CVE-2024-24813

Frappe framework vulnerability CVE-2024-24813: SQL injection from a specific whitelisted method affects versions prior to 14.64.0 and 15.0.0. A fixed patch is included in 14.64.0 and 15.0.0; no workarounds are documented. Upgrade to these patched versions to mitigate.

CVE-2024-2711

CVE-2024-2711 affects Tenda AC10U firmware 15.03.06.48. The vulnerability is in the addWifiMacFilter function located at /goform/addWifiMacFilter, where manipulating the deviceMac argument leads to a stack-based buffer overflow. Attacks may be launched remotely, and the exploit has been publicly ...

CVE-2024-2710

CVE-2024-2710 affects Tenda AC10U 15.03.06.49. The vulnerability resides in the setSchedWifi function in /goform/openSchedWifi, where manipulating the schedStartTime parameter causes a stack-based buffer overflow. This can be exploited remotely and, per multiple sources, the exploit has been publ...

CVE-2024-23818

GeoServer’s WMS OpenLayers Format has a stored XSS vulnerability that can be triggered by an authenticated administrator with workspace privileges to store a JavaScript payload in the GeoServer catalog, executed in another user’s browser when rendering WMS GetMap. Affected are versions prior to 2...

CVE-2024-2709

The CVE-2024-2709 vulnerability affects Tenda AC10U firmware 15.03.06.49. A stack-based buffer overflow is triggered by manipulating the argument list in the fromSetRouteStatic function of /goform/SetStaticRouteCfg, allowing remote execution with no user interaction. Multiple sources confirm the ...

CVE-2024-2708

CVE-2024-2708 affects Tenda AC10U, specifically the /goform/execCommand formexeCommand function. The vulnerability stems from a stack-based buffer overflow triggered by manipulating the cmdinput argument, potentially allowing a remote attacker to execute arbitrary code on the device. Public explo...

CVE-2023-45177

CVE-2023-45177 affects IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD. The issue is a denial-of-service caused by an error in the MQ clustering logic. Affected entries explicitly state the clustering logic as the root cause and that a DoS can occur via this flaw. Public details in connected...

CVE-2024-2630

CVE-2024-2630 affects Google Chrome on iOS, describing an inappropriate implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chromium/Chrome prior to version 123.0.6312.58. Public advisories in connected feeds confirm remediation by...

CVE-2024-2625

CVE-2024-2625 affects Google Chrome/V8 with an object lifecycle issue in V8 prior to 123.0.6312.58 that could allow remote exploitation via a crafted HTML page (high severity). The issue is fixed in Chrome 123.0.6312.58+; Debian reports a fix to 123.0.6312.86-1~deb12u1 for stable, and Fedora pack...

CVE-2024-2707

The CVE-2024-2707 entry concerns Tenda AC10U (firmware 15.03.06.49). The root cause is improper sanitization in the mac parameter of the /goform/WriteFacMac endpoint (function formWriteFacMac), enabling remote OS command injection. Impact is high: attackers can execute arbitrary commands on affec...

CVE-2024-2705

CVE-2024-2705 affects Tenda AC10U 1.0/15.03.06.49. The vulnerability is a stack-based overflow in the formSetQosBand function of /goform/SetNetControlList caused by manipulation of the list argument, potentially enabling a remote attacker to compromise confidentiality, integrity, and availability...

CVE-2024-2704

CVE-2024-2704 affects Tenda AC10U (firmware 15.03.06.49). The vulnerable code path is formSetFirewallCfg in /goform/SetFirewallCfg, where manipulating the firewallEn argument triggers a stack-based buffer overflow. The description states the attack can be launched remotely and that the exploit ha...

CVE-2024-2703

CVE-2024-2703 affects Tenda AC10U firmware 15.03.06.49. The vulnerability is a stack-based overflow in the formSetDeviceName function of /goform/SetOnlineDevName caused by manipulation of the mac argument, with remote exploitation possible. Public exploit information is disclosed (VDB-257454). Mu...

CVE-2024-23640

GeoServer stores a stored XSS vulnerability in Style Publisher. Authenticated administrators with workspace-level privileges can inject a JavaScript payload into uploaded style/legend resources or crafted datastore files, which will execute in the context of another user’s browser when viewed in ...

CVE-2024-23634

CVE-2024-23634 (GeoServer) affects GeoServer versions prior to 2.23.5 and 2.24.2. An authenticated administrator with REST Coverage/Data Store API file-store permissions can rename arbitrary files/directories to names not ending in .zip. External uploads are particularly susceptible, risking deni...

CVE-2023-51445

GeoServer’s CVE-2023-51445 is a stored XSS in the REST Resources API. Affected versions prior to 2.23.3 and 2.24.0 allow an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources, which will execute in another administrator’s b...

CVE-2023-51444

GeoServer CVE-2023-51444 is a authenticated arbitrary file upload vulnerability in REST Coverage Store API present in versions prior to 2.23.4 and 2.24.1. An admin with permissions to modify coverage stores can upload arbitrary file contents to arbitrary locations, enabling remote code execution....

CVE-2024-2291

CVE-2024-2291 (MOVEit Transfer) is a logging bypass vulnerability affecting MOVEit Transfer versions prior to 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), and 2023.1.4 (15.1.4). An authenticated user can manipulate a request to bypass the web application’s logging mechanism, causi...

CVE-2023-41038

The CVE-2023-41038 vulnerability affects Firebird DB versions 4.0.0–4.0.3 and 5.0 beta1, where a crafted long CHAR in a SET BIND statement can crash the server due to stack corruption by a non-privileged user. Fixes are available in Firebird 4.0.4.2981 and 5.0.0.117. No workarounds are documented...

CVE-2023-35888

CVE-2023-35888 affects IBM Security Verify Governance - Identity Manager/Software component (ISVG 10.0.2). The vulnerability arises from failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to disclose sensitive information via man-in-the-middle techniques. Affect...