CVE-2023-28389

CVE-2023-28389 is an Intel CSME-related issue described in multiple sources. Affected software: Intel® Converged Security Management Engine (CSME) installer software prior to version 2328.5.5.0. Root cause: incorrect default permissions in the installer could allow an authenticated user to escala...

CVE-2023-32282

CVE-2023-32282 is a race condition in BIOS firmware for a range of Intel processors that may allow a privileged user to escalate privileges via local access. Affected products include Intel Celeron J6413/N6211, Pentium J6425/N6415, and Atom x6211E/x6413E/x6425E/x6212RE/x6414RE/x6425RE/x6427FE/x62...

CVE-2023-35191

The CVE-2023-35191 entry concerns Intel SPS firmware where a resource-management error can allow a privileged user to cause a denial of service over the network. Affected components are Intel SPS firmware (versions subject to the advisory). The underlying issue is uncontrolled resource consumptio...

CVE-2023-22655

The CVE-2023-22655 entry concerns a protection mechanism failure in some 3rd/4th Gen Intel Xeon CPUs when using SGX or TDX, potentially allowing a privileged local user to escalate privileges. The connected sources identify the affected hardware as Intel Xeon processors with SGX/TDX and the root ...

CVE-2023-32666

The CVE-2023-32666 issue concerns on-chip debug and test interfaces with improper access control in some 4th Generation Intel Xeon processors when using SGX or TDX. The underlying risk is privilege escalation via local access by a privileged user. Affected products include 4th Gen Xeon Scalable, ...

CVE-2023-43490

CVE-2023-43490 concerns an incorrect calculation in the microcode keying mechanism for some Intel Xeon D processors with SGX, enabling potential information disclosure by a privileged local user. The vulnerability affects Intel microcode handling and is repeatedly referenced across distributions ...

CVE-2023-50168

CVE-2023-50168 affects Pegasystem Pega Platform versions 6.x through 8.8.4, due to an XML External Entity (XXE) vulnerability in PDF generation. The NVD and related sources classify the impact as high (CVSSv3.1: 7.7, Confidentiality Impact: High, Attack Vector: Network, Privileges Required: Low, ...

CVE-2024-25156

GoAnywhere MFT (Fortra) before version 7.4.2 contains a path traversal issue that allows an attacker to bypass endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Affected component: GoAnywhere MFT prior to 7.4.2. Root cause: path traversal enabling circumvention of permi...

CVE-2024-1623

The CVE-2024-1623 entry concerns the Sagemcom FAST3686 V2 Vodafone router. Affected component: the router’s web admin login flow, specifically Login.asp and logout.asp, with an insufficient session timeout that fails to manage session details correctly. Impact described as allowing a local attack...

CVE-2024-0313

Technical details about CVE-2024-0313 are not present in the provided documents. The connected records do not specify affected products, versions, root cause, or remediation. Monitor for updates.

CVE-2024-0311

CVE-2024-0311 affects Skyhigh Client Proxy on Windows, where a malicious insider can bypass the product’s policy without a valid release code. Connected sources describe a bypass via a named pipe MCPTrayPipe0 (CreateNamedPipeW) and related access-control weaknesses, enabling abuse of SCPBypass.ex...

CVE-2024-28746

CVE-2024-28746 affects Apache Airflow versions 2.8.0–2.8.2. The issue allows an authenticated user with limited permissions to access resources (e.g., variables, connections) from the UI that they should not access, constituting an information disclosure vulnerability. The cited connected documen...

Sql injection

SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv, displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku...

Remote code execution

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server...

CVE-2024-22398

The CVE-2024-22398 entry describes a Path Traversal vulnerability in SonicWall Email Security Appliance. An attacker with administrative privileges can perform a directory traversal to delete arbitrary files from the appliance file system. Root cause: improper limitation of a pathname to a restri...

CVE-2024-22396

CVE-2024-22396 describes an integer-based buffer overflow in SonicOS when processing IPSec IKEv2 payloads. The vulnerability is exploitable remotely under specific conditions, potentially causing Denial of Service and, in the worst case, arbitrary code execution. The affected component is SonicOS...

Sql injection

SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method...

Improper access control

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

CVE-2024-1883

CVE-2024-1883 is a reflected cross-site scripting vulnerability in PaperCut NG/MF application server. The attack is triggered by a malicious URL containing a script, and exploitation requires user interaction (the user clicking the link). Impact is described as potentially affecting confidentiali...

CVE-2024-1654

PaperCut NG/MF (CVE-2024-1654) enables potential unauthorized write operations that may lead to remote code execution. Exploitation requires authenticated admin access and knowledge of both an internal system identifier and another valid user. CVSS v3.1 base score is 7.2 (HIGH) with NETWORK attac...