CVE-2023-33528

Halo v1.6.0 is vulnerable to Cross Site Scripting (XSS) . The documents identify the affected software and version but do not provide root cause details, exploitation data, or a confirmed patch. No remediation version is stated in the provided sources; monitor for vendor advisories for an officia...

CVE-2024-24407

The CVE-2024-24407 entry concerns the Best Courier management system v1.0, where a SQL injection in the print_pdets.php component allows a remote attacker to obtain sensitive information. Documented impact is data disclosure with a CVSS v3.1 base score of 5.3 (MEDIUM), attack vector NETWORK, and ...

CVE-2024-30585

The CVE-2024-30585 entry concerns Tenda FH1202 (v1.2.0.14(408)). A vulnerability exists in the deviceId parameter of the saveParentControlInfo function that leads to a stack overflow. Connected sources corroborate the affected device and function name; no explicit exploitation details are provide...

CVE-2024-30592

CVE-2024-30592 affects Tenda FH1202 v1.2.0.14(408). A stack overflow vulnerability exists in the page parameter of the fromAddressNat function, exploitable via crafted input likely affecting the /goform/addressNat endpoint (remote attacker). Documents describe potential arbitrary code execution o...

CVE-2024-30604

CVE-2024-30604 affects Tenda FH1203 v2.0.1.6, with a stack overflow in the list1 parameter of the fromDhcpListClient function. Red Hat and CNVD entries corroborate a buffer/stack overflow risk, and a denial-of-service impact is implied by some sources. A PT-Security advisory additionally notes th...

CVE-2024-30584

CVE-2024-30584 affects Tenda FH1202 router, specifically v1.2.0.14(408). The vulnerability is a stack overflow in the security parameter of the formWifiBasicSet function. This is reported with a CVSS v3.1 base score of 9.8 (CRITICAL) and a network attack vector with no user interaction required. ...

CVE-2024-29316

CVE-2024-29316 involves NodeBB 3.6.7 with an Incorrect Access Control vulnerability. A low-privilege attacker can access restricted Admin tabs by setting a parameter (e.g., isadmin: true), as described in multiple connected documents. The root cause is insufficient access control checks that perm...

CVE-2023-25341

The CVE describes a Directory Traversal in Ladle Dev Server (versions 2.5.1 and earlier) that allows an attacker on the same network to read files accessible to the user via GET requests. Red Hat, NVD, CNNVD, and related enrichments corroborate the same impact. No exploit details are provided in ...

CVE-2024-28714

CVE-2024-28714 is a SQL Injection vulnerability in the CRMEB_Java e-commerce system version 1.3.4. The issue allows an attacker to cause arbitrary code execution via the groupid parameter. The Red Hat/OSV/NVD and related entries confirm the vulnerability description, but none of the provided docu...

CVE-2024-30612

CVE-2024-30612 affects Tenda AC10U with firmware v15.03.06.48. A stack overflow vulnerability exists in the formSetClientState function, specifically in parameters deviceId, limitSpeed, and limitSpeedUp. Public descriptions indicate the overflow stems from insufficient input validation on input l...

CVE-2024-3008

The vulnerability CVE-2024-3008 affects the Tenda FH1205 router (v2.0.0.7(775)) in the /goform/execCommand file, specifically the formexeCommand function. The cmdinput argument handling leads to a stack-based buffer overflow, enabling remote code execution with no user interaction required. Publi...

CVE-2024-3007

CVE-2024-3007 affects Tenda FH1205, firmware 2.0.0.7(775). The stack-based buffer overflow occurs in the fromNatStaticSetting function via the page parameter in /goform/NatStaticSetting. The issue can be triggered remotely; exploit details have been disclosed. Public data provides mitigation guid...

CVE-2024-3006

CVE-2024-3006 affects Tenda FH1205 (firmware 2.0.0.7(775)). The vulnerability is a stack-based overflow in the fromSetRouteStatic function (/goform/fromRouteStatic) triggered via the entrys argument, with remote exploitation and public disclosures. Connected sources confirm the root cause (stack-...

CVE-2024-3004

CVE-2024-3004 affects code-projects Online Book System 1.0. The vulnerability arises from manipulation of an argument value in the file /Product.php , enabling cross-site scripting (XSS) . The issue is exploitable remotely, and the exploit has been disclosed publicly. Affected product/version: On...

CVE-2024-3003

CVE-2024-3003 affects code-projects Online Book System 1.0, where the /cart.php endpoint’s quantity/remove parameter is vulnerable to SQL injection due to lack of input validation. This can be exploited remotely and has been publicly disclosed, with VDB-258205 assigned. Multiple sources corrobora...

CVE-2024-3002

CVE-2024-3002 affects code-projects Online Book System 1.0. The vulnerability is in /description.php where the ID parameter is not validated, allowing remote SQL injection. Exploitation is possible remotely, and multiple sources note public disclosure. Documented impact is data theft/alteration r...

CVE-2024-0078

CVE-2024-0078 affects NVIDIA GPU Display Driver for Windows and Linux. A vulnerability in the kernel-mode layer can allow a guest user to trigger a NULL-pointer dereference on the host, potentially causing a denial of service. Affected component: NVIDIA GPU Display Driver in kernel space; root ca...

CVE-2024-0073

CVE-2024-0073 concerns the NVIDIA GPU Display Driver for Windows. The vulnerability resides in the kernel‑mode layer when the driver performs an operation at a privilege level higher than the minimum required. The impact, as described, includes code execution, denial of service, privilege escalat...

CVE-2024-0071

CVE-2024-0071 affects the NVIDIA GPU Display Driver for Windows. The vulnerability is in the user-mode layer and allows an unprivileged regular user to cause an out-of-bounds write, with potential code execution, denial of service, privilege escalation, information disclosure, and data tampering....

CVE-2024-3001

CVE-2024-3001 affects code-projects Online Book System 1.0. The vulnerability resides in the handling of a value passed to /Product.php, where input manipulation enables SQL injection. It can be exploited remotely without authentication and requires no user interaction. Public exploit information...