CVE-2024-28563

The CVE-2024-28563 vulnerability affects FreeImage v3.19.0 (r1909). The root cause is a buffer overflow in the EXR image path, specifically Imf_2_2::DwaCompressor::Classifier::Classifier(), which can cause a locally-triggered DoS when reading EXR images. The provided connected documents confirm t...

CVE-2024-28564

CVE-2024-28564 affects FreeImage 3.19.0 [r1909]. A buffer overflow in Imf_2_2::CharPtrIO::readChars() can cause a local DoS when reading EXR images. Public details confirm the vulnerability but do not provide vendor patch information in the supplied documents. Some connected sources (e.g., unpatc...

CVE-2024-28392

CVE-2024-28392 is a SQL injection vulnerability in the PrestaShop module pscartabandonmentpro up to version 2.0.11. The flaw affects the FrontCAPUnsubscribeJobModuleFrontController::setEmailVisualized() function, enabling a remote attacker to escalate privileges. Documents consistently state affe...

CVE-2024-28573

CVE-2024-28573 is a buffer overflow vulnerability in the open-source library FreeImage v3.19.0 (r1909) that allows a local attacker to trigger a DoS by calling jpeg_read_exif_profile() while reading JPEG images. The issue affects FreeImage as packaged in multiple distributions and has been docume...

CVE-2024-28735

Summary: CVE-2024-28735 affects Unit4 Financials by Coda prior to 2023Q4. An authenticated user can bypass access control to change any user’s password via a crafted request (PoC shows POST /coda/rest/session/password with fields including user, newPassword, and target username). Impact: password...

CVE-2024-28576

CVE-2024-28576 concerns the FreeImage library. A buffer overflow in FreeImage v3.19.0 (r1909) allows a local attacker to cause a DoS by triggering the opj_j2k_tcp_destroy() path when reading images in J2K format. The vulnerability is due to improper handling within this function, enabling denial ...

CVE-2024-28396

CVE-2024-28396 affects MyPrestaModules ordersexport, version 6.0.2 and earlier. The vulnerability resides in the download.php component and allows a remote attacker to execute arbitrary code. Public sources consistently describe a need to update to a version that contains a fix; no exploit specif...

CVE-2024-29419

TOTOLINK X2000R is affected by a Cross-site Scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page. The issue exists in versions prior to v1.0.0-B20231213.1013, with the likely impact being execution of arbitrary script within the device’s web UI. Remediation per PT-2024...

CVE-2024-28579

CVE-2024-28579 concerns a buffer overflow in the open‑source FreeImage library (v3.19.0 [r1909]). The vulnerability is triggered by the FreeImage_Unload() function when processing HDR images, allowing a local attacker to cause a denial of service. Affected component is FreeImage_Version 3.19.0; i...

CVE-2024-28570

CVE-2024-28570 describes a buffer overflow in the open source library FreeImage v3.19.0 [r1909]. A local attacker can trigger a denial of service by invoking processMakerNote() while reading JPEG images. The description is consistent across multiple sources in the connected documents, which do no...

CVE-2024-28286

Summary: CVE-2024-28286 affects mz-automation’s libiec61850 v1.4.0. A NULL pointer dereference is triggered in mmsServer_handleFileCloseRequest.c (src/mms/iso_mms/server/mms_file_service.c), leading to a SEGV and application crash. Multiple sources (NVD, Red Hat, OSV, CVE listings, CNNVD, CVE enr...

CVE-2024-28566

CVE-2024-28566 is a buffer overflow in the open-source FreeImage library (v.3.19.0 [r1909]) that allows a local attacker to execute arbitrary code via the TIFF reading path, specifically through AssignPixel(). The connected documents consistently describe this vulnerability in FreeImage’s TIFF ha...

CVE-2024-28582

CVE-2024-28582 applies to the open-source FreeImage library (v3.19.0, r1909). A buffer overflow in the function rgbe_RGBEToFloat() when reading HDR images allows a local attacker to execute arbitrary code. The vulnerability is documented across multiple sources (NVD,NASL/UBUNTU OSVs/SUSE/Debian t...

CVE-2024-24050

Concrete details found: CVE-2024-24050 affects Sourcecodester Workout Journal App 1.0. The vulnerability is Cross-Site Scripting (XSS) via the firstname and lastname parameters in /add-user.php, potentially allowing arbitrary code execution. Documented by multiple sources (NVD, Red Hat, CVE List,...

CVE-2024-2649

Netentsec NS-ASG Application Security Gateway 6.3 is affected by CVE-2024-2649 due to SQL injection in the /protocol/iscdevicestatus/deleteonlineuser.php endpoint when manipulating the messagecontent parameter. The vulnerability is exploitable remotely, and multiple sources indicate the exploit/p...

CVE-2024-2648

CVE-2024-2648 affects Netentsec NS-ASG Application Security Gateway 6.3, where an unknown function in /nac/naccheck.php accepts the username parameter and allows improper neutralization of data within XPath expressions (XPath injection). This enables remote abuse and exploitation once disclosed p...

CVE-2024-2646

CVE-2024-2646 affects Netentsec NS-ASG Application Security Gateway version 6.3. The vulnerability is a SQL injection in the endpoint /vpnweb/index.php?para=index triggered by manipulating the check_VirtualSiteId argument. It is exploitable remotely and has been disclosed publicly. Impacts includ...

CVE-2024-2642

CVE-2024-2642 concerns Ruijie RG-NBS2009G-P devices (up to 20240305). Affected component: the /EXCU_SHELL file, where improper handling of the Command1 argument enables remote command injection. Sources across multiple documents confirm this vulnerability and indicate that the exploit has been pu...

CVE-2024-2641

CVE-2024-2641 affects Ruijie RG-NBS2009G-P (up to 20240305). The vulnerability is in the Password Handler’s file /system/passwdManage.htm, described as an unknown function that enables improper authorization. The issue allows a remote attacker to trigger the flaw, and public exploitation has been...

CVE-2024-2169

CVE-2024-2169 describes a DoS by network loops via UDP in implementations of UDP application protocols. Connected sources show concrete details for MikroTik RouterOS (vulnerable: <6.49.12 and