CVE-2024-27355

CVE-2024-27355 affects phpseclib when parsing the ASN.1 certificate OID, where a crafted sub-identifier can cause a denial of service due to excessive CPU usage during decodeOID. Affected versions are 1.x < 1.0.23, 2.x < 2.0.47, and 3.x

CVE-2024-27572

CVE-2024-27572 affects LBT T300-T390 v2.2.1.8, where a stack overflow in updateCurAPlist via the ApCliSsid parameter can be triggered by a crafted POST request, causing Denial of Service (DoS). Public documents consistently describe a stack overflow in ApCliSsid affecting the device and do not pr...

CVE-2024-25293

CVE-2024-25293 affects mjml-app versions 3.0.4 and 3.1.0-beta. Multiple sources confirm a remote code execution (RCE) via the href attribute, notably involving the mj-button tag and path traversal, enabling local code execution. An exploit PoC is available (PoC repository linked in connected docu...

CVE-2024-24512

CVE-2024-24512 concerns PKP Open Journal Systems (PKP OJS) 3.4. It is a Cross Site Scripting (XSS) vulnerability in the input subtitle component that could allow an attacker to execute arbitrary code. The CVE is documented with a CVSS v3.1 base score of 6.1 (MEDIUM) with network attack vector, lo...

CVE-2023-49545

CVE-2023-49545 affects the Customer Support System v1. The vulnerability is a directory listing flaw that allows an attacker to enumerate directories and sensitive files without requiring authorization. The provided connected sources corroborate this description across multiple feeds (NVD/Red Hat...

CVE-2024-22891

CVE-2024-22891 affects Nteract v0.28.0 and is a Remote Code Execution (RCE) via Markdown links. The issue arises from using Electron WebView with nodeIntegration enabled in the Markdown parser, enabling an attacker to achieve RCE by crafting a link or shared file. The CVSS v3.1 impact is high (CV...

CVE-2024-27744

CVE-2024-27744 is a stored Cross-Site Scripting vulnerability in Petrol Pump Management Software v1.0. The issue arises from user-supplied input to the image parameter in profile.php, enabling an attacker to execute arbitrary code when the crafted payload is processed (e.g., SVG uploads). Public ...

CVE-2024-27747

Petrol Pump Management Software v1.0 (vendor mayuri_k) contains a file-upload vulnerability in profile.php via the Image parameter in the email field, enabling remote code execution. Root cause: insufficient validation of uploaded content allows uploading a PHP shell (as shown by PoCs) which can ...

CVE-2024-27559

CVE-2024-27559 – Stupid Simple CMS : A CSRF vulnerability exists in Stupid Simple CMS v1.2.4 via the component /save_settings.php. The CVSS 3.1 base metrics indicate a MEDIUM severity (6.3) with network attack vector, low attack complexity, and LOW impact on confidentiality, integrity, and availa...

CVE-2024-27567

CVE-2024-27567 affects LinBle LBT T300-T390 routers (v2.2.1.8). The vulnerability is a stack overflow in the config_vpn_pptp function triggered by the vpn_client_ip parameter, allowing a crafted POST request to cause a Denial of Service.

CVE-2024-25434

CVE-2024-25434 affects Pkp Ojs v3.3, with a stored/reflected XSS vulnerability in the Publicname parameter. The available sources describe that arbitrary web scripts/HTML can be executed via crafted input, but do not provide a confirmed exploit method or patch details. CVSS 3.1 base score is 5.4 ...

CVE-2024-27571

CVE-2024-27571 affects LBT T300-T390 v2.2.1.8. The issue is a stack overflow in the ApCliSsid parameter of the makeCurRemoteApList function, leading to Denial of Service via a crafted POST request. Affected vendor/product details appear consistently across sources (NVD, Red Hat advisory, CNNVD, C...

CVE-2024-27746

Petrol Pump Management Software v1.0 is affected by a SQL injection vulnerability that allows an attacker to execute arbitrary code via the email address parameter in index.php. The issue is documented across multiple sources (including CVE-2024-27746 records and Red Hat/CNNVD entries), with high...

CVE-2024-25386

CVE-2024-25386 affects the DICOM Connectivity Framework by LaurelBridge prior to version 2.7.6b. The issue is a directory traversal in the format_logfile.pl file that enables a remote attacker to execute arbitrary code. Impact is described as remote code execution with high severity. Affected pro...

CVE-2024-27569

Summary: CVE-2024-27569 affects LBT T300-T390 v2.2.1.8. A stack overflow comes from the ApCliSsid parameter in the init_nvram function, enabling a Denial of Service via a crafted POST request. The Red Hat and NVD entries corroborate the same description. The PT-Security entry provides practical m...

CVE-2024-27570

Affected product: LBT T300-T390 v2.2.1.8 (industrial router). Vulnerability: stack overflow in the ApCliSsid parameter of the generate_conf_router function. Impact: Denial of Service via a crafted POST request. Notes: Multiple connected documents corroborate the issue; no patch/version fix detail...

CVE-2024-27354

CVE-2024-27354 affects phpseclib 1.x < 1.0.23, 2.x < 2.0.47, and 3.x

CVE-2024-25438

CVE-2024-25438 describes a cross-site scripting (XSS) vulnerability in the Submission module of PKP Open Journal Systems (PKP OJS) version 3.3. The issue allows an attacker to inject arbitrary web scripts or HTML via a crafted payload in the Input subject field under the Add Discussion function. ...

CVE-2023-49539

Book Store Management System v1.0 is affected by a cross-site scripting (XSS) vulnerability in the category parameter of /bsms_ci/index.php/category. The root cause is unsanitized input that allows arbitrary web scripts/HTML to be injected and executed in the client. Impact is consistent with XSS...

CVE-2024-25436

CVE-2024-25436 is an XSS vulnerability in PKP Open Journal Systems (PKP OJS) v3.3, affecting the Production/Submission flow where a crafted payload in the Add Discussion subject input can execute arbitrary scripts in the victim’s browser. The cited sources consistently describe the vulnerability ...