CVE-2024-31099

Technical details about CVE-2024-31099 are not provided in the connected documents. The initial description notes a missing authorization vulnerability affecting Averta Shortcodes/Phlox auxin-elements, but no vendor/version specifics, impact details, or remediation steps are present to cite. Moni...

CVE-2022-4966

CVE-2022-4966 affects sequentech admin-console up to version 6.1.7, impacting the Election Description Handler component. The issue enables cross-site scripting and can be exploited remotely. A fix is available in version 7.0.0-beta.1 (patch 0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d); upgrading th...

CVE-2023-6154

CVE-2023-6154 affects Bitdefender Total Security, Internet Security, Antivirus Plus, and Antivirus Free (all reported as 27.0.25.114). Root cause: a configuration setting issue in seccenter.exe that allows an attacker to change the product’s expected behavior and potentially load a third‑party li...

CVE-2024-1526

The vulnerability CVE-2024-1526 affects the Hubbub Lite WordPress plugin for versions prior to 1.33.1. The issue arises from the plugin not ensuring that a user has access to password-protected posts before displaying their content in a meta tag (og:description) when Open Graph meta tags are enab...

CVE-2024-20055

In imgsys, a missing bounds check leads to local information disclosure with required System execution privileges. Exploitation requires user interaction (per CVE-2024-20055 descriptions). Patch ID ALPS08518692 is referenced; the connected PT-2024-18541 entry notes affected versions are not speci...

CVE-2024-20054

CVE-2024-20054 concerns a missing bounds check in the gnss component, enabling local privilege escalation with System execution privileges required and no user interaction. The vulnerability is associated with MediaTek/gnss implementations, with a patch identified as ALPS08580200 (Issue ID: ALPS0...

CVE-2024-20052

In flashc (MediaTek chip/software context), an uncaught exception can cause information disclosure, potentially enabling local information exposure with System privileges. Exploitation requires local access; no user interaction is needed. A patch is referenced (ALPS08541757 / ALPS08541761). No ot...

CVE-2024-20051

In flashc, an uncaught exception can cause a system crash, enabling local denial of service with system execution privileges required. No user interaction is needed. A patch is referenced (ALPS08541757; ALPS08541758).

CVE-2024-20050

CVE-2024-20050 affects the flashc component in MediaTek-related platforms, with an uncaught exception leading to local information disclosure. Exploitation requires system execution privileges (local attack) and does not require user interaction. Patch ALPS08541757 (Issue ALPS08541757) is associa...

CVE-2024-20049

CVE-2024-20049 affects the flashc component in MediaTek-chip devices. The vulnerability is caused by an uncaught exception in flashc, enabling possible local information disclosure with System privileges required for exploitation; no user interaction is needed. A patch is available (Patch ID: ALP...

CVE-2024-20044

The CVE 2024-20044 affects the da module in MediaTek chips, where a missing bounds check enables an out-of-bounds write. This could allow local escalation of privilege to SYSTEM-level execution with no user interaction required. Patch ALPS08541784/ALPS08541784 is referenced as the mitigation. Con...

CVE-2024-20040

CVE-2024-20040 affects MediaTek WLAN firmware (MT6XXX/MT79XX) and stems from an out-of-bounds write caused by improper input validation. This could enable remote escalation of privilege with no additional execution privileges required and no user interaction. The CVSSv3.1 base score is 8.8 (HIGH)...

CVE-2024-20039

The CVE-2024-20039 issue concerns MediaTek modem protocol components with a missing bounds check that enables an out-of-bounds write. This can lead to remote code execution with no privileges or user interaction required. Concrete details across connected documents identify the affected area as t...

CVE-2024-28895

CVE-2024-28895 is a cross-site scripting vulnerability in the Yahoo! JAPAN App for Android (2.3.1–3.161.1) and iOS (3.2.2–4.109.0). The root cause is a WebView-based XSS (CWE-79) that could allow an arbitrary script to execute in the WebView via another app on the device. Exploitation details are...

CVE-2024-30866

Netentsec NS-ASG 6.3 is reported vulnerable to SQL Injection via the /3g/menu.php endpoint. The CVE description and connected records indicate the flaw originates from unsafe SQL handling in that API path, leading to potential exposure or alteration of data with low to moderate impact (CVSS v3.1:...

CVE-2024-30867

CVE-2024-30867 affects netentsec NS-ASG 6.3. The vulnerability is a SQL injection in the /admin/edit_virtual_site_info.php endpoint, with CVSS v3.1 base score 9.8 (CRITICAL). Exposed via NETWORK, no user interaction required, privileges none. Root cause: improper handling of database queries enab...

CVE-2024-30863

CVE-2024-30863 affects netentsec NS-ASG 6.3. The vulnerability is an SQL injection in the /WebPages/history.php endpoint. CVSS 3.1 base score 6.3 (Network, High attack complexity, Low privileges, No user interaction). Impact is integrity loss, with confidentiality/availability not affected per th...

CVE-2024-30872

CVE-2024-30872 affects NetentSec NS-ASG 6.3. The vulnerability is a SQL Injection in the /include/authrp.php endpoint. Documented impact per CVSS: confidentiality impact NONE, integrity impact LOW, availability impact LOW. Exploitation details or patch information are not provided in the connecte...

CVE-2024-29435

Summary : CVE-2024-29435 affects Alldata v0.4.6, enabling an attacker to execute arbitrary commands via the processId parameter. Affected software : Alldata version 0.4.6. Impact : arbitrary command execution (described as high-risk functionality exposure in multiple sources); CVSS 3.1 base score...

CVE-2024-29433

CVE-2024-29433 affects Alldata v0.4.6 via a deserialization vulnerability in the FASTJSON component, allowing attackers to execute arbitrary commands by supplying crafted data. Documents confirm the vulnerable software/version and the underlying cause; no details on exploitation methods beyond th...