CVE-2024-20763

Adobe Animate is affected by CVE-2024-20763: an out-of-bounds read in GIF/file parsing for version 24.0, 23.0.3 and earlier that can disclose memory and bypass ASLR. Exploitation requires user interaction (victim opens a malicious file). Patches are available: update to non‑affected builds 23.0.4...

CVE-2024-20761

Adobe Animate is affected by CVE-2024-20761, an out-of-bounds write in the BMP/file parsing path that can allow arbitrary code execution in the context of the current user. Affected versions are 24.0, 23.0.3 and earlier. Exploitation requires user interaction (victim must open a malicious file). ...

CVE-2024-21652

Argo CD prior to versions 2.8.13, 2.9.9, and 2.10.4 is affected by a multi-facet issue where a chain of vulnerabilities, including a Denial of Service and in-memory data storage weakness, can bypass the brute-force login protection. This enables unlimited login attempts and can crash the service,...

CVE-2024-27096

GLPI (Free Asset and IT Management Software) is affected by CVE-2024-27096 : a SQL injection vulnerability in the search engine that can be exploited by an authenticated user to extract data from the database. The vulnerability has been patched in version 10.0.13 ; multiple sources (NVD, RH Red H...

CVE-2024-2229

Schneider Electric EcoStruxure Power Design - Ecodial (NL/INT/FR) is affected by a CWE-502 Deserialization of Untrusted Data vulnerability in the BinSerializer deserialization path. All versions of EcoStruxure Power Design - Ecodial are listed as affected; the issue could allow remote code execut...

CVE-2024-2050

The CVE-2024-2050 entry is an active Cross-site Scripting (CWE-79) vulnerability affecting Schneider Electric Easergy T200 (SC2-04MOD-07000104 and earlier). Root cause: improper neutralization of inputs during web page generation, enabling injection and execution of arbitrary JavaScript in the pr...

CVE-2024-20757

Technical details about CVE-2024-20757 are not publicly available in the provided connected documents. Monitor for updates from official advisories; the initial description notes an out-of-bounds read affectingBridge versions and that exploitation requires user interaction.

CVE-2024-20755

Adobe Bridge CVE-2024-20755 is a heap-based buffer overflow in PDF parsing that can lead to arbitrary code execution in the context of the current user. Affected: Bridge 13.0.5, 14.0.1 and earlier. Exploitation requires the user to open a malicious file. Remediation per advisories is to upgrade t...

CVE-2024-20752

Adobe Bridge is affected by a Use-After-Free vulnerability in the PS file parsing for Bridge 13.0.5, 14.0.1 and earlier, enabling arbitrary code execution in the context of the current user when a malicious file is opened. The issue (CVE-2024-20752) requires user interaction and local access to e...

CVE-2024-20756

CVE-2024-20756 affects Adobe Bridge 13.x prior to 13.0.6 and 14.x prior to 14.0.2. The issue is an out-of-bounds write that can lead to arbitrary code execution in the context of the current user. Exploitation requires the victim to open a malicious file (user interaction). Affected product versi...

CVE-2024-2390

CVE-2024-2390 relates to a Nessus plugin vulnerability where a user with sufficient permissions on a scan target could place a binary in a specific filesystem location and abuse the plugin to escalate privileges. Descriptions from PT-2024-2338 indicate the issue stems from inadequate access contr...

CVE-2024-27930

GLPI CVE-2024-27930 affects GLPI (Asset/IT Management) where an authenticated user can access sensitive fields data from items they have read access. Root cause details are not fully specified in the provided documents; the issue is mitigated by patching in version 10.0.13. The vulnerability is a...

CVE-2024-1658

CVE-2024-1658 affects the Grid Shortcodes WordPress plugin prior to 1.1.1. The root cause is that the plugin does not validate and escape certain shortcode attributes before outputting them in a page/post, enabling a Stored XSS when the shortcode is embedded. Impact: users with the contributor ro...

CVE-2024-1333

The CVE-2024-1333 entry affects the WordPress plugin Responsive Pricing Table (dk-pricr-responsive-pricing-table) prior to version 5.1.11. Root cause: the plugin does not validate and escape certain Pricing Table options before output, enabling Stored XSS when a page/post is rendered with the rel...

CVE-2024-1331

CVE-2024-1331 affects the Team Members WordPress plugin prior to version 5.3.2. The vulnerability arises because certain shortcode attributes are not validated or escaped before being output in a post/page where the shortcode is embedded. This can allow users with the author role or higher to per...

CVE-2024-20746

CVE-2024-20746 affects Adobe Premiere Pro, specifically versions 24.1, 23.6.2 and earlier. It is an out-of-bounds write vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. The is...

CVE-2024-20745

Adobe Premiere Pro (versions 24.1, 23.6.2 and earlier) is affected by a heap-based buffer overflow vulnerability in AVI/file parsing that could lead to arbitrary code execution in the context of the current user. Exploitation requires the user to open a malicious file. The issue is discussed acro...

Rapid7 offers continued vulnerability coverage in the face of NVD delays

Recently, the US National Institute of Standards and Technology NIST announced on the National Vulnerability Database NVD site that there would be delays in adding information on newly published CVEs. NVD enriches CVEs with basic details about a vulnerability like the vulnerability’s CVSS score,...

CVE-2024-22257

CVE-2024-22257 refers to a broken access control in Spring Security where an application vulnerable if it directly uses AuthenticatedVoter.vote with a null Authentication. The entry lists affected versions: 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, 6.0.x prior to 6.0.9, 6.1.x prior to 6.1.8, ...

CVE-2024-2598

CVE-2024-2598 affects AMSS++ version 4.31, with a Cross-Site Scripting (XSS) vulnerability due to insufficient encoding of user-controlled input in multiple parameters of the /amssplus/modules/book/main/select_send_2.php endpoint. Exploitation could allow a remote attacker to lure an authenticate...