a storm of interrupts. The fix, per the connected sources, is to check and clear the DMA_DPP_Interrupt_Status register for each channel. ...

CVE-2024-26683

Summary (CVE-2024-26683): In the Linux kernel’s wireless stack, a change intended to avoid connecting to an AP during a CSA channel switch inadvertently caused connection failures with some APs that permanently advertise an extended channel switch announcement (e.g., Asus RT-AC53 with firmware 3....

CVE-2024-26681

CVE-2024-26681 is a Linux kernel vulnerability affecting the netdevsim driver. The issue arises in nsim_dev_trap_report_work() where failure to grab a mutex could lead to a loop/backtrace scenario, potentially impacting system stability. The vulnerability details are grounded in a kernel trace an...

CVE-2024-26679

CVE-2024-26679 : Linux kernel vulnerability where inet_recv_error() reads sk->sk_family without holding the socket lock, enabling a mutation from IPv6 to IPv4 via IPV6_ADDRFORM and potentially triggering a KCSAN warning. Documented fixes exist in kernel commits (see references to stable/commit...