CVE-2024-23944

CVE-2024-23944 is a ZooKeeper information-disclosure vulnerability involving persistent watchers. The issue arises when a watcher attached to a parent znode to which the attacker already has access is triggered; the server does not perform an ACL check at watch-trigger time, exposing the full pat...

CVE-2024-2490

CVE-2024-2490 affects Tenda AC18 with firmware 15.03.05.05. The vulnerability is a stack-based buffer overflow in the setSchedWifi function (/goform/openSchedWifi) caused by improper handling of schedStartTime/schedEndTime, exploitable remotely and publicly disclosed. There is no confirmed patch ...

CVE-2024-2489

CVE-2024-2489 affects Tenda AC18 firmware 15.03.05.05; the vulnerability is in formSetQosBand (file /goform/SetNetControlList) and stems from a stack-based buffer overflow, enabling remote exploitation. Public exploit details exist; remediation guidance from connected sources recommends disabling...

CVE-2024-2488

CVE-2024-2488 affects Tenda AC18 (firmware 15.03.05.05). The issue is a stack-based buffer overflow in the startIP parameter of the function formSetPPTPServer in /goform/SetPptpServerCfg . It can be exploited remotely and has been publicly disclosed, with potential impact on confidentiality, inte...

CVE-2024-2487

CVE-2024-2487 affects the Tenda AC18 router (version 15.03.05.05). The vulnerability is in the function formSetDeviceName of the file /goform/SetOnlineDevName, where manipulating the devName/mac arguments causes a stack-based buffer overflow. Impact details per sources indicate the issue can be e...

CVE-2024-2486

CVE-2024-2486 affects Tenda AC18 firmware version 15.03.05.05. The issue is a stack-based buffer overflow in the formQuickIndex function of /goform/QuickIndex caused by manipulating the PPPOEPassword parameter. The vulnerability can be exploited remotely, and public exploits have been disclosed (...

CVE-2024-2485

The CVE-2024-2485 issue affects Tenda AC18, version 15.03.05.05, specifically the function formSetSpeedWan in the /goform/SetSpeedWan endpoint. A vulnerability in the speed_dir argument causes a stack-based buffer overflow, which can be exploited remotely and may impact confidentiality, integrity...

CVE-2024-2399

CVE-2024-2399 affects the Premium Addons for Elementor plugin for WordPress. It is a Stored XSS vulnerability via widget attributes caused by insufficient input sanitization and output escaping in versions up to and including 4.10.23. Exploitation requires an authenticated attacker with contribut...

CVE-2024-1795

CVE-2024-1795 affects the HUSKY – Products Filter for WooCommerce Professional for WordPress. The WordPress plugin is vulnerable to an SQL injection via the 'name' parameter in the woof shortcode, in all versions up to and including 1.3.5.2. The issue arises from insufficient escaping of user-sup...

CVE-2024-1796

CVE-2024-1796 affects HUSKY – Products Filter for WooCommerce (WordPress). The vulnerability is a Stored Cross-Site Scripting via the plugin’s woof shortcode in versions up to 1.3.5.1, caused by insufficient input sanitization and output escaping on user-supplied attributes (e.g., swoof_slug). Im...

CVE-2024-2482

CVE-2024-2482 affects Surya2Developer Hostel Management Service 1.0, via the HTTP POST Request Handler in the file /check_availability.php. The vulnerability arises from manipulation of the argument named oldpassword, causing an observable response discrepancy. Impact details in the provided sour...

CVE-2024-2180

The CVE-2024-2180 entry concerns Zemana AntiLogger v2.74.204.664, where a Memory Information Leak vulnerability is triggered by the IOCTL code 0x80002020 in the zam64.sys and zamguard64.sys drivers. Concretely, affected software is Zemana AntiLogger (v2.74.204.664); vulnerable components are the ...

Cross site scripting

A cross-site scripting XSS vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cname parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...

Authorization

A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization...

Authorization

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization...

Improper access control

Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators...

CVE-2024-1916

The CVE-2024-1916 issue affects Mitsubishi Electric MELSEC-Q/L Series CPU modules. A remote, unauthenticated attacker can exploit an Integer Overflow or Wraparound condition by sending a specially crafted packet to execute arbitrary code on affected devices. Affected products include MELSEC-Q Ser...

CVE-2024-1915

Summary: CVE-2024-1915 affects Mitsubishi Electric MELSEC-Q/L Series CPU modules (Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU, Q03/04/06/13/26UDVCPU, Q04/06/13/26UDPVCPU, and MELSEC-L Series L02/06/26CPU(-P), L26CPU(-P)BT). A remote, unauthenticated attacker can trigger an Incorrect Pointer Scali...

CVE-2024-27351

The CVE-2024-27351 issue affects Django’s Truncator.words() (with html=True) and the truncatewords_html filter. The vulnerability arises from a DoS vector in crafted HTML strings and is linked to an incomplete fix for CVE-2019-14232/CVE-2023-43665. Affected versions per sources include Django 3.2...