CVE-2023-52615

CVE-2023-52615 : The Linux kernel patch fixes a deadlock in the hwrng read path when a user reads from /dev/hwrng and mmap()’ed memory overlap. Root cause is a page fault during copy_to_user invoked from the hwrng core read path, which could trigger a recursive read and deadlock. The fix switches...

CVE-2024-1606

CVE-2024-1606 describes a lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 that allows logged-in users to manipulate generated web pages by injecting HTML code, potentially enabling phishing via malicious links. The issue affects the web/UI layer and is caused by insufficien...

CVE-2024-1605

CVE-2024-1605 affects BMC Control-M branches 9.0.20 and 9.0.21. On user login, the app loads all DLLs from a directory that has write/read access for all users, allowing potentially malicious libraries to load and execute with the application’s privileges. The CVE details indicate the vulnerabili...

CVE-2024-1604

CVE-2024-1604 concerns BMC Control-M branches 9.0.20 and 9.0.21 where an improper authorization flaw in the report management/creation module allows logged-in users to read and alter any report without proper permissions, given knowledge of the report identifier. Impact is limited to unauthorized...

CVE-2024-28039

CVE-2024-28039 affects FitNesse (all releases) with an improper restriction of XML external entity references (CWE-611). A remote, unauthenticated attacker can potentially obtain sensitive information, alter data, or cause a denial-of-service (DoS). Public documents consistently describe the impa...

CVE-2024-21824

CVE-2024-21824 is an improper authentication vulnerability in BROTHER printers/scanners that use Web Based Management. A network-adjacent attacker may impersonate an administrator if they can access the device. Connected sources confirm affected products are BROTHER printers/scanners with Web Bas...

CVE-2024-28745

CVE-2024-28745 concerns the ABEMA App for Android (prior to 10.65.0), where improper export of Android components can let another installed app access an arbitrary URL via Intent. This could cause an arbitrary website to be displayed within the ABEMA app, potentially enabling a phishing attack ag...

CVE-2024-2581

The CVE-2024-2581 vulnerability affects Tenda AC10 firmware 16.03.10.13, specifically the fromSetRouteStatic() function in /goform/SetStaticRouteCfg. The issue is a stack-based buffer overflow triggered by manipulating the list parameter, permitting remote exploitation. Multiple sources confirm i...

CVE-2024-2575

CVE-2024-2575 concerns SourceCodester Employee Task Management System 1.0. The vulnerability affects an unknown functionality of the file /task-details.php, where manipulating the task_id parameter enables an authorization bypass. The issue is described as exploitable remotely and has had exploit...

CVE-2024-2574

CVE-2024-2574 affects SourceCodester Employee Task Management System 1.0. The vulnerability exists in the /edit-task.php endpoint where manipulating the task_id parameter leads to an authorization bypass. Exploitation is remote and publicly disclosed per the provided documents. Multiple sources c...

CVE-2024-2573

SourceCodester Employee Task Management System 1.0 is affected by a vulnerability in an unknown function within /task-info.php that enables execution after a redirect. Exploitation appears possible remotely and public exploit information exists (VDB-257076). Affected documents consistently descri...

CVE-2024-2572

CVE-2024-2572 affects SourceCodester Employee Task Management System 1.0. The vulnerability is in /task-details.php, where processing leads to execution after redirect. It can be triggered remotely and has been disclosed publicly. Multiple sources corroborate a critical/ HIGH impact depending on ...

CVE-2023-40160

CVE-2023-40160 involves a directory traversal in the Mailing List Search CGI (pmmls.exe) of A.K.I Software PMailServer/PMailServer2. The vulnerability may allow a remote attacker to obtain arbitrary files on the server. Affected CGI is pmmls.exe (and related PMailServer/PMailServer2 components). ...

CVE-2024-2570

CVE-2024-2570 affects SourceCodester Employee Task Management System 1.0. The vulnerability exists in an unknown part of the file /edit-task.php, where manipulation leads to execution after redirect and can be triggered remotely. The exploit has been disclosed publicly. Red Hat and PT Security re...

CVE-2018-25099

The CVE-2018-25099 issue affects the CryptX Perl module prior to 0.062, where gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() fail to verify the authentication tag. This can lead to input tampering without detection, as summarized in multiple advisories. Public mentions show remediatio...

CVE-2024-27757

Flusity CMS

CVE-2024-29151

Summary (CVE-2024-29151) Rocket.Chat.Audit (through 5ad78e8) depends on the Python package filecachetools , which is reported as not existing in PyPI. This dependency issue is cited across the CVE entries (NVD/Red Hat/CVE records) and is the root cause described in multiple sources. According to ...

CVE-2024-28550

The CVE-2024-28550 entry concerns Tenda AC18 router firmware V15.03.05.05, reporting a stack overflow in the filePath parameter of the formExpandDlnaFile function. Public references confirm the affected device and parameter, with a CVSSv3.1 base score of 4.3 (Network, Low privileges, no user inte...

CVE-2024-28547

CVE-2024-28547 affects Tenda AC18, vulnerable in the firewallEn parameter of the formSetFirewallCfg function. A stack overflow is reported, potentially enabling arbitrary control. Affected version: V15.03.05.05. Impact: high availability impact (CVE metrics). Some sources note the issue can be ex...

CVE-2024-24230

Komm.One CMS 10.4.2.14 is affected by a Server-Side Template Injection (SSTI) in the Velocity engine. The underling issue allows an attacker to craft a URL that uses java.lang.Runtime and getRuntime().exec to execute arbitrary OS commands on the server. This CVE-2024-24230 entry is corroborated b...