CVE-2024-20037

CVE-2024-20037 affects the pq component/module, where an incorrect bounds check enables a potential write-what-where condition leading to local escalation of privilege with System-level execution privileges required. Exploitation is reported as local (no user interaction). Affected versions are n...

CVE-2024-20036

CVE-2024-20036 describes a permission bypass in the vdec component that may allow local information disclosure with System privileges. Affected: vdec (details across Red Hat, NVD/NIST records). Impact per metrics: confidentiality impact High; integrity/availability not affected; attack vector Loc...

CVE-2024-20034

CVE-2024-20034 affects MediaTek battery module, with a missing bounds check that could enable local privilege escalation to System level. The vulnerability relies on no user interaction and has a network-style CVSS base with high impact across confidentiality, integrity, and availability, though ...

CVE-2024-20033

CVE-2024-20033 concerns a missing bounds check in the nvram module of MediaTek-based components, enabling local information disclosure that requires SYSTEM/privilege level for exploitation. The documented impact is information disclosure with no user interaction; no exploit vectors are provided i...

CVE-2024-20032

CVE-2024-20032 affects the aee component and describes a permission bypass due to a missing permission check, enabling local escalation of privilege with System execution privileges required. Exploitation is noted as not requiring user interaction. Connected documents corroborate the issue across...

CVE-2024-20029

CVE-2024-20029 concerns the wlan firmware with a vulnerability described as an out-of-bounds write caused by improper input validation. The underlying issue can lead to a local escalation of privilege with System execution privileges, and exploitation does not require user interaction. The availa...

CVE-2024-20028

CVE-2024-20028 is a MediaTek-related issue affecting the MediaTek stack’s “da” module, described as an out-of-bounds write due to lack of validation. The vulnerability could enable local escalation of privilege with System execution privileges and does not require user interaction. Affects MediaT...

CVE-2024-20026

CVE-2024-20026 affects the MediaTek MediaTek MTK da module (as indicated by multiple feeds) and is caused by improper input validation in the da component. The flaw could allow local information disclosure with system execution privileges required for exploitation, and no user interaction is need...

CVE-2024-20025

MediaTek da module vulnerability CVE-2024-20025: out-of-bounds write caused by an integer overflow, enabling local escalation to SYSTEM privileges with no user interaction. Patch ALPS08541686/Issue ALPS08541686 is listed as the fix. Multiple connected sources reiterate the same description; no ex...

CVE-2024-20024

CVE-2024-20024 concerns the MediaTek flashc module where an out-of-bounds write arises from insufficient input validation. The vulnerability can enable local escalation of privilege to System execution privileges without user interaction. Public documentation consistently lists the issue as affec...

CVE-2024-20022

CVE-2024-20022 describes a missing bounds check in the lk module that could allow local escalation of privilege to SYSTEM-level execution. The issue is triggered locally (no user interaction required) and is corroborated across multiple connected sources (e.g., Red Hat advisory and other feeds) w...

CVE-2024-20005

The CVE-2024-20005 entry describes a permission bypass in MediaTek’s da module due to a missing permission check. This could allow local escalation to SYSTEM privileges with no user interaction required. The impact is confined to local, system-level access; exploitation details are not provided, ...

CVE-2024-20019

CVE-2024-20019 concerns a memory leak in the wlan driver caused by improper input handling. The issue enables remote denial of service without privileges, with no user interaction required for exploitation. Patch WCNCR00351241 is identified (Issue MSV-1173). Connected sources reference MediaTek a...

CVE-2024-20018

CVE-2024-20018 affects the MediaTek WLAN driver. The issue is an out-of-bounds write caused by improper input validation, enabling local escalation of privilege with no additional execution privileges required and no user interaction needed. A patch is available (Patch ID: WCNCR00348479; Issue ID...

CVE-2024-20020

OP-TEE (Trusted Execution Environment) vulnerability CVE-2024-20020 involves an out-of-bounds write caused by an incorrect bounds check. This could enable local information disclosure with System execution privileges required, and no user interaction is needed. The issue is tracked with patch ALP...

CVE-2024-20017

CVE-2024-20017 affects MediaTek Wi‑Fi chipsets via the wappd/wlan path, where an out-of-bounds write caused by insufficient input validation can enable remote code execution without user interaction. The issue is observed in MediaTek’s wappd, with public reports indicating affected firmware/SDK v...

Sql injection

A vulnerability has been found in SourceCodester Online Mobile Management Store 1.0 and classified as critical. This vulnerability affects unknown code of the file viewproduct.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has be...

Sql injection

A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown function of the file adminclass.php. The manipulation of the argument img leads to sql injection. It is possible to launch the attack remotely. The exploit has be...

Sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /admin/orders/vieworder.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-2156

CVE-2024-2156 affects SourceCodester Best POS Management System 1.0. The vulnerability is a SQL injection in an unknown function within admin_class.php, triggered by manipulating the img argument. The issue can be exploited remotely and a public exploit exists. Multiple connected sources corrobor...