CVE-2024-2264

CVE-2024-2264 concerns the keerti1924 PHP-MYSQL-User-Login-System 1.0. Multiple connected sources confirm a SQL injection vulnerability in the /login.php file, triggered by manipulating the email parameter. The issue is described as remote in attack surface, with the exploit disclosed publicly. C...

CVE-2024-28115

CVE-2024-28115 concerns FreeRTOS Kernel versions through 10.6.1, where local privilege escalation is possible via Return Oriented Programming if code injection/execution is possible. Affected are ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled (configENABLE_MPU=1). The issue is fixed...

CVE-2023-46169

CVE-2023-46169 affects IBM DS8900F HMC and could allow an authenticated user to arbitrarily delete files. Affected product/versions include DS8900F HMC firmware: R9.2 (89.22.19.0) and R9.3 (89.30.68.0, 89.32.40.0, 89.33.48.0). Remediation is provided in Microcode Bundle 89.40.89.0 (R9.4 GA2); CVE...

CVE-2023-46172

CVE-2023-46172 involves IBM DS8900F HMC where an authenticated user could bypass authentication restrictions for an authorized user. Affected versions include 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0. IBM’s Security Bulletin outlines fixes delivered in Microcode Bundle 89.40...

CVE-2024-1986

The CVE-2024-1986 entry concerns Booster Elite for WooCommerce (WordPress). The vulnerability is an arbitrary file upload flaw in wc_add_new_product() across all versions up to 7.1.7, enabling network-authenticated (Subscriber+) attackers to upload arbitrary files when product-upload is enabled, ...

CVE-2023-46170

CVE-2023-46170 affects IBM DS8900F HMC. An authenticated user could arbitrarily read files after enumerating filenames due to an information-disclosure condition in the DS8900F HMC. Affected version ranges include 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 (R9.3). IBM lists a ...

CVE-2023-46171

CVE-2023-46171 affects IBM DS8900F HMC. An authenticated user could view sensitive log information after enumerating filenames. Affected product scope includes DS8900F HMC firmware/microcode versions in R9.2 and R9.3 lines (e.g., 89.22.19.0; 89.30.68.0; 89.32.40.0; 89.33.48.0; 89.21.x series). Ro...

CVE-2024-26167

CVE-2024-26167 corresponds to a Microsoft Edge for Android spoofing vulnerability. Affected product: Microsoft Edge for Android (Chromium-based). Vulnerable item: user interface (UI) spoofing vulnerability in Edge for Android. Root cause is described as spoofing in the Edge browser, enabling a re...

Cross site scripting

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-2127

CVE-2024-2127 affects Page Builder: Pagelayer (WordPress plugin) up to version 1.8.3. The issue is stored Cross-Site Scripting via custom attributes caused by insufficient input sanitization and output escaping, enabling authenticated attackers with contributor+ permissions to inject scripts into...

CVE-2024-2128

CVE-2024-2128 affects the WordPress plugin EmbedPress (Embed PDF, Google Docs, Vimeo, Wistia, YouTube, etc.). The vulnerability is a Stored Cross‑Site Scripting flaw in the plugin’s embed widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows au...

CVE-2024-1773

CVE-2024-1773 concerns the PDF Invoices and Packing Slips For WooCommerce WordPress plugin, where PHP Object Injection can occur in all versions up to and including 1.3.7 via deserialization of untrusted input through the order_id parameter. The vulnerability authorizes authenticated attackers wi...

Input validation

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failin...

Unrestricted file upload

File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component...

Authorization

Missing Authorization vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3...

Input validation

JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts...

Design/Logic Flaw

JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data...

CVE-2023-47691

CVE-2023-47691 is rejected and not an active vulnerability entry.

Path traversal

Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6...

CVE-2024-2241

CVE-2024-2241 affects Devolutions Workspace (versions up to and including 2024.1.0). The vulnerability is due to improper access control in the user interface, allowing an authenticated user to perform unintended actions through specific permissions. The Red Hat/NVD entries corroborate the same d...