CVE-2024-29875

Summary: CVE-2024-29875 concerns a SQL injection in Sentrifugo 3.2 via the sort_name parameter in /sentrifugo/index.php/default/reports/exportactiveuserrpt. Several connected sources corroborate the flaw and its impact of potentially exposing all data. The available documents do not specify a fix...

CVE-2024-29874

Sentrifugo 3.2 is affected by an SQL injection in the endpoint /sentrifugo/index.php/default/reports/activeuserrptpdf via the sort_name parameter. The vulnerability could allow a remote attacker to send a crafted query and exfiltrate data. CVSS v3.1 metrics indicate high impact on confidentiality...

CVE-2024-29873

Sentrifugo 3.2 is affected by an SQL injection in the endpoint /sentrifugo/index.php/reports/businessunits/format/html through the bunitname parameter. An attacker could remotely craft queries to extract data from the database. The connected documents do not provide exploit details or a confirmed...

CVE-2024-29872

The provided connected records confirm a SQL injection vulnerability in Sentrifugo version 3.2 exploitable via the /sentrifugo/index.php/empscreening/add endpoint, targeting the agencyids parameter. Root cause is lack of validation of externally entered SQL statements, enabling a remote attacker ...

CVE-2024-29871

CVE-2024-29871 affects Sentrifugo 3.2. The SQL injection vulnerability resides in the API endpoint /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber via the id parameter, potentially allowing a remote attacker to craft queries and extract data. Exploitation...

CVE-2024-29870

CVE-2024-29870 affects Sentrifugo 3.2. The vulnerability is a SQL injection in the endpoint /sentrifugo/index.php/index/getdepartments/format/html, exploiting the business_id parameter. This could allow a remote attacker to craft a query to extract data from the database. The root cause is lack o...

CVE-2024-2742

Planet IGS-4215-16T2S (firmware 1.305b210528) is affected by an OS command injection vulnerability exploitable by an authenticated attacker through the IP address functionality. The issue allows executing arbitrary commands on the remote host. Public details confirm the vulnerability, including a...

CVE-2024-26642

Technical details about CVE-2024-26642 are not publicly available in the provided documents. No affected products, impact, or remediation details are disclosed here. Monitor for updates.

CVE-2023-52620

CVE-2023-52620 – Linux kernel nf_tables timeout handling : The vulnerability stems from nf_tables in netfilter where timeout parameters for anonymous sets were not disallowed, even though they were never used from userspace. It is a local, low–severity issue per CVSSv3.1 (base 2.5) with potential...

CVE-2024-29732

CVE-2024-29732 concerns the Abast SCAN_VISIO eDocument Suite Web Viewer. The vulnerability affects the login page through the user parameter, enabling an unauthenticated user to retrieve, update, and delete all database information via SQL injection. Reported impact is high/confidentiality, integ...

CVE-2024-27438

CVE-2024-27438 affects Apache Doris. The vulnerability arises from downloading and loading arbitrary JDBC driver jars used by the JDBC catalog, enabling remote command execution when a catalog is initialized with unchecked code snippets. Affected versions are Doris 1.2.0 through 2.0.4; upgrade to...

CVE-2024-29131

CVE-2024-29131 describes an out-of-bounds write in Apache Commons Configuration, affecting 2.x releases prior to 2.10.1. Fedora advisories and Fedora/OS update entries confirm 2.10.1 as the fixed version. The connected docs provide the fix version but do not include symptom details, exploitation ...

CVE-2024-29133

CVE-2024-29133 describes an out-of-bounds write vulnerability in Apache Commons Configuration, affecting versions 2.0 up to 2.10.0 (and related entries indicate 2.0 through 2.10.1 as impacted). The issue is fixed in 2.10.1. Multiple connected sources corroborate the vulnerability class and the fi...

CVE-2024-1147

CVE-2024-1147 describes a weakness in OpenText PVCS Version Manager with weak access control that can bypass authentication to download files. The PT-2024-17018 entry specifies affected versions: OpenText PVCS Version Manager prior to 8.6.3.3. The advisory recommends upgrading to version 8.6.3.3 ...

CVE-2024-28835

CVE-2024-28835 and CVE-2024-28834 affect GnuTLS (gnutls library). CVE-2024-28835 can cause an application crash when verifying a specially crafted PEM bundle with certtool --verify-chain. CVE-2024-28834 describes a timing side-channel (Minerva) in certain ECDSA/nonces, potentially leaking informa...

CVE-2024-1538

CVE-2024-1538 affects the WordPress File Manager plugin up to version 7.2.4. The root cause is missing or incorrect nonce validation on the wp_file_manager page that includes files via the 'lang' parameter, enabling unauthenticated attackers to cause local JavaScript inclusion and potentially ach...

CVE-2023-51142

This CVE affects ZKTeco BioTime software, specifically versions 8.5.4 and earlier. The publicly documented impact is that a remote attacker can obtain sensitive information. The connected PT-2024-14056 entry confirms remediation guidance: update to a version later than 8.5.4 to resolve the issue....

CVE-2023-48903

CVE-2023-48903 affects tramyardg Autoexpress 1.3.0. The stored XSS occurs in the uploadCarImages.php flow, where user-supplied input in the imgType (also reported as imageType[]) parameter can be injected to execute arbitrary script/HTML. The vulnerability is demonstrated in public writeups and P...

CVE-2024-29374

CVE-2024-29374 affects Moodle 3.10.9 with a Cross-Site Scripting (XSS) vulnerability in the GET /?lang= parameter. The root cause is improper handling/escaping of user-supplied data in the lang query parameter, enabling XSS. Impact per sources is consistent with cross-site scripting (potential cr...

CVE-2024-29916

The CVE describes a vulnerability in dormakaba Saflok systems (pre‑November‑2023 software update) where an attacker who has a valid active or expired keycard for a property can unlock arbitrary doors via forged keycards. The root cause is a UID‑only based key derivation function, affecting Saflok...