CVE-2024-30627

The CVE-2024-30627 entry concerns the Tenda FH1205 router. Publicly referenced sources confirm a stack overflow in the deviceId parameter within the saveParentControlInfo function, affecting at least version 2.0.0.7(775). The root cause is insufficient validation of input data to deviceId, enabli...

CVE-2024-30626

CVE-2024-30626 affects Tenda FH1205 v2.0.0.7(775). A stack overflow is caused by insufficient validation in the schedEndTime parameter of setSchedWifi, allowing overflow of input data. Documented impacts include arbitrary code execution or denial of service per CNVD/Red Hat/CVE records; exploitat...

CVE-2024-27619

The CVE-2024-27619 entry concerns D-Link Dir-3040us A1 (firmware 1.20b03a hotfix). The issue is a buffer overflow caused by a read/write FTP server path that allows uploading files larger than available RAM, leading to RAM exhaustion and a system crash/reboot. The FTP service permits changing the...

CVE-2024-30631

CVE-2024-30631 affects Tenda FH1205 v2.0.0.7(775). The schedStartTime parameter in setSchedWifi is vulnerable to a stack overflow in the vulnerable function, per Red Hat, CNVD, NVD and CVE records. Impact is a stack overflow; explicit exploit details are not provided in the sources. No CVE remedi...

CVE-2024-30636

The CVE-2024-30636 issue affects Tenda F1202 v1.2.0.20(408). The vulnerability is a stack overflow triggered by the PPPOEPassword parameter in the formQuickIndex function. Affected component: the F1202 router firmware, with the root cause described as improper handling/validation of input length ...

CVE-2024-25954

Dell PowerScale OneFS (versions 9.5.0.x–9.7.0.x) contains an insufficient session expiration vulnerability that can be exploited remotely by an unauthenticated attacker to cause a denial of service. Evidence from multiple sources confirms the affected product and impact; the CVSS base metrics ind...

CVE-2024-2947

CVE-2024-2947 describes a command-injection vulnerability in Cockpit triggered by deleting a sosreport with a crafted name via the Cockpit web interface, capable of privilege escalation. The issue affects Cockpit versions 270 and newer and is reflected across multiple distributions (Red Hat, Alma...

CVE-2024-25952

Dell PowerScale OneFS is affected by a local, high-privilege symbolic link (symlink) following vulnerability in versions 8.2.2.x through 9.7.0.x. The issue allows a local attacker with high privileges to potentially cause denial of service and tamper with information. Exploitation details are not...

CVE-2024-25960

CVE-2024-25960 affects Dell PowerScale OneFS versions 8.2.2.x–9.7.0.x, where a cleartext transmission of sensitive information is possible. The root cause is plaintext data exposure enabling a local, low-privilege attacker to escalate privileges. Affected component: PowerScale OneFS operating sys...

CVE-2023-42930

CVE-2023-42930 affects macOS components where an app may modify protected parts of the file system. The public descriptions in connected sources indicate the issue was fixed by Apple in macOS Ventura 13.6.3, macOS Sonoma 14.2, and macOS Monterey 12.7.2 through improved checks. There are no detail...

CVE-2023-42913

CVE-2023-42913 affects macOS Sonoma 14.2 where remote Login sessions may obtain full disk access due to an issue in state management. Apple and Red Hat/NVD references indicate the vulnerability is addressed in macOS Sonoma 14.2 (with fixes applied to Remote Login/session handling). The root cause...

CVE-2024-31140

CVE-2024-31140 affects JetBrains TeamCity versions prior to 2024.03. The issue is described as improper input validation that could let a remote attacker remove arbitrary files from the server by installing tools. The vulnerability has been observed across multiple feeds including Red Hat and oth...

CVE-2024-31137

Summary: CVE-2024-31137 affects JetBrains TeamCity versions prior to 2024.03, where the Space connection configuration component can cause a reflected XSS. The root cause is insufficient protection of the web page structure in the Space configuration flow, allowing an attacker to inject/script vi...

CVE-2024-31135

JetBrains TeamCity is affected by an open redirect vulnerability on the login page prior to 2024.03. The issue stems from the login page redirect handling and could lead users to an arbitrary URL. Affected: JetBrains TeamCity versions before 2024.03. Remediation: update to 2024.03 or later. As a ...

CVE-2024-3042

The CVE-2024-3042 entry applies to SourceCodester Simple Subscription Website 1.0. It documents an SQL injection in the file manage_user.php via the id parameter, caused by improper handling of the input. The vulnerability can be exploited remotely, and public disclosures exist. Remediation/worka...

CVE-2023-45715

CVE-2023-45715 affects the HCL BigFix Platform console. A vulnerability causes a service interruption (Denial of Service) when the console processes file names that contain invalid characters. The root cause is not explicitly detailed in the provided documents beyond the impact condition. Current...

CVE-2023-45706

CVE-2023-45706 affects WebReports/HCL BigFix Platform where an administrative user can trigger a Cross Site Scripting (XSS) and/or a Man in the Middle (MITM) attack via SAML configuration. The connected sources corroborate that the issue involves WebReports and SAML configuration enabling XSS/MIT...

CVE-2024-29898

The CVE-2024-29898 entry concerns Miraheze’s CreateWiki (MediaWiki extension). Affected behavior: during patching for CVE-2024-29897, an oversight could cause suppressed wiki requests listed on Special:RequestWikiQueue to be accessible to users on private wikis who had the (read) permission not r...

CVE-2024-29200

Kimai API flaw CVE-2024-29200 exposes timesheet entries to users who should be restricted. The issue stems from inconsistent handling of the view_other_timesheet permission between the UI and API, where the UI restricts data to a user’s teams but the API returns all timesheets when querying /api/...

CVE-2023-6437

CVE-2023-6437 affects TP-Link router models (EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3; VX220-G2u, VN020-G2u) due to OS command injection from improper neutralization of special elements. Technical details from PT-2024-2586 specify the vulnerability exists in EX20v AX1800, C5v AC1200,...