CVE-2024-2607

CVE-2024-2607 is a concrete issue affecting Mozilla Firefox/Thunderbird components on Armv7-A: return registers may be overwritten during JIT/return handling , potentially enabling arbitrary code execution. The CVE is referenced in multiple advisories (Debian, AlmaLinux, CentOS) with explicit fix...

CVE-2024-2632

Summary: CVE-2024-2632 is an information-exposure vulnerability in Meta4 HR exposed via HTTP GET to /sitetest/english/dumpenv.jsp. The endpoint reportedly leaks substantial environment details, including process variables, Tomcat version, library versions, and underlying OS. Sources across NVD/CV...

CVE-2024-1146

CVE-2024-1146 concerns Devklan’s Alma Blog. Affected: versions ≤ 2.1.10. Vulnerability: cross-site scripting via storing a malicious JavaScript payload in the application by adding content to the public-facing fields Community Description or Community Rules . Impact: could enable execution of inj...

CVE-2024-1144

CVE-2024-1144 refers to an improper access control vulnerability in Devklan’s Alma Blog, affecting versions 2.1.10 and earlier. An unauthenticated user could access certain functionalities without credentials. Public sources confirm the affected software and versions; the incident is not describe...

CVE-2024-25942

Dell PowerEdge Server BIOS is affected by an Improper SMM communication buffer verification vulnerability. The root cause is improper verification in SMM communication buffers, enabling a physically present, high-privilege attacker to cause arbitrary writes to SMRAM. Impact is restricted to integ...

CVE-2024-22453

Summary: CVE-2024-22453 affects Dell PowerEdge Server BIOS. A heap-based buffer overflow arises from unchecked input in the BIOS, enabling a local, highly privileged attacker to write to memory they should not access. The vulnerability’s impact includes potential integrity and availability concer...

CVE-2024-21503

CVE-2024-21503 affects Black prior to 24.3.0. The vulnerability is a Regular Expression Denial of Service (ReDoS) in strings.py lines_with_leading_tabs_expanded, exploitable when Black processes untrusted input or inputs with thousands of leading tabs. Affected: Python Black package (versions bef...

CVE-2024-21504

CVE-2024-21504 affects livewire/livewire up to 3.4.9. The vulnerability is a Cross-site Scripting (XSS) flaw when a page uses [Url] for a property, allowing an attacker to inject HTML in a user’s browser via a crafted link. Remediation: upgrade to 3.4.9 or later (Livewire release notes and adviso...

CVE-2024-2622

The CVE-2024-2622 entry concerns Fujian Kelixin Command and Dispatch Platform up to 20240318, with an SQL injection in /api/client/editemedia.php where the attacker can manipulate the number/enterprise_uuid parameter. This allows remote exploitation and has been disclosed publicly. Affected compo...

CVE-2024-2621

The vulnerability CVE-2024-2621 affects Fujian Kelixin Communication Command and Dispatch Platform (versions up to 20240318). The issue concerns an SQL injection in the file api/client/user/pwd_update.php, triggered by manipulating the uuid argument. Exploitation may be possible remotely and publ...

CVE-2024-2620

CVE-2024-2620 affects Fujian Kelixin Communication Command and Dispatch Platform (up to 20240318). Affected is the file api/client/down_file.php; manipulating the uuid parameter triggers a SQL injection. Exploitability is remote and exploit has been disclosed publicly (VDB-257197). Multiple sourc...

CVE-2024-28446

CVE-2024-28446 affects Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 (v1.2.9). A buffer overflow is triggered by the lan_netmask parameter via the /apply.cgi API endpoint. CVSS v3.1 base score 5.7 (AV:A, AC:L, PR:L, UI:N, S:U, C:N, I:N, A:H). Connected sources consistently list LBT-T300-min...

CVE-2024-24336

CVE-2024-24336 describes a multiple XSS vulnerability in Koha Library Management System (versions 23.05.05 and earlier) affecting the endpoints /members/moremember.pl and /members/members-home.pl. The underlying issue allows malicious staff users to perform CSRF actions that can change usernames ...

CVE-2024-28092

CVE-2024-28092 concerns UBEE DDW365 XCNDDW365 software version 8.14.3105 on hardware 3.13.1. The issue allows a remote attacker within Wi‑Fi proximity to perform stored cross‑site scripting (XSS) attacks through the ASP pages: RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, and RgPar...

CVE-2024-24042

The CVE-2024-24042 entry affects Devan-Kerman ARRP versions 0.8.1 and earlier, with a directory traversal vulnerability in the RuntimeResourcePackImpl component that can allow remote code execution via the dumpDirect endpoint. Connected sources confirm the affected software and the vulnerable fun...

CVE-2024-28389

CVE-2024-28389 describes a SQL injection vulnerability in KnowBand SpinWheel, affecting v3.0.3 and earlier. The flaw resides in the SpinWheelFrameSpinWheelModuleFrontController::sendEmail() path and can allow a remote attacker to cause privilege escalation and access sensitive information. Affect...

CVE-2024-28283

CVE-2024-28283 affects Linksys E1000 routers, with firmware v2.1.03 and earlier. The vulnerability is a stack-based overflow in the pc_change_act function that leads to remote code execution. Multiple connected sources corroborate the issue, but there is no single, unified patch status in the pro...

CVE-2024-28595

CVE-2024-28595 is a SQL Injection vulnerability in Employee Management System v1.0 that can be exploited via the admin_id parameter in update-admin.php to execute arbitrary SQL. The affected component is the Employee Management System’s update-admin.php endpoint; root cause is unsafe handling of ...

CVE-2023-40277

OpenClinic GA 5.247.01 contains a reflected XSS in the login.jsp message parameter. The vulnerability affects the login flow and is documented with CVSSv3.1 base score 6.1 (MEDIUM) with Network attack vector, low attack complexity, no privileges, user interaction required, and changed scope (C/L/...

CVE-2023-40279

OpenClinic GA 5.247.01 has a directory path traversal vulnerability (CVE-2023-40279) via the Page parameter in GET /openclinic/main.do. Multiple connected sources describe potential access to arbitrary files and even execution in some contexts. No patch/version remediation details are provided in...