231579 matches found
CVE-2024-28401
TOTOLINK X2000R firmware before v1.0.0-B20231213.1013 contains a Store Cross-site Scripting (XSS) vulnerability in Root Access Control under the Wireless Page. The issue arises from inadequate input validation/escaping of user-supplied data, enabling an attacker to inject arbitrary web script or ...
CVE-2024-26540
The CVE-2024-26540 issue affects the CImg library, specifically Clmg before 3.3.3, where a crafted file loaded via cimg_library::CImg::_load_analyze can trigger a heap-based buffer overflow. The vulnerability is documented in Mageia MGASA-2025-0169 and corroborated by OSV/Red Hat/Ubuntu advisorie...
CVE-2024-27756
GLPI
CVE-2024-26454
CVE-2024-26454 affects Healthcare-Chatbot (version up to 9b7058a). A Cross Site Scripting flaw allows an attacker to inject a crafted payload via the email1 or pwd1 parameter in login.php, enabling client-side script execution. The NVD entry lists CVSS-3.1 base score 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/...
CVE-2024-28403
TOTOLINK X2000R (before V1.0.0-B20231213.1013) is vulnerable to Cross Site Scripting (XSS) via the VPN Page. The root cause cited is lack of proper filtering/escaping of user-supplied data on the VPN Page. No remediation or fix version is specified in the provided documents. Exploitation details ...
CVE-2024-28354
TRENDnet TEW-827DRU routers with firmware version 2.10B01 are affected by CVE-2024-28354. The vulnerability is a command injection in the apply.cgi interface, where an attacker can inject commands via the post parameter usapps.@smb[%d].username and obtain root shell privileges. The issue is trigg...
CVE-2024-28318
CVE-2024-28318 affects gpac 2.3-DEV-rev921-g422b78ecf-master. The issue is an out-of-bounds/write via swf_get_string in scene_manager/swf_parse.c:325, enabling a remote attacker to potentially access sensitive data. The CVSS3.1 base score is 7.1 (HIGH) with NETWORK attack vector and user interact...
CVE-2024-0803
CVE-2024-0803 affects Mitsubishi Electric MELSEC-Q/L Series CPU modules, where an Integer Overflow or Wraparound vulnerability can allow a remote, unauthenticated attacker to execute malicious code by sending a crafted packet. Affected products include MELSEC-Q/L Series CPUs (various models) with...
CVE-2024-0802
CVE-2024-0802 affects Mitsubishi Electric MELSEC-Q/L Series CPU modules (MELSEC-Q/L Series) and is an Incorrect Pointer Scaling vulnerability. A remote, unauthenticated attacker can read arbitrary data or execute code by sending a specially crafted packet. The NVD/ICS advisories cite a CVSS v3.1 ...
CVE-2024-28383
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
CVE-2024-27986
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
Design/Logic Flaw
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in opnodeipcpipe leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node childproce...
Design/Logic Flaw
RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service DoS attacks. The attacker ca...
Input validation
Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...
CVE-2024-25651
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
CVE-2024-25650
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
CVE-2024-25649
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
Design/Logic Flaw
An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickleload function of the serialize.py file...