CVE-2024-31005

CVE-2024-31005 affects Bento4 (Bento version 1.6.0-641). The issue resides in Ap4MdhdAtom.cpp, specifically AP4_MdhdAtom::AP4_MdhdAtom, triggered via mp4fragment, enabling a remote attacker to execute arbitrary code. The connected documents consistently describe this vulnerability in Bento4 1.6.0...

CVE-2024-30807

CVE-2024-30807 affects Bento4 v1.6.0-641-2-g1529b83. It describes a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom (Ap4Atom.cpp) that leads to a Denial of Service, as demonstrated by mp42ts. Multiple sources (NVD, Red Hat, CNNVD, OSV, CVE listing, CVELIST, PT Security) confirm the issue...

CVE-2024-27605

CVE-2024-27605 affects Alldata v0.4.6 and describes an Insecure Permissions issue that allows non-authenticated or insufficiently privileged users (e.g., user/test) to query information about other users in the system. Root cause cited across connected sources is misconfigured permissions exposin...

CVE-2024-30806

CVE-2024-30806 affects Bento4 v1.6.0-641-2-g1529b83. The issue is a heap overflow in AP4_Dec3Atom::AP4_Dec3Atom (Ap4Dec3Atom.cpp) that leads to a Denial of Service (DoS). Demonstrated by mp42aac. Connected advisories corroborate the same description. The Red Hat entry mirrors the DoS without prov...

CVE-2024-30946

CVE-2024-30946 concerns a CSRF vulnerability in DedeCMS v5.7 exploitable via the API endpoint /src/dede/co_do.php. The core issue is Cross-Site Request Forgery affecting DedeCMS 5.7, as documented by multiple feeds (NVD/CNNVD/Red Hat and PTSecurity), with CVSS 3.1 vector indicating network access...

CVE-2024-29514

CVE-2024-29514 affects Lepton v7.1.0. The vulnerability is a file-upload flaw that allows a remote, authenticated attacker to execute arbitrary PHP code by uploading a crafted file. Impact is high (remote code execution, authenticated access). Affected software is LeptonCMS/Lepton v7.1.0, with th...

CVE-2024-30809

Bento4 v1.6.0-641-2-g1529b83 has a heap-use-after-free in AP4_Sample::GetOffset() (Ap4Sample.h), causing Denial of Service. Exploitation is demonstrated by mp42ts; CVE-2024-30809 has CVSSv3.1 base score 7.5 (NETWORK access, no authentication, high impact on availability). Multiple feeds confirm t...

CVE-2024-30808

CVE-2024-30808 affects Bento4 v1.6.0-641-2-g1529b83, where a heap-use-after-free in AP4_SubStream::~AP4_SubStream (Ap4ByteStream.cpp) leads to a Denial of Service. The issue is demonstrated by mp42ts. Affected component: Bento4 library; root cause: heap-use-after-free in AP4_SubStream destructor....

CVE-2024-28287

CVE-2024-28287 describes a DOM-based open redirection in the INSTINCT UI Web Client, version 6.5.0, where the returnUrl parameter can be manipulated to redirect users to attacker‑controlled sites. The issue is documented across multiple feeds (NVD, Red Hat, CVE lists) with the same root cause: im...

CVE-2024-27604

CVE-2024-27604 affects Alldata V0.4.6. Multiple sources (NVD, Red Hat, CVE list, CNNVD, etc.) describe a command-execution vulnerability where system commands can be deserialized. CVSS:3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction required, and full impact on confi...

CVE-2024-31002

CVE-2024-31002 describes a buffer overflow in Bento4 v1.6.0-641, exploitable via the AP4 BitReader::ReadCache() function in Ap4Utils.cpp, allowing remote arbitrary-code execution. The issue affects Bento4’s Ap4Utils.cpp/AP4_BitReader::ReadCache without proper input length validation. Public refer...

CVE-2024-3139

CVE-2024-3139 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability lies in the save_users function (/classes/Users.php?f=save), where the id argument is used in file path/authorization logic without proper validation, enabling improper authorization. A remote attack...

CVE-2024-27327

CVE-2024-27327 affects PDF-XChange Editor. The issue is an out-of-bounds write in PDF parsing due to insufficient validation of input data, which can allow arbitrary code execution in the context of the current process when a user opens a malicious PDF or visits a malicious page. Exploitation req...

CVE-2024-27326

CVE-2024-27326 affects PDF-XChange Editor. The issue stems from XPS file parsing where missing validation of user-supplied data can cause a read past the end of an allocated object, enabling an information disclosure. Exploitation requires user interaction (target user must visit a crafted page o...

CVE-2024-23118

CVE-2024-23118 describes a SQL Injection in Centreon’s updateContactHostCommands function. The root cause is improper validation of user-supplied input used to build SQL queries, enabling an attacker to execute arbitrary code in the context of the service account. Exploitation requires authentica...

CVE-2024-23117

CVE-2024-23117 concerns Centreon: the vulnerability is in the updateContactServiceCommands function where user-supplied input is not properly validated before being used to build SQL queries. This leads to a SQL Injection that can execute arbitrary code in the context of the Centreon service acco...

CVE-2024-23116

Summary (CVE-2024-23116): Centreon is vulnerable to a SQL Injection in the core function updateLCARelation , caused by improper validation of a user-supplied string used to build SQL queries. This leads to Remote Code Execution in the context of the service account. The vulnerability is documente...

CVE-2024-1863

Summary : CVE-2024-1863 affects Sante PACS Server. The vulnerability lies in the token endpoint handling HTTP requests on port 3000, where the token parameter is not properly validated before being used in SQL queries, enabling unauthenticated remote code execution in the context of NETWORK SERVI...

CVE-2024-1179

The CVE-2024-1179 issue affects TP-Link Omada ER605 routers, specifically the DHCPv6 Client Options handling. The root cause is improper validation of the length of user-supplied data before copying to a fixed-length stack buffer, enabling a stack-based buffer overflow that allows Remote Code Exe...

CVE-2024-0637

Centreon updateDirectory SQL Injection Remote Code Execution vulnerability affects Centreon installations. The flaw is due to improper validation of a user-supplied string in the updateDirectory function, which is used to build SQL queries. This can allow an attacker to execute arbitrary code in ...