CVE-2024-24098

CVE-2024-24098 affects Code-projects Scholars Tracking System 1.0. The News Feed is vulnerable to SQL Injection due to lack of input validation, enabling potential unauthorized SQL execution. Connected advisories consistently identify the issue as a News Feed SQL injection vulnerability; exploita...

CVE-2024-26339

CVE-2024-26339 affects SWFTools, version 0.9.2. The vulnerability is a strcpy parameter overlap in the function at /home/swftools/src/swfc+0x48318a , producing conditions associated with a denial of service in multiple sources. The CVSS v3.1 vector reports a CRITICAL base score (9.1) with network...

CVE-2024-26334

CVE-2024-26334 affects swftools v0.9.2, with a vulnerability in the compileSWFActionCode function (swftools/lib/action/actioncompiler.c) that leads to a segmentation fault. Several sources label this as a denial of service risk, and the issue is consistently described across multiple feeds as a s...

CVE-2024-22889

CVE-2024-22889 affects Plone, specifically version 6.0.9, where improper access control allows remote attackers to view and enumerate all files hosted on the site with a crafted request. Public sources (NVD) flag it as a high-severity information-disclosure issue (CVSSv3.1: 7.5, Network attack ve...

CVE-2024-24276

CVE-2024-24276 is a high-severity XSS vulnerability in the Teamwire Windows desktop client (versions 2.0.1–2.4.0). The issue allows a remote attacker to exfiltrate sensitive information by crafting payloads targeting chat name, message preview, username, and group name components. No exploitation...

CVE-2024-27565

The CVE-2024-27565 issue affects ChatGPT-wechat-personal, specifically the weixin.php component, where a Server-Side Request Forgery (SSRF) vulnerability exists due to commit a0857f6. The vulnerability allows an attacker to induce the application to make arbitrary outbound requests. According to ...

Input validation

An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application to read files without authorization...

Input validation

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...

CVE-2024-1936

Thunderbird vulnerability CVE-2024-1936: In Thunderbird, the encrypted subject of an email could be incorrectly and permanently assigned to a different message in local cache, risking leakage of confidential subjects when replying. Affected product: Mozilla Thunderbird (versions prior to 115.8.1)...

Sql injection

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/operations/expensecategory.php of the component HTTP POST Request Handler. The manipulation of the argument status leads...

Code injection

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. e.g. draft, private, pending review,...

CVE-2024-1316

The CVE-2024-1316 issue affects the WordPress plugins Event Tickets and Registration (pre-5.8.1) and Events Tickets Plus (pre-5.9.1). Reports across multiple sources identify a vulnerability where users with at least the Contributor role can leak the existence of certain events they should not ac...

CVE-2024-2048

CVE-2024-2048 affects Vault and Vault Enterprise where TLS certificate auth did not properly validate client certificates when configured with a non-CA trusted certificate, potentially allowing certificate-based authentication bypass. The issue is fixed in Vault 1.15.5 and 1.14.10.

CVE-2023-6068

CVE-2023-6068 affects Arista MOS-based 7130 Series FPGA devices running MultiAccess FPGA software version 1.7.1 or 1.6.x. The issue is that applying ACLs may cause incorrect ACL operation on a port, allowing some packets that should be denied and denying some that should be allowed. Arista provid...

CVE-2024-27889

CVE-2024-27889 affects Arista Edge Threat Management - Arista NG Firewall (NGFW). The vulnerability is a set of SQL injection flaws in the reporting application that can be exploited by a user with advanced report-application access rights; exploitation could allow commands to run on the underlyi...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: IB/qib: Fix memory leak in qibusersdmaqueuepkts The wrong goto label was used for the error case and missed cleanup of the pkt allocation. Addresses-Coverity-ID: 1493352 "Resource leak"...

Buffer overflow

IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979...

CVE-2023-32331

CVE-2023-32331 – IBM Sterling Connect:Express for UNIX (1.5.0) is affected by a buffer overflow in the browser UI that can allow a remote attacker to cause a denial of service. The vulnerability originates from improper validation of input data. Remediation provided by IBM recommends upgrading to...

CVE-2021-47107

CVE-2021-47107 : Linux kernel NFSD is affected by a buffer overflow in READDIR handling. If a client sends a very small READDIR count (e.g., 0), the new init_dirlist logic can underflow the buffer size calculation, causing XDR writing to exceed the allocated space. This underflow was exposed by a...

CVE-2021-47105

CVE-2021-47105 : In the Linux kernel, the ice: xsk path had a bug where cleaning the SW ring NULLed xdp_buff but did not return the buffers to the xsk pool. This caused buffers in the umem to leak and become unusable. The fix adds a missing xsk_buff_free() in the cleanup path and ensures only the...