CVE-2024-25995

CVE-2024-25995 involves PHOENIX CONTACT CHARX SEC-3000 (CHARX Series) AC charge controllers. The root cause is an input-validation/authentication flaw in critical functions, allowing an unauthenticated attacker to modify configurations and trigger remote code execution. Affected product versions ...

CVE-2024-25994

CVE-2024-25994 affects Phoenix Contact CHARX SEC devices (CHARX SEC-3100, and related SEC series). The CharxUpdateAgent service listens on TCP port 9999 and fails to validate user-supplied data, enabling an unauthenticated attacker to upload arbitrary script files to a fixed write-only location. ...

CVE-2024-21584

CVE-2024-21584 affects Pleasanter 1.3.49.0 and earlier, with a cross-site scripting (CWE-79) vulnerability. An attacker can lure a user to access the product via a specially crafted URL and perform a specific operation, potentially causing arbitrary script execution in the user’s browser. The iss...

CVE-2024-24964

CVE-2024-24964 affects SKYSEA Client View in Windows: improper access control in the resident process allows running arbitrary code as SYSTEM when a user with login access exploits it. Affected versions are SKYSEA Client View from Ver.11.220 up to (before) Ver.19.2. Remediation across sources poi...

CVE-2024-21805

SKYSEA Client View contains an improper access-control vulnerability (CVE-2024-21805) affecting versions 16.100 through prior to 19.3. A logged-in user can place a specially crafted DLL in a specific folder, potentially executing code with SYSTEM privileges. This is a local issue tied to the spec...

Stack overflow

DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remote Code Execution RCE vulnerability elevated from HNAP Stack-Based Buffer Overflow...

Design/Logic Flaw

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

Design/Logic Flaw

Insertion of Sensitive Information into Log File vulnerability in Hitachi Cosminexus Component Container allows local users to gain sensitive information.This issue affects Cosminexus Component Container: from 11-30 before 11-30-05, from 11-20 through 11-20-, from 11-10 through 11-10-, from 11-00...

CVE-2023-6814

The CVE-2023-6814 issue affects Hitachi Cosminexus Component Container and is caused by insertion of sensitive information into log files, leading to local information disclosure. Affected versions include 11-00 through 11-00-12, 11-10 through 11-10-10, 11-20 through 11-20-07, 11-30 through 11-30...

CVE-2024-25644

CVE-2024-25644 affects SAP NetWeaver WSRM 7.50. Under certain conditions, it allows an attacker to access information that would normally be restricted, yielding low impact on confidentiality and no impact on integrity or availability. The connected sources confirm the product and scope but do no...

CVE-2024-28339

CVE-2024-28339 describes an information leak in the debuginfo.htm component of Netgear CBR40, CBK40, and CBK43 routers (version 2.5.0.28). The issue allows attackers to obtain sensitive information without authentication, due to improper access control in the debuginfo.htm page. Publicly availabl...

CVE-2023-43292

CVE-2023-43292 is a Cross-Site Scripting vulnerability in the web application "My Food Recipe Using PHP with Source Code" v1.0. Public sources describe that a crafted payload in the Recipe Name, Procedure, or ingredients parameters can allow a local attacker to execute arbitrary code. Multiple bu...

CVE-2024-28553

The data center identifies a stack overflow in the Tenda AC18 router, specifically affecting V15.03.05.05. The vulnerability is in the AddressNat function’s entrys parameter, with root cause described as a missing bounds check on input in fromAddressNat. Reported implications include potential de...

CVE-2024-27758

CVE-2024-27758 affects RPyC prior to 6.0.0. The issue arises when a server exposes a method that calls the attribute array on a client-provided netref (e.g., np.array(client_netref)), enabling remote code execution. Impact is system compromise with high severity; exploit requires local access/vec...

CVE-2024-24101

Affected software: Code-projects Scholars Tracking System 1.0. Vulnerability: SQL Injection in Eligibility Information Update. Root cause not explicitly stated in the provided documents. Impact (as stated): High confidentiality, integrity, and availability impact per NVD CVSS v3.1 metrics (9.8 CR...

CVE-2024-28340

CVE-2024-28340 affects NETGEAR CBR40/CBK40/CBK43 routers with firmware 2.5.0.28. The currentsetting.htm component exposes an information‑leak vulnerability that allows unauthenticated attackers to obtain sensitive data via the web interface due to insufficient access control. The CVSS v3.1 base s...

CVE-2024-24093

The CVE-2024-24093 issue affects Code-projects Scholars Tracking System 1.0. A SQL injection vulnerability in the Personal Information Update functionality could let an attacker run arbitrary code, as described across multiple feeds (NVD/Red Hat/CNVD etc.). The core details indicate a high-severi...

CVE-2024-24092

The CVE-2024-24092 entry concerns Scholars Tracking System 1.0 by Code-projects.org, where a SQL Injection flaw in login.php enables attackers to run arbitrary code. The root cause is lack of validation/execution of unsanitized SQL statements. Affected software/version: Scholars Tracking System v...

CVE-2024-25325

The CVE-2024-25325 entry describes a SQL injection in the Employee Management System v1.0, exploitable via a crafted payload to the txtemail parameter in login.php. This is a local vulnerability that could allow an attacker to obtain sensitive information. The provided connected documents confirm...

CVE-2024-25331

Summary of CVE-2024-25331 : D-Link DIR-822 family devices are affected by a LAN-side unauthenticated remote code execution (RCE) vulnerability that arises from a stack-based overflow in the HNAP handling. Affected products and versions include DIR-822 Rev. B firmware 2.02KRB09 and DIR-822-CA Rev....