CVE-2024-1174

CVE-2024-1174 affects HP ThinPro prior to 8.0 SP8. HP ThinPro 8.0 SP8 is released with mitigations that address potential vulnerabilities. CVSS v3.1 base score 8.2 (HIGH); attack vector LOCAL, requires user interaction, with HIGH impact to confidentiality, integrity, and availability. Exploitatio...

Sql injection

A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument categoryid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2024-2077

The CVE-2024-2077 entry concerns SourceCodester Simple Online Bidding System 1.0. Affected component: index.php, where manipulating the category_id parameter enables SQL injection. Impact stated as high confidentiality, integrity, and availability risk, with remote exploitation possible and explo...

Sql injection

A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1/1. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed ...

CVE-2024-2075

CVE-2024-2075 affects SourceCodester Daily Habit Tracker 1.0. The vulnerability resides in /endpoint/update-tracker.php where manipulation of the day parameter triggers cross-site scripting. Exploitation is possible remotely, and public disclosures exist. The impact is a potential injection of sc...

CVE-2024-2074

CVE-2024-2074 affects Mini-Tmall (versions up to 20231017). The vulnerability is a SQL injection caused by manipulation of the orderBy parameter in the endpoint implemented as “?r=tmall/admin/user/1/1”. Evidence across Red Hat, NVD, CVE lists, and security feeds describes remote exploitation and ...

Cross site scripting

Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting XSS within the blog title of the settings...

Open redirect

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-22939. Reason: This candidate is a duplicate of CVE-2024-22939. Notes: All CVE users should reference CVE-2024-22939 instead of this candidate...

Cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Flashcard Quiz App 1.0. This affects an unknown part of the file /endpoint/update-flashcard.php. The manipulation of the argument question/answer leads to cross site scripting. It is possible to initiate the attack...

Sql injection

A vulnerability has been found in SourceCodester Block Inserter for Dynamic Content 1.0 and classified as critical. This vulnerability affects unknown code of the file viewpost.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has...

Design/Logic Flaw

In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences...

CVE-2024-2073

CVE-2024-2073 affects SourceCodester Block Inserter for Dynamic Content 1.0, with a SQL injection in the view_post.php file triggered by the id parameter. The vulnerability is exploitable remotely and public exploits are reported; multiple sources (Red Hat, CVE boards, vulnerability catalogs) con...

CVE-2023-52558

CVE-2023-52558 affects OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019. A kernel crash can occur from a network buffer that must be split at a certain length after receiving specially crafted escape sequences. The issue arises in the m_split handling; patches 002_msplit.patch (Ope...

Authorization

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do...

Cross site scripting

A vulnerability classified as problematic was found in SourceCodester FAQ Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-faq.php. The manipulation of the argument question/answer leads to cross site scripting. The attack can be launched...

CVE-2023-52557

OpenBSD 7.3 prior to errata 016 is affected. The npppd(8) component may crash when processing an L2TP message containing an AVP with an incorrect length. The issue is addressed by OpenBSD patch errata 016 for 7.3 (reference patches: 016_npppd.patch.sig; commit abf3a29384c582c807a621e7fc6e7c68d0ca...

CVE-2024-1624

The CVE-2024-1624 entry describes an OS Command Injection vulnerability affecting the documentation server in Dassault Systèmes’ 3DEXPERIENCE platform (R2022x–R2024x), SIMULIA Abaqus (2022–2024), SIMULIA Isight (2022–2024), and CATIA Composer (R2023–R2024). The underlying issue is an OS command i...

CVE-2024-27296

CVE-2024-27296 affects Directus: prior to 10.8.3, the exact Directus version is shipped in compiled JS bundles accessible without authentication, enabling attackers to map to known vulnerabilities in Directus core or dependencies. The issue has been fixed in 10.8.3 and later. Remediation is upgra...

CVE-2024-27140

Apache Archiva is affected by a Cross-site Scripting (XSS) issue described as Improper Neutralization of Input During Web Page Generation. The vulnerability affects Archiva versions 2.0.0 and later, with the project stated as retired and no plan for a fix. Practical impact is an XSS risk in web p...

CVE-2024-2069

CVE-2024-2069 affects SourceCodester FAQ Management System 1.0. The vulnerability is a SQL injection in the /endpoint/delete-faq.php endpoint triggered by manipulating the faq parameter. Reports state the issue is exploitable remotely and has been disclosed publicly. The root cause is an unsafely...