CVE-2024-2596

AMSS++ 4.31 is affected by a Cross-Site Scripting (XSS) vulnerability in multiple parameters of the /amssplus/modules/mail/main/select_send.php endpoint due to insufficient encoding of user-supplied input. This could allow a remote attacker to supply a crafted URL to an authenticated user and ste...

CVE-2024-2595

AMSS++ 4.31 is affected by an XSS vulnerability in the bookdetail_khet_person.php endpoint, via the b_id parameter in /amssplus/modules/book/main/. The issue arises from insufficient encoding of user-controlled input, enabling an attacker to craft a URL that, when visited by an authenticated user...

CVE-2024-2594

AMSS++ 4.31 is affected by a Cross-Site Scripting (XSS) vulnerability due to insufficient encoding of user-controlled input in multiple parameters on /amssplus/admin/index.php. Root cause: input is not properly encoded, enabling a remote attacker to craft a URL that, when visited by an authentica...

CVE-2024-2592

The CVE-2024-2592 issue affects AMSS++ v4.31, where the vulnerability exists in the /amssplus/modules/person/pic_show.php endpoint, specifically the person_id parameter, leading to SQL injection that could allow an attacker to retrieve the database contents. The root cause is an injectable parame...

CVE-2024-2591

CVE-2024-2591 affects AMSS++ 4.31. The AMSS++ web endpoint /amssplus/modules/book/main/bookdetail_group.php is vulnerable to SQL injection via multiple parameters, enabling remote attackers to craft queries that can extract data from the database. The available documents consistently describe the...

CVE-2024-2590

AMSS++ 4.31 is affected by an SQL injection in the sd_index parameter of /amssplus/modules/mail/main/select_send.php. The issue allows a remote attacker to craft SQL queries to the database and exfiltrate data. Several connected sources (including PT-2024-21192 and CVE records) corroborate the vu...

CVE-2024-2589

AMSS++ 4.31 is affected by an SQL injection in the endpoint /amssplus/modules/book/main/bookdetail_school_person.php across multiple parameters. Remote attackers could craft queries to retrieve information from the database. The sources describe the vulnerability and general impact but do not pro...

CVE-2024-2588

CVE-2024-2588 concerns AMSS++ v4.31 with an SQL injection in the /amssplus/admin/index.php endpoint via the id parameter. Exploitation could allow a remote attacker to craft SQL queries and retrieve data from the database. The connected sources consistently describe the vulnerability as SQLi in t...

CVE-2024-2585

CVE-2024-2585 affects AMSS++ v4.31. The vulnerability is an SQL injection via the sd_index parameter in /amssplus/modules/book/main/select_send_2.php, allowing a remote attacker to craft queries and potentially retrieve all data from the database. Public documents consistently describe this as a ...

CVE-2024-27773

CVE-2024-27773 affects Unitronics Unistream Unilogic (Unitronics PLC software). Affects Unilogic versions prior to 1.35.227. Root cause per sources: use of less trusted sources, which may allow remote code execution (RCE). Impact is high (network access, local privileges, unauthenticated/low-priv...

CVE-2024-27772

CVE-2024-27772 affects Unitronics Unistream Unilogic prior to version 1.35.227. The vulnerability is an OS Command Injection that can lead to Remote Code Execution (RCE). The CVSSv3.1 vector indicates network attack with low complexity and requires low privileges, no user interaction, and results...

CVE-2024-27768

CVE-2024-27768 affects Unitronics Unistream Unilogic before version 1.35.227. The issue is a Path Traversal vulnerability that may allow remote code execution (RCE) by accessing files outside the web root. Affected component appears to be the Unilogic software on Unitronics Unistream controllers....

CVE-2024-27767

CVE-2024-27767 affects Unitronics Unistream Unilogic (PLC software platform). The issue is an improper authentication weakness that may allow an authentication bypass. Reported for versions prior to 1.35.227. Impact is reported as severe/total access potential to restricted functions. Remediation...

CVE-2024-2496

Mode C: This CVE is active in libvirt. A NULL pointer dereference in udevConnectListAllInterfaces() can occur when detaching a host interface while listing interfaces with virConnectListAllInterfaces, potentially crashing the libvirt daemon (DoS). Connected advisories confirm affected packages an...

CVE-2024-2002

CVE-2024-2002 describes a double-free in libdwarf when processing a multiply-corrupted DWARF object, where an allocation may be freed twice, leading to unpredictable results. Multiple connected advisories (Red Hat, CBL Mariner, Tencent/TSSA, Azure Linux, etc.) confirm libdwarf as the vulnerable c...

CVE-2024-20767

CVE-2024-20767 affects Adobe ColdFusion 2023 (Update 6 and earlier) and 2021 (Update 12 and earlier) due to an Improper Access Control weakness that allows an attacker to perform an arbitrary file system read when the admin panel is internet-exposed. Multiple sources confirm public exploitation a...

NIST NVD Halt Leaves Thousands of Vulnerabilities Untagged

By Deeba Ahmed 40% of 2024 CVEs Missing Key Info: NVD Data Gap Raises Security Risks! This is a post from HackRead.com Read the original post: NIST NVD Halt Leaves Thousands of Vulnerabilities Untagged...

CVE-2024-1013

CVE-2024-1013 (unixODBC) has an out-of-bounds stack write on 64-bit architectures where the caller uses 4 bytes but the callee writes 8. This can cause memory corruption or crashes, with impact depending on endianness (more visible on big-endian). Affected products in connected docs show unixODBC...

CVE-2024-26637

CVE-2024-26637 is a Linux kernel vulnerability affecting the wifi/ath11k path where mac80211 debugfs entries could be mishandled, causing ath11k to crash when entries are deleted. The root cause, per the description, is that mac80211 started deleting debugfs entries in certain cases and the code ...

CVE-2023-52616

CVE-2023-52616 affects the Linux kernel crypto/mpi code path: mpi_ec_init may fail to clear all fields in the mpi_ec_ctx on initialization, leading to a crash when the structure is released and a field is referenced later (notably when Za is computed for SM2). The issue is caused by fields not be...