231579 matches found
CVE-2024-30203
CVE-2024-30203 affects GNU Emacs prior to 29.3, where Gnus treats inline MIME contents as trusted. Public advisories from multiple sources (e.g., ALAS/ALAS2) recommend upgrading Emacs to a newer version (29.3 or later) to apply the fix. The issue is limited to Emacs/Gnus handling of inline MIME; ...
CVE-2023-47430
CVE-2023-47430 affects ReadyMedia/Minidlna v1.3.3, with a stack-buffer-overflow in the SendContainer() function (tivo_commands.c) that can cause a denial of service. Connected advisories indicate Fedora updates to minidlna in multiple releases (e.g., 1.3.3-13.fc41/42/43) and explicitly reference ...
CVE-2024-29442
CVE-2024-29442 entry is rejected/not used per initial description.
CVE-2024-29303
CVE-2024-29303 affects SourceCodester PHP Task Management System 1.0. The delete admin users function is vulnerable to SQL Injection, with an attacker-controlled admin_id parameter (GET). Public references show a crafted exploit attempting SQL manipulation, indicating potential data disclosure/mo...
CVE-2024-28435
Twenty CRM platform version 0.3.0 is affected by a server-side request forgery (SSRF) via the file upload feature. The root cause is SSRF in the file upload handling, which can allow an attacker to trigger requests to internal resources or make unauthorized requests. PT-Security notes remediation...
CVE-2024-29188
CVE-2024-29188 affects WiX Toolset. The RemoveFolderEx action could be abused by a per-user folder link (directory junction) in a per-machine installer to cause deletion of protected directories during Windows Installer processing. This could allow a standard user to delete protected directories ...
CVE-2024-29187
CVE-2024-29187 affects Wix Burn-based bundles when run as SYSTEM. Burn drops binaries into the insecure C:\Windows\Temp via GetTempPathW, allowing an attacker to hijack the binaries and elevate privileges. The issue is fixed in Wix 3.14.1 and 4.0.5. Affected component: Wix Toolset Burn installer ...
CVE-2024-29194
OneUptime web application vulnerability: localStorage key is_master_admin can be changed from false to true, bypassing server-side checks and granting administrative privileges to a regular user. Root cause: improper validation of client-side stored data in the web app; privileges are controlled ...
CVE-2020-36825
The CVE-2020-36825 entry refers to cyberaz0r WebRAT (up to 20191222) with a flaw in Server/api.php called download_file. Manipulating the argument name (name) allows unrestricted upload, and the issue can be triggered remotely over the network. A patch is identified (0c394a795b9c10c07085361e6fcea...
CVE-2024-2856
The CVE-2024-2856 vulnerability affects Tenda AC10 firmware 16.03.10.13/16.03.10.20. The issue is in the function fromSetSysTime of /goform/SetSysTimeCfg, where manipulating the timeZone parameter causes a stack-based buffer overflow. It can be triggered remotely and public exploits have been dis...
CVE-2024-2853
CVE-2024-2853 affects Tenda AC10U firmware 15.03.06.48/15.03.06.49, where manipulation of the usbName argument in /goform/setsambacfg formSetSambaConf leads to OS command injection. The vulnerability can be triggered remotely, and public exploit details are available. Multiple sources (NVD, Red H...
CVE-2024-2851
CVE-2024-2851 affects Tenda AC15 (versions 15.03.05.18 – 15.03.20 multi). The vulnerability is in the formSetSambaConf function at /goform/setsambacfg, where the usbName parameter is not properly sanitized, allowing OS command injection. It can be triggered remotely and the exploit has been discl...
CVE-2024-2850
The CVE-2024-2850 vulnerability affects Tenda AC15 (firmware version 15.03.05.18), specifically the saveParentControlInfo function in /goform/saveParentControlInfo. The issue is a stack-based buffer overflow triggered by manipulation of the urls argument. It can be exploited remotely and the expl...
CVE-2024-30161
CVE-2024-30161 – Qt6 base (qt6-base) / QNetworkReply header data in Qt 6.5.4, 6.5.5, and 6.6.2 can be exposed via a dangling pointer when running Qt for WebAssembly (wasm). The root cause is a dangling pointer access to header data, affecting WebAssembly builds; earlier/later Qt versions are not ...
CVE-2018-25100
CVE-2018-25100 concerns the Mojolicious Perl module prior to version 7.66. It describes a cookie leakage vulnerability in Mojo::UserAgent::CookieJar when handling multiple similar cookies for the same domain. Affected software: Mojolicious versions before 7.66 (Perl). Reported impact: potential l...
CVE-2020-36827
The CVE-2020-36827 entry affects XAO::Web (Perl) before version 1.84, where the json-embed path in Web::Action mishandles in JSON output. Impact per the documents is a security vulnerability, with CVSS v3.1 base score 5.4 (Medium) affecting network-exposed vectors, requiring low privileges and n...
CVE-2024-1603
CVE-2024-1603 affects paddlepaddle/paddle v2.6.0, enabling a read of arbitrary files via paddle.vision.ops.read_file. The issue arises from how the read_file interface handles input validation, per multiple sources in the connected documents. Impact is High for confidentiality, with no reported i...
CVE-2024-2849
The CVE-2024-2849 entry concerns SourceCodester Simple File Manager 1.0. The vulnerability arises from incorrect handling of the photo argument, enabling unrestricted file uploads. This is described as a remote, critical issue with publicly disclosed exploit information. Affected component: Simpl...
CVE-2024-24832
CVE-2024-24832 affects WordPress plugin EventPrime (Metagauss) up to version 3.3.9. Root cause: missing/improper authorization check in saving event bookings, enabling unauthenticated modification of ticket prices/attributes (Broken Access Control). Impact per sources: unauthorized data modificat...