Memory corruption

MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-28094

CVE-2024-28094 affects the Schoolbox application’s chat functionality prior to version 23.1.3. The issue is a blind SQL Injection that authenticated attackers can exploit to read, modify, and delete database records. Multiple sources confirm the vulnerability in Schoolbox before 23.1.3 and indica...

CVE-2024-0815

CVE-2024-0815 affects paddlepaddle/paddle 2.6.0 and is caused by a command-injection in paddle.utils.download._wget_download (bypass filter). The vulnerability description in multiple sources confirms the issue is triggered via OS commands, enabling potential local exploitation. No explicit explo...

CVE-2024-1460

Summary: CVE-2024-1460 affects MSI Afterburner v4.6.5.16370 and is described as a kernel memory leak in RTCore64.sys triggered by IOCTL 0x80002040. The handle to RTCore64.sys must be obtained from a high-integrity process, constraining exploitability to local, high-privilege contexts. Technical d...

CVE-2024-1443

MSI Afterburner 4.6.5.16370 is vulnerable to a Denial of Service via the RTCore64.sys driver. The DoS can be triggered by calling IOCTL 0x80002000, and the driver handle can only be obtained from a high-integrity process. No exploitation details are provided in the supplied documents, and there i...

Command injection

Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0...

Cross site scripting

Cross Site Scripting XSS vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter...

CVE-2024-0817

CVE-2024-0817 concerns PaddlePaddle 2.6.0's IrGraph.draw. Connected sources provide a concrete technical detail: the vulnerability arises from lack of proper input validation on user-supplied data (save_path and name parameters), which are directly incorporated into a subprocess call, enabling co...

Sql injection

Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php...

CVE-2024-0199

CVE-2024-0199 is an authorization bypass in GitLab. Affected are versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2, where an attacker could bypass CODEOWNERS by sending a crafted payload in an old feature branch to perform malicious actions. The provided sources co...

CVE-2024-28222

CVE-2024-28222 affects Veritas NetBackup prior to 8.1.2 and NetBackup Appliance prior to 3.1.2. The BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file. Impact is impactful: high confidentiality, integrity, and availability r...

CVE-2024-27733

CVE-2024-27733 is a local file-upload vulnerability in Byzro Network Smart S42 Management Platform (v.S42) affecting the component path useratte/userattestation.php. The root cause is unrestricted/unsafe file upload that enables a local attacker to execute arbitrary code. Documents consistently r...

CVE-2024-27707

CVE-2024-27707 affects hcengineering Huly Platform v0.6.202. The vulnerability is a Server Side Request Forgery (SSRF) in the file upload path that allows attackers to run arbitrary code via a crafted SVG file. Multiple sources (NVD/Red Hat/CNNVD and related CVE ecosystems) confirm the presence o...

CVE-2022-46499

Hospital Management System 1.0 contains a SQL injection vulnerability in the pat_number parameter of his_admin_view_single_patient.php. Affected component is the web application’s single-patient admin view; root cause is improper handling of input leading to SQL injection. CVSSv3.1 base score is ...

CVE-2024-26566

CVE-2024-26566 affects Cute Http File Server v3.1. The issue allows a remote attacker to escalate privileges via the password verification component, with a network attack vector, no user interaction, and high impact (Integrity). Affected software is Cute Http File Server v3.1 (no other versions ...

CVE-2022-46497

CVE-2022-46497 affects Hospital Management System 1.0. The vulnerability is a SQL injection in the pat_number parameter of the his_doc_view_single_patien.php endpoint. According to the metadata, the CVSS v3.1 base score is 8.1 (HIGH) with Network attack vector, low attack complexity, privileges r...

CVE-2022-46089

CVE-2022-46089 is a Cross Site Scripting (XSS) vulnerability in the Online Flight Booking Management System v1.0, specifically in the add-airline form where an attacker can inject a payload via the airline parameter to execute arbitrary client-side scripts. The common details across connected doc...

CVE-2023-33676

Sourcecodester Lost and Found Information System, Version 1.0, is vulnerable to unauthenticated SQL injection in the endpoint /items/view (parameter id) via the query string ?page=items/view&id=*, which can escalate to remote command execution. Affected software/component: Sourcecodester Lost and...

CVE-2023-51786

CVE-2023-51786 affects Lustre—versions 2.13.x through 2.15.x before 2.15.4—where an Incorrect Access Control flaw allows privilege escalation and access to sensitive information. The issue’s root cause is an access-control vulnerability within Lustre’s path/permission handling (per multiple sourc...

CVE-2023-41015

CVE-2023-41015 affects code-projects.org Online Job Portal 1.0. Public docs indicate a SQL Injection vulnerability in /Employer/DeleteJob.php?JobId=1 (via JobId parameter) with CVSS v3.1 base score 5.5 (MEDIUM). Exploitation status is not documented in the provided sources. No remediation/fix det...