CVE-2024-22080

Affected product: Elspec G5 digital fault recorder (versions 1.1.4.15 and earlier). Vulnerability: Unauthenticated memory corruption during XML body parsing. Root cause: memory corruption in XML parsing path. Impact: high confidentiality, integrity, and availability impact (per CVSS 3.1 base metr...

CVE-2024-22081

CVE-2024-22081 affects Elspec G5 digital fault recorder versions 1.1.4.15 and earlier, with unauthenticated memory corruption possible in the HTTP header parsing mechanism. The issue is described across multiple sources (RH, NVD, Tenable/NASL, CVE lists) as a memory corruption vulnerability explo...

CVE-2024-28578

CVE-2024-28578 describes a Buffer Overflow in the open-source FreeImage library (version 3.19.0 [r1909]) that can allow a local attacker to execute arbitrary code via the Load() function when reading images in the RAS format. The vulnerability is triggered in FreeImage’s image-loading path, leadi...

CVE-2024-28568

CVE-2024-28568 is a buffer overflow in the open-source FreeImage library (version 3.19.0 [r1909]) that allows a local attacker to cause a denial of service when processing TIFF images via the read_iptc_profile() function. The published descriptions consistently identify FreeImage v3.19.0 and the ...

CVE-2024-29471

CVE-2024-29471 concerns OneBlog v2.3.4, which has a stored cross-site scripting (XSS) vulnerability in the Notice Manage module. The NVD entry lists a CVSSv3.1 base score of 5.4 (Medium) with network attack, low complexity, required user interaction, and scope changed. Multiple connected sources ...

CVE-2024-28577

CVE-2024-28577 affects FreeImage 3.19.0 (r1909). It is a Local Privilege/DoS issue caused by a Null Pointer Dereference in jpeg_read_exif_profile_raw() when reading JPEGs, allowing a local attacker to trigger a denial of service. Connected sources corroborate the vulnerability across multiple fee...

CVE-2024-28562

CVE-2024-28562 affects FreeImage v3.19.0 [r1909]. The vulnerability is a Buffer Overflow in the Imf_2_2::copyIntoFrameBuffer() path when reading EXR images, allowing a local attacker to execute arbitrary code. Documents consistently describe the issue as local to FreeImage’s EXR handling; no deta...

CVE-2024-22078

CVE-2024-22078 affects Elspec G5 digital fault recorder (versions 1.1.4.15 and earlier). The root cause is weak filesystem permissions on the network configuration script, allowing world-writable access and enabling privilege escalation from a standard user to administrator. Public descriptions c...

CVE-2024-28567

CVE-2024-28567 describes a buffer overflow in the FreeImage library (v3.19.0 [r1909]) that allows a local attacker to trigger a DoS via FreeImage_CreateICCProfile() when processing TIFF images. Public references in the provided documents confirm the vulnerability exists in FreeImage and affect TI...

CVE-2024-28569

The CVE-2024-28569 entry concerns the open source library FreeImage v3.19.0 (r1909) . A buffer overflow in the function Imf_2_2::Xdr::read() when processing EXR images can allow a local attacker to execute arbitrary code. This vulnerability affects FreeImage’s EXR handling and is described across...

CVE-2024-28580

CVE-2024-28580 concerns a buffer overflow in FreeImage v3.19.0 [r1909] triggered by ReadData() when processing RAS format images, allowing a local attacker to execute arbitrary code. The vulnerability is described consistently across multiple sources (NVD/NASL/Nessus/SUSE/Ubuntu/OSV/DEBIAN/Ubuntu...

CVE-2024-29472

OneBlog v2.3.4 contains a stored cross-site scripting (XSS) vulnerability in the Privilege Management module. The CVE-2024-29472 entry indicates a network-exposed, low-privilege XSS with user interaction required, resulting in partial confidentiality/integrity impact and no availability impact. T...

CVE-2024-23721

CVE-2024-23721 concerns a Directory Traversal in the Draytek Vigor3910, specifically in the process_post function. Affected product/version: Draytek Vigor3910 4.3.2.5 and earlier. The issue is triggered by a crafted POST request that causes the function to export information, indicating a potenti...

CVE-2024-22085

CVE-2024-22085 affects Elspec G5 digital fault recorder, versions 1.1.4.15 and older. The vulnerability is that the shadow file is world readable, enabling local access to sensitive account data and impacting confidentiality. The CVSSv3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N with a base ...

CVE-2024-28392

CVE-2024-28392 is a SQL injection vulnerability in the PrestaShop module pscartabandonmentpro up to version 2.0.11. The flaw affects the FrontCAPUnsubscribeJobModuleFrontController::setEmailVisualized() function, enabling a remote attacker to escalate privileges. Documents consistently state affe...

CVE-2024-28574

CVE-2024-28574 affects the open-source library FreeImage, version 3.19.0 [r1909]. The vulnerability is a buffer overflow in the function opj_j2k_copy_default_tcp_and_create_tcd() when reading images in the J2K format, enabling a local attacker to cause a denial of service. Connected sources reite...

CVE-2024-28572

CVE-2024-28572 affects the open-source FreeImage library (v3.19.0 [r1909]). A buffer overflow in FreeImage_SetTagValue() when reading JPEGs allows a local attacker to cause a DoS. Root cause: inadequate validation of input length/size. Exploitation evidence is present (PoC noted in the ADP metric...

CVE-2024-28564

CVE-2024-28564 affects FreeImage 3.19.0 [r1909]. A buffer overflow in Imf_2_2::CharPtrIO::readChars() can cause a local DoS when reading EXR images. Public details confirm the vulnerability but do not provide vendor patch information in the supplied documents. Some connected sources (e.g., unpatc...

CVE-2024-29470

OneBlog v2.3.4 is affected by a stored XSS vulnerability in the component path {{rootpath}}/links, caused by insufficient filtering/escaping of user input. Impact described across sources: an attacker could inject and execute arbitrary web script/HTML in a victim’s browser. No explicit patch/vers...

CVE-2024-29473

OneBlog v2.3.4 contains a stored cross-site scripting (XSS) vulnerability in the Role Management module. The issue stems from insufficient input filtering/escaping of user-supplied data, enabling attacker-supplied scripts to be stored and executed in the victim’s browser. CVSS data indicates low ...