CVE-2024-3987

CVE-2024-3987 : The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored XSS via image alt text in all versions up to 2.8.4.2, caused by insufficient input sanitization and output escaping. The vulnerability could be triggered by an authenticated attac...

CVE-2024-36774

CVE-2024-36774 describes an arbitrary file upload vulnerability in Monstra CMS v3.0.4 that enables attackers to execute arbitrary PHP code by uploading a crafted PHP file. The issue targets the CMS itself and arises from an upload path that allows PHP payloads. Estimated impact per CVSS vectors i...

CVE-2024-22525

CVE-2024-22525 concerns the dnspod-sr package at version 0dfbd37, which contains a SEGV (segmentation fault). The CVSS data indicates a LOCAL attack vector with LOW privileges required and NO user interaction, resulting in a HIGH availability impact. Multiple connected sources corroborate that th...

CVE-2024-22524

CVE-2024-22524 concerns dnspod-sr 0dfbd37, with a buffer overflow vulnerability. Affected component: dnspod-sr (version 0dfbd37). Impact per sources: availability impact HIGH; CVSSv3.1 metrics indicate LOCAL attack vector, LOW privileges, LOW complexity, no user interaction. No exploit details ar...

CVE-2024-24199

CVE-2024-24199 concerns SmartDNS. Multiple connected sources confirm a misaligned address in smartdns/src/dns.c that can cause undefined behavior. The impact statements in OSV/Ubuntu advisories indicate a potential denial of service or arbitrary code execution, depending on the environment. The C...

CVE-2024-24195

CVE-2024-24195 affects robdns via a misaligned address introduced in commit d76d2e6 at /src/zonefile-insertion.c. The issue is tracked with a CVSSv3.1 base score of 7.5 (HIGH), with NETWORK attack vector, LOW attack complexity, no privileges required, and a HIGH impact on availability (I=N, A=H; ...

CVE-2024-24194

CVE-2024-24194 concerns robdns with commit d76d2e6, which has a NULL pointer dereference via the item->tokens component in /src/conf-parse.c. The NVD metrics indicate a high impact vulnerability (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base score 7.5). The connected PT-security entry pr...

CVE-2024-24192

CVE-2024-24192 affects robdns, with a heap overflow in the code path handling block->filename in /src/zonefile-insertion.c (version d76d2e6). Multiple connected sources corroborate the issue and identify the vulnerable component as block->filename and the function zonefile-insertion.c. PT-2...

CVE-2023-49441

CVE-2023-49441 affects dnsmasq 2.9, with an Integer Overflow via the forward_query path. The vulnerability has an availability impact (High) and a network attack vector with no user interaction. Affected products include various Linux distributions (per Nessus/EulerOS advisories) where dnsmasq 2....

CVE-2024-36823

CVE-2024-36823 affects Ninja Core v7.0.0 where the encrypt() function uses a weak cryptographic algorithm, potentially leaking sensitive information. This weakness is consistently described across multiple connected sources (NVD/NV OSV entries, Red Hat, Veracode, GHSA, and OSS advisories). The av...

CVE-2024-36795

CVE-2024-36795 concerns insecure permissions in the Netgear WNR614 router firmware (version JNR1010V2/N300-V1.1.0.54_1.0.1). The issue allows attackers to access URLs and directories embedded within the firmware via unspecified vectors. The base CVSSv3.1 score is 4.0 (Medium) with local attack ve...

CVE-2024-22074

CVE-2024-22074 affects Dynamsoft Service versions ranging from 1.0.516–1.3.0115 up through 1.8.2013, and 1.4.0618–1.4.1230, 1.5.0625–1.5.3116, 1.6.0428–1.6.1112, 1.7.0330–1.7.2531, and 1.8.1025–1.8.2013, with an underlying Incorrect Access Control vulnerability. The impact is rated CRITICAL (CVSS...

CVE-2024-2359

The CVE concerns parisneo/lollms-webui v9.3. An OS command injection stems from improper neutralization, enabling remote code execution. Affected component: the host/config handling in the runtime; attacker-controlled host via the /update_setting endpoint bypasses the intended protection on /exec...

CVE-2024-2360

CVE-2024-2360 affects parisneo/lollms-webui. The vulnerability is a path traversal flaw due to insufficient sanitization of user-supplied input in the settings for the Database path and PDF LaTeX path , allowing an attacker to traverse directories and potentially execute arbitrary code on the tar...

CVE-2024-2965

CVE-2024-2965 affects the LangChain SitemapLoader in langchain-ai/langchain. The parse_sitemap function lacks a guard against self-referential sitemap recursion, enabling an infinite recursion loop that can exhaust server resources and crash the Python process. Multiple trusted sources (NVD, Red ...

CVE-2024-37153

The CVE-2024-37153 issue affects Evmos (EVM hub on Cosmos). A vulnerability occurs when a local state change happens together with an ICS20 transfer within the same function, using the contract’s address as the sender in an ICS20 precompile transfer. This enables an effective “infinite money glit...

CVE-2023-45192

IBM Engineering Requirements Management DOORS Next versions 7.0.2 and 7.0.3 are affected by an XML External Entity Injection (XXE) when processing XML data. A remote attacker could potentially expose sensitive information or exhaust memory resources due to the vulnerable XML processing. Remediati...

CVE-2024-5278

CVE-2024-5278 affects gaizhenbiao/chuanhuchatgpt. A vulnerability in the /upload endpoint allows unrestricted file uploads because handle_file_upload does not sanitize or validate file extensions or content types, enabling upload of HTML or Python files. This can lead to stored XSS and potentiall...

CVE-2024-36734

CVE-2024-36734 involves OneFlow-Inc. Oneflow v0.9.1, with an improper input validation in the dim parameter that can be exploited to cause a Denial of Service. The vulnerability is described across multiple sources as a DoS triggered by negative input values for dim, leading to availability impac...

CVE-2024-3149

The CVE-2024-3149 entry describes a Server-Side Request Forgery (SSRF) in the upload link feature of mintplex-labs/anything-llm. The vulnerability affects the upload workflow used by users with manager/admin roles, where uploaded links are processed via an internal Collector API using a headless ...