CVE-2024-21411

CVE-2024-21411 — Skype for Consumer RCE : The vulnerability is caused by insufficient input validation in Skype for Consumer, allowing a remote attacker to execute arbitrary code. Exploitation requires user interaction (e.g., opening a malicious page/rogue link). The CVSSv3.1 base score is 8.8 (H...

CVE-2024-20671

CVE-2024-20671 affects the Microsoft Defender Antimalware Platform. The issue is a security feature bypass that could allow a local attacker, with low privileges and no user interaction, to bypass security measures and escalate impact to availability (A:H) while confidentiality and integrity rema...

CVE-2024-2182

CVE-2024-2182 concerns Open Virtual Network (OVN) with Open vSwitch/Openvswitch3 where BFD packets used for HA between hypervisors are not sufficiently validated. The flaw allows an attacker inside unprivileged workloads (including VMs/containers) to inject crafted BFD packets, triggering denial ...

Cross site scripting

CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to ...

Design/Logic Flaw

Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file functionality...

CVE-2024-1303

CVE-2024-1303 affects Badger Meter Monitool prior to 4.6.3. The root cause is an incorrect restriction that allows path traversal in the download-file function, enabling an authenticated attacker to retrieve arbitrary files from the device. Affected component: Monitool on compatible Badger Meter ...

CVE-2024-1302

CVE-2024-1302 affects Badger Meter Monitool up to version 4.6.3 and earlier. The vulnerability allows a local attacker to manipulate the application’s file parameter to point to a log file, leading to exposure of sensitive data such as database credentials. Documents consistently describe an info...

CVE-2024-1529

CMS Made Simple 2.2.14 is affected by a Cross-Site Scripting (XSS) vulnerability in the /admin/adduser.php endpoint due to insufficient encoding of user-controlled input across multiple parameters. The issue could allow a remote attacker to deliver a crafted JavaScript payload to an authenticated...

CVE-2024-1301

CVE-2024-1301 describes an SQL injection in Badger Meter Monitool affecting versions 4.6.3 and earlier. The vulnerability arises from allowably crafting input sent to the server via the j_username parameter, enabling a remote attacker to retrieve information stored in the database. Multiple conne...

CVE-2024-1528

CMS Made Simple 2.2.14 is reported to be vulnerable to Cross-Site Scripting through /admin/moduleinterface.php due to insufficient encoding of user-controlled input in multiple parameters. The issue is exploitable to deliver a crafted JavaScript payload to an authenticated user, with potential se...

CVE-2024-1527

CMS Made Simple 2.2.14 has an Unrestricted File Upload vulnerability (CVE-2024-1527). An authenticated user can bypass upload protections and potentially upload a webshell to achieve remote command execution. Multiple sources (NVD entry) describe the impact as high to critical with high confident...

Sql injection

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets...

Authorization

An improper authorization vulnerability CWE-285 in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload...

Code injection

A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe...

CVE-2024-1227

CVE-2024-1227 corresponds to an open redirect vulnerability affecting Rejetto Http File Server (HFS). CNNVD references an input validation error that enables open redirection, with specific mention of version 2.2a in that source. The NVD entry documents a open redirect impact (redirect to malicio...

CVE-2023-42789

Summary (CVE-2023-42789) A out-of-bounds write in Fortinet FortiOS and FortiProxy allows remote unauthenticated code execution via specially crafted HTTP requests, mainly via the captive portal. Affected FortiOS: 6.2.0–6.2.15, 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.5, 7.4.0–7.4.1. Affected FortiPr...

CVE-2023-48788

CVE-2023-48788 — Fortinet FortiClient EMS SQLi affects FortiClient EMS servers (versions 7.2.0–7.2.2 and 7.0.1–7.0.10). Root cause: improper neutralization of input in the FCTUID header allows an SQL injection over crafted packets, enabling an unauthenticated attacker to enable xp_cmdshell and ac...

CVE-2023-42790

CVE-2023-42790 is a remote code execution risk due to a stack-based buffer overflow in Fortinet FortiOS and FortiProxy. Affected versions include FortiOS 6.2.0–6.2.15, 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.5, 7.4.0–7.4.1 and FortiProxy 2.0.0–2.0.13, 7.0.0–7.0.12, 7.2.0–7.2.6, 7.4.0. Exploitation ...

CVE-2024-23112

This CVE affects Fortinet FortiOS and FortiProxy SSL-VPN bookmarks. Affected components are the SSL-VPN bookmark handling, where an authenticated attacker may bypass authorization via URL manipulation to access another user’s bookmarks. Affected FortiOS/ FortiProxy versions include: FortiOS 6.4.7...

CVE-2024-21761

FortiPortal suffers an improper authorization vulnerability (CWE-285) affecting FortiPortal versions 7.0.6 and below and 7.2.0. An attacker could download reports from other organizations by modifying the request payload. The issue is documented across multiple sources, with practical remediation...