CVE-2024-5171

CVE-2024-5171: Integer overflow in libaom’s internal function img_alloc_helper can cause a heap buffer overflow when large d_w/d_h/align values are used. The overflow can affect the returned aom_image_t fields via calls to aom_img_alloc(), aom_img_wrap(), or aom_img_alloc_with_border(), as descri...

CVE-2024-27374

CVE-2024-27374 concerns Samsung Mobile Processor Exynos models 980, 850, 1280, 1380, and 1330. The vulnerability is in the function slsi_nan_publish_get_nl_params() where there is no input validation for hal_req->service_specific_info_len sourced from userspace, allowing a potential heap overw...

CVE-2024-27372

CVE-2024-27372 affects Samsung Mobile Processor Exynos 980, 850, 1280, 1380, and 1330. The vulnerability resides in the function slsi_nan_config_get_nl_params() where there is no input validation for disc_attr->infrastructure_ssid_len from userspace, enabling a potential heap overwrite. The is...

CVE-2024-27381

CVE-2024-27381 affects Samsung Mobile Processor Exynos 980/850/1280/1380/1330. The issue is in the function slsi_send_action_frame_ut() where there is no input validation on len from userspace, enabling a heap over-read. Impact is labeled as Confidentiality HIGH and Availability HIGH, with Local ...

CVE-2024-36129

OpenTelemetry Collector is affected by CVE-2024-36129, an unsafe decompression vulnerability that allows unauthenticated remote DoS via excessive memory consumption. The issue affects the OpenTelemetry Collector and its modules, with fixes published in version 0.102.1 of the collector and 0.102.1...

CVE-2024-4009

This CVE (CVE-2024-4009) affects ABB KNX hardware and related components: ABB, Busch-Jaeger, FTS Display (v1.00), and BCU (v1.3.0.33). The vulnerability allows an attacker with Local access to capture and replay KNX telegrams on the local KNX Bus-System. Documented impact includes high confidenti...

CVE-2024-35674

CVE-2024-35674 – Missing Authorization in Unlimited Elements for Elementor (Free Widgets, Addons, Templates) affects Unlimited Elements For Elementor up to version 1.5.109. Public exploitation details are not provided in the supplied documents; no remediation details are specified here.

CVE-2024-20404

CVE-2024-20404 affects Cisco Finesse web-based management interface. The issue is an SSRF caused by insufficient validation of user-supplied input in HTTP requests sent to the device. An unauthenticated, remote attacker can exploit crafted HTTP requests to obtain limited sensitive information fro...

CVE-2024-24790

Summary: CVE-2024-24790 concerns the behavior of the Go networking IsPrivate/IsLoopback (and related) methods when given IPv4-mapped IPv6 addresses. The connected advisories/entries confirm a mismatch where these addresses could be treated as non-private, non-loopback in Go’s net/ip logic, potent...

CVE-2024-4812

The CVE-2024-4812 entries describe a stored cross-site scripting (XSS) vulnerability in the Katello plugin for Foreman, where malicious JavaScript can be saved in a user Description field and executed when loading pages such as Host Collections. Root cause: insufficient input sanitization of the ...

CVE-2024-5629

CVE-2024-5629 describes an out-of-bounds read in the PyMongo BSON deserializer. The advisory notes that PyMongo 4.6.2 and earlier can deserialize malformed BSON provided by a server, potentially raising an exception that may contain arbitrary memory. Affected component: PyMongo’s bson module. Imp...

CVE-2024-35673

CVE-2024-35673 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Pure Chat – Live Chat & More! WordPress plugin, affecting version range up to 2.22. The vulnerability is categorized as a CSRF issue with a Medium risk (CVSS v3.1 score 4.3 in NVD metrics). The connected documents i...

CVE-2024-5459

CVE-2024-5459 affects the Restaurant Menu and Food Ordering plugin for WordPress. All versions up to 2.4.16 are vulnerable due to missing capability checks on add_section, add_menu, add_menu_item, and add_menu_page, enabling authenticated users with Subscriber-level access and above to create men...

CVE-2024-1662

The CVE-2024-1662 entry describes a Missing Authentication for Critical Function / Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application, allowing retrieval of embedded sensitive data in versions before 2.02. Affected component is the PowerBa...

CVE-2024-5526

Grafana OnCall CVE-2024-5526 affects versions 1.1.37–1.5.1, with a Server Side Request Forgery (SSRF) vulnerability in the webhook functionality. The issue is resolved in version 1.5.2. Affected component: Grafana OnCall webhook handler. Impact described as SSRF; no explicit exploitation details ...

CVE-2024-4743

CVE-2024-4743 affects LifterLMS – WP LMS for eLearning. It is a SQL Injection via the lifterlms_favorites shortcode’s orderBy parameter in all versions up to 7.6.2, caused by insufficient escaping and incomplete query preparation. An authenticated attacker with Contributor-level access can inject...

CVE-2024-4821

Technical details beyond this entry are not provided in the supplied documents; monitor for updates from vendors/advisories.

CVE-2024-5571

CVE-2024-5571 affects the EmbedPress plugin for WordPress (EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, YouTube, etc.). It is a Stored XSS vulnerability in the EmbedPress PDF widget via the url attribute in versions up to 4.0.1, allowing authenticated attackers with contributor-level acces...

CVE-2024-1272

Affected software: TNB Mobile Solutions Cockpit Software. Vulnerability: Inclusion of Sensitive Information in Source Code allows retrieval of embedded sensitive data. Impact: confidentiality impact HIGH; integrity/availability not affected per provided details. Versions: before v0.251.1. Root ca...

CVE-2024-23669

CVE-2024-23669 affects Fortinet FortiWebManager; improper authorization could allow an attacker to execute unauthorized code or commands via HTTP requests or CLI. Affected versions include FortiWebManager 7.2.0, 7.0.0–7.0.4, 6.3.0, 6.2.3–6.2.4, and 6.0.2. CVSS details in the NVD indicate high imp...