Out-of-bounds

An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions...

Input validation

An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions...

CVE-2024-23612

NI LabVIEW CVE-2024-23612 is an improper error handling vulnerability affecting LabVIEW 2024 Q1 and earlier. Public docs confirm that exploitation requires a user to open or be presented with a specially crafted VI, potentially enabling remote code execution. Related disclosures (ZDI) describe an...

Privilege escalation

Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 EOL allows local user to escalate privileges...

CVE-2024-23610

CVE-2024-23610 is an out-of-bounds write in National Instruments LabVIEW caused by a missing bounds check in VI parsing, enabling remote code execution. Affected: LabVIEW 2024 Q1 and earlier versions. The exploit requires a user to run a specially crafted VI (per ZDI/NI advisories). Impact: poten...

CVE-2024-0670

CVE-2024-0670 affects Checkmk Agent for Windows; local privilege escalation via Uncontrolled Search Path Element in agent plugins before 2.2.0p23, 2.1.0p40, and 2.0.0 (EOL). Public PoCs/exploits exist (GitHub), demonstrating local access elevation. Remediations are to upgrade to fixed releases (e...

CVE-2024-1441

CVE-2024-1441 : In libvirt, the off-by-one error in udevListInterfacesByStatus() occurs when the number of interfaces exceeds the size of the names array. This can allow a local, unprivileged attacker to crash the libvirt daemon, causing a denial of service. The CVSS/metrics indicate a LOCAL, low...

CVE-2024-2370

CVE-2024-2370 is a duplicate of CVE-2018-5341 affecting Zoho ManageEngine Desktop Central. The connected records describe a missing server-side file type/extension check in Desktop Central 10.0.124/10.0.184, and note the 2018-5341 advisory as the authoritative entry. No explicit exploit details o...

CVE-2024-28823

CVE-2024-28823 affects Amazon AWS aws-js-s3-explorer (1.0.0) . The vulnerability allows XSS when an attacker uses a crafted S3 bucket name that targets the explorer’s index.html. The root cause is a cross-site scripting vector via user-controlled bucket names, enabling execution of malicious scri...

CVE-2022-46070

GV-ASManager V6.0.1.0 has a Local File Inclusion in GeoWebServer via Path (CVE-2022-46070). The NVD entry assigns CVSSv3.1 base score 7.5 (HIGH) with Network access, Low attack complexity, No privileges required, No user interaction; confidentiality impact HIGH. Exploitation status not provided i...

CVE-2024-25854

CVE-2024-25854 affects Sourcecodester Insurance Management System v1.0. It is an XSS vulnerability that lets attackers inject arbitrary code via the Subject and Description fields when submitting a support ticket. The issue is documented across multiple feeds (NVD, Red Hat, CNNVD, etc.). The CVSS...

CVE-2024-2365

CVE-2024-2365 (Musicshelf, Android) affects Musicshelf 1.0/1.1. The vulnerability concerns an unknown function in PinningTrustManager.java (SHA-1 Handler) where manipulation could lead to a password hash with insufficient computational effort. Exploitation is described as possible on a physical d...

Default credentials

If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default...

Default credentials

If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default...

CVE-2024-2314

CVE-2024-2314 concerns the bcc tool loading kernel headers from a temporary directory during header extraction. The vulnerability is locally exploitable by an unprivileged user who could coerce bcc into loading compromised headers. Affected products vary; Nessus/MIRACLE_LINUX and TencentOS/Tencen...

CVE-2024-2313

CVE-2024-2313 affects bpftrace (and related packages across several Linux distros). The issue arises when kernel headers must be extracted: bpftrace may load headers from a temporary directory, enabling an unprivileged user to force loading of compromised Linux headers. Local, high-privilege-seek...

Design/Logic Flaw

A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /secretcoder.sql. The manipulation leads to inclusion of sensitive information in source code. The attack can be launched...

CVE-2024-2355

CVE-2024-2355 affects keerti1924 Secret-Coder-PHP-Project 1.0. The vulnerability involves an issue in an unknown functionality of the file /secret_coder.sql, where manipulation leads to inclusion of sensitive information in source code. Reported as exploitable remotely with rather high attack com...

CVE-2024-2354

Dreamer CMS 4.1.3 contains a Cross-Site Request Forgery (CSRF) flaw in the /admin/menu/toEdit endpoint, where manipulating the id parameter can trigger the CSRF. The vulnerability is exploitable remotely and has had public exploits disclosed. Multiple connected sources corroborate the issue witho...

Command injection

A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.85220230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be...