CVE-2024-29042

CVE-2024-29042 affects the Translate package (Node.js and browser) prior to 3.0.0. An attacker who controls the second variable of the translate function can cause a cache poisoning attack by overwriting the cache key via the opt.id parameter, enabling them to influence subsequent users’ translat...

CVE-2024-28861

CVE-2024-28861 affects Symfony 1.x (1.1.0 to 1.5.18) due to a dangerous deserialization gadget chain in sfNamespacedParameterHolder, enabling remote code execution when an application deserializes user input. The issue arises from how sfOutputEscaperArrayDecorator interacts during deserialization...

CVE-2024-2820

DedeCMS 5.7 is affected by CVE-2024-2820 via the /src/dede/baidunews.php file. The vulnerability arises from manipulating the filename parameter, enabling cross-site request forgery (CSRF). The issue is exploitable remotely and the public exploit has been disclosed. Multiple sources (NVD/Red Hat/...

CVE-2024-2228

The CVE-2024-2228 issue relates to IdentityIQ/QuickLink authorization in SAP Lifecycle Manager. Connected sources indicate an authenticated user can perform a Lifecycle Manager flow or other QuickLink targeting a user outside the defined QuickLink Population. The root cause details are not fully ...

CVE-2022-32754

CVE-2022-32754 : IBM Security Verify Directory 10.0.0 is vulnerable to cross-site scripting in the Web UI, allowing arbitrary JavaScript and potentially credential disclosure within a trusted session. IBM X-Force ID: 228445. Remediation: apply fixed releases (e.g., Verify Directory 10.0.3+; relat...

CVE-2022-32751

CVE-2022-32751 affects IBM Security Verify Directory (Directory/Verify Directory) at version 10.0.0, where an information-disclosure condition could allow an attacker to retrieve sensitive server data. The published IBM notices (Security Bulletin entries) corroborate that this vulnerability is as...

CVE-2022-32756

CVE-2022-32756 affects IBM Security Verify Directory 10.0.0. The vulnerability allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser, enabling information disclosure that could aid further attacks. The evidence and scores appea...

CVE-2022-32753

CVE-2022-32753 affects IBM Security Verify Directory 10.0.0. The vulnerability arises from the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information (IBM X-Force ID: 228444). IBM's bulletin details the vulnerability in the Dire...

The NVD Disruption: Navigating Through Uncertainty in Cybersecurity

In recent weeks, a significant disruption has unfolded at the US National Institute of Standards and Technology NIST, impacting its National Vulnerability Database NVD and, by extension, the global cybersecurity landscape. The NVD, a cornerstone in the cybersecurity defense mechanisms of...

CVE-2024-2726

CVE-2024-2726 describes a Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system, where an attacker can store and execute malicious JavaScript in an application form without prior registration. The CVE details indicate the affected component is the CIGESv2 system, with a net...

CVE-2024-2725

CVE-2024-2725 affects the CIGESv2 system and describes an information-exposure vulnerability where a remote attacker can access the /vendor/composer/installed.json endpoint to enumerate all installed packages used by the application. Documented impact is information disclosure with CVSS v3.1 base...

CVE-2024-2722

CVE-2024-2722 affects the CIGESv2 system via the /ajaxConfigTotem.php endpoint, where the id parameter is vulnerable to SQL injection. This condition could allow a remote attacker to retrieve all data stored in the database, as described in the NVD entry. The available references corroborate a da...

CVE-2024-2448

CVE-2024-2448 describes an OS command injection in Kemp/LoadMaster. An authenticated UI user with any permission level can inject commands into a UI component via a shell command, leading to possible OS command execution with high impact (confidentiality, integrity, availability all high). Affect...

CVE-2024-29944

The CVE-2024-29944 issue affects Mozilla Firefox on desktop (not mobile), allowing an attacker to inject an event handler into a privileged object to achieve arbitrary JavaScript execution in the parent process. Affects Firefox versions older than 124.0.1 and Firefox ESR older than 115.9.1; multi...

CVE-2024-29943

CVE-2024-29943 is a Firefox vulnerability: an attacker could perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. Affected product: Mozilla Firefox versions earlier than 124.0.1 (desktop; ESR has separate fixes). The root cause is an incor...

CVE-2024-28824

CVE-2024-28824 affects the mk_informix Checkmk agent plugin. The flaw is a least-privilege violation and reliance on untrusted inputs that allows local privilege escalation. Affected versions are before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41, and 2.0.0 (EOL). Mitigation is to upgrade to the c...

CVE-2024-1742

Summary: CVE-2024-1742 concerns the mk_oracle Checkmk agent plugin exposing sensitive information by invoking sqlplus on the command line, allowing leakage from the process list. What is affected: Checkmk agent plugins mk_oracle prior to versions: 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41, and 2.0.0 (EO...

CVE-2024-0638

CVE-2024-0638 involves a least-privilege escalation in the Checkmk agent plugins mk_oracle , mk_oracle.ps1 , and mk_oracle_crs . Affected versions are Checkmk prior to: 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41, and 2.0.0 (EOL). The issue allows local users to escalate privileges due to the plugins’ han...

CVE-2024-2816

The CVE-2024-2816 entry concerns Tenda AC15 firmware 15.03.05.18. The vulnerability is in the fromSysToolReboot function exposed via /goform/SysToolReboot and results in cross-site request forgery. It can be exploited remotely, with public disclosures of exploits. Connected sources corroborate th...

CVE-2024-2815

CVE-2024-2815 affects Tenda AC15, specifically the R7WebsSecurityHandler in /goform/execCommand. The vulnerability stems from a stack-based buffer overflow caused by manipulating the password argument, enabling remote exploitation. Public exploit information is indicated in the entry. Connected s...