CVE-2024-24890

CVE-2024-24890 affects gala-gopher (openEuler) up to and including version 1.0.2, with an OS command injection in the ioprobe.c component of the eBPF-based probes framework. The vulnerability allows local command execution with low privileges and no user interaction, and has high impact on confid...

CVE-2021-33632

CVE-2021-33632 : TOCTOU race condition in openEuler iSulad on Linux. The issue affects iSulad versions 2.0.18-13 and 2.1.4-1 through 2.1.4-2, with the vulnerability linked to the main.C source file in the iSulad repo. The Red Hat and OpenEuler entries confirm the root cause as a TOCTOU race condi...

CVE-2024-2863

CVE-2024-2863 affects LG LED Assistant and is detailed in the Nuclei template: a path traversal flaw in the /api/thumbnail endpoint (Common.js) allows an unauthenticated, remote attacker to upload arbitrary files to arbitrary disk locations on the target. The description confirms endpoint exists,...

CVE-2024-2862

LG LED Assistant exposes an unauthenticated password-reset vulnerability (CVE-2024-2862). The Nuclei template details an endpoint: /api/changePw that accepts requests from localhost and can be triggered by spoofing X-Forwarded-For: 127.0.0.1 to obtain a success response, enabling password resets ...

CVE-2024-29216

The CVE-2024-29216 issue affects the Sangoma cg6kwin2k.sys driver (cg6kwin2k.sys) prior to version 2.1.7.0. A user without administrator privileges can send a crafted IOCTL, enabling I/O to arbitrary hardware ports or physical addresses and potentially erasing or altering firmware. Affected compo...

CVE-2024-1232

CM Download Manager (WordPress) is affected by CVE-2024-1232 due to missing CSRF protections in multiple areas, enabling CSRF-based actions that could allow an attacker to prompt a logged-in administrator to delete downloads. Root cause: CSRF checks not implemented consistently in the plugin prio...

CVE-2024-21505

CVE-2024-21505 affects the web3-utils package: versions prior to 4.2.1 are vulnerable to a Prototype Pollution issue in the recursive merge via the helper functions format and mergeDeep . An attacker can alter an object’s prototype, potentially changing behavior of all objects inheriting from it....

CVE-2023-30480

CVE-2023-30480 covers a Missing Authorization/Broken Access Control in the Sparkle WP Educenter theme (Educenter

CVE-2023-33923

CVE-2023-33923 : Broken Access Control allowing authenticated users to activate arbitrary plugins in multiple HashThemes themes (Viral News, Viral, HashOne). Affected: Viral News up to 1.4.5; Viral up to 1.8.0; HashOne up to 1.3.0. Public records confirm a low- to moderate-severity issue (CVSS 4....

CVE-2023-37886

CVE-2023-37886 is a Missing Authorization / Broken Access Control vulnerability in InspiryThemes RealHomes WordPress theme, affecting RealHomes up to version 4.0.2. The root cause is an authorization check missing for access control. Exploitation status is not specified in the provided documents....

CVE-2024-29009

CVE-2024-29009 affects the WordPress plugin easy-popup-show (all versions) and is a CSRF vulnerability. The issue enables a remote unauthenticated attacker to hijack an administrator’s session by enticing the admin to view a malicious page, potentially allowing unintended operations. Multiple con...

CVE-2024-21865

The HGW BL1500HM router (firmware 002.001.013 and earlier) is affected by CVE-2024-21865 due to use of weak credentials. An adjacent unauthenticated attacker can connect via SSH and obtain a shell. Remediation: update firmware to 002.001.019 (per JVN RedHat/RH entries). The impact is limited to c...

CVE-2024-28041

CVE-2024-28041 affects the home gateway HGW BL1500HM, with vulnerable versions 002.001.013 and earlier. The issue is described as a network-adjacent, unauthenticated command execution vulnerability (command injection risk). Several connected sources corroborate the vulnerability and identify the ...

CVE-2024-30205

CVE-2024-30205 affects Emacs prior to 29.3 where Org mode trusts contents of remote files (Org mode before 9.6.23). CVSS indicates HIGH severity with LOCAL exploitability and USER INTERACTION required. Affected distributions document remediation via updating Emacs/Org-mode to fixed versions (e.g....

CVE-2024-29302

CVE-2024-29302 affects SourceCodester PHP Task Management System 1.0, vulnerable to SQL Injection via update-employee.php. Technical details in PacketStorm show exploitation through unsafely constructed SQL using admin_id from GET and posted data, enabling potentially unauthorized access or data ...

CVE-2024-28421

CVE-2024-28421 affects Razor 0.8.0. The vulnerability is a SQL Injection in ChannelModel::updateapk within channelmodle.php, which could let a remote attacker escalate privileges. In confirmed third-party sources, mitigation guidance for Razor v0.8.0 includes disabling the ChannelModel::updateapk...

CVE-2024-28393

CVE-2024-28393 is a SQL injection vulnerability affecting Scalapay v1.2.41 and earlier. The root cause, as documented across sources, is an injectable input path in ScalapayReturnModuleFrontController::postProcess(), enabling a remote attacker to escalate privileges. The CVSS‑3.1 base score is 9....

CVE-2024-29301

The CVE-2024-29301 affects SourceCodester PHP Task Management System 1.0. The vulnerability is an SQL Injection in update-admin.php?admin_id=, caused by unsanitized input to the admin_id parameter in the update-admin flow. Multiple connected sources confirm the issue and even provide an exploit e...

CVE-2024-28386

CVE-2024-28386 affects Home-Made.io fastmagsync, version ≤ 1.7.51. The issue allows a remote attacker to execute arbitrary code via the getPhpBin() component. The root cause is not fully detailed in the provided documents beyond this vector. Exploit status is not specified; in the PT-Security wri...

CVE-2024-30204

CVE-2024-30204 (Emacs) affects Emacs before 29.3, where LaTeX preview is enabled by default for e‑mail attachments, potentially enabling denial of service. Connected advisories from multiple vendors confirm the issue and recommend upgrading Emacs to a version including the fix (≥29.3). In practic...