Design/Logic Flaw

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the...

Design/Logic Flaw

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability ReDos 2nd degree polynomial. This vulnerability is patched in 3.0.9.1 and 2.2.8.1...

CVE-2024-25291

CVE-2024-25291 affects Deskfiler v1.2.3. Multiple sources confirm that a crafted plugin upload can lead to arbitrary code execution, leveraging an Electron WebView to trigger RCE. The Red Hat and NVD entries repeat the same payload: uploading a specially crafted plugin enables code execution. The...

CVE-2024-25239

Sourcecodester Employee Management System v1.0 is affected by a SQL Injection vulnerability exploitable via a crafted POST to /emloyee_akpoly/Account/login.php, enabling attackers to execute arbitrary SQL commands. The root cause is improper input handling in the login endpoint, with high impact ...

CVE-2024-27655

CVE-2024-27655 affects the D-Link DIR-823G router (A1V1.0.2B05). The root cause is a buffer overflow in the SOAPACTION parameter, leading to a potential Denial of Service and possible remote code execution. Exploitation status is not detailed in the provided sources. Remediation isn’t publicly de...

CVE-2024-24110

CVE-2024-24110 affects crmeb_java prior to v1.3.4. Affected component is the GET endpoint /api/front/spread/people, where an attacker can trigger an SQL injection to run arbitrary SQL commands. The issue is documented across multiple sources (NVD/Red Hat/OSV) with the same description. Impact is ...

CVE-2023-51801

CVE-2023-51801 concerns a SQL injection in the Simple Student Attendance System v1.0, exploitable via the id parameter in student_form.php and class_form.php. Reported by multiple sources (Red Hat, CNNVD, PRION, NVD/CVE lists) as allowing remote code execution with high impact (C/H/I/A = 9.8). Af...

CVE-2024-24246

CVE-2024-24246 is a heap buffer overflow in qpdf 11.9.0 triggered by memory handling in the standard library’s shared_ptr path (std::__shared_count). Multiple connected reports (Ubuntu, Fedora, Red Hat, OpenVAS, and Nessus plugins) describe that processing certain input can crash the application,...

CVE-2023-51800

CVE-2023-51800 affects the School Fees Management System v1.0. The Red Hat/NVD/PRION entries describe a Cross Site Scripting (XSS) vulnerability that lets a remote attacker execute arbitrary code via a crafted payload in the main_settings component across multiple fields (phone, address, bank, ac...

CVE-2024-24028

CVE-2024-24028 affects Likeshop prior to 2.5.7. The issue is a Server Side Request Forgery (SSRF) vulnerability that lets an attacker view sensitive information via the avatar parameter used in UserLogic::updateWechatInfo. Public sources in Red Hat, NVD, OSV, CNNVD, CVE listings describe the same...

CVE-2024-27656

CVE-2024-27656 affects D-Link DIR-823G version A1V1.0.2B05, with a buffer overflow in handling the Cookie parameter. The Root Cause is a flaw in the firmware that allows crafted input to overflow a buffer, leading to DoS and potentially remote code execution. Documentation consistently states vul...

CVE-2024-27657

CVE-2024-27657 affects D-Link DIR-823G A1V1.0.2B05. A buffer overflow in the User-Agent parameter can cause a Denial of Service and may allow remote code execution. Reported impact is high (CVSS 3.1: AV Adjacent, AC Low, PR None, UI None, C/H/I/A = High). Public documentation cites denial-of-serv...

CVE-2024-27658

Summary: CVE-2024-27658 affects the D-Link DIR-823G (A1V1.0.2B05). The root cause is a null-pointer dereference in the function sub_4484A8(), which can be triggered by a crafted input to cause a Denial of Service. Documentation consistently reports DoS impact; no explicit exploitation details are...

CVE-2024-27659

CVE-2024-27659 affects D-Link DIR-823G A1V1.0.2B05. The issue is a null-pointer dereference in function sub_42AF30, which can be triggered by crafting input to cause a Denial of Service. Several sources (NVD, Red Hat, CNVD, CNNVD, etc.) consistently describe the vulnerability and impact as DoS, w...

CVE-2024-27662

CVE-2024-27662 involves the D-Link DIR-823G router, specifically firmware A1V1.0.2B05, with a vulnerability in the function sub_4110f4 that causes a null pointer dereference. The result is a denial of service via crafted input. The available sources consistently describe this null-pointer derefer...

CVE-2024-25811

Dreamer CMS v4.0.1 contains an access control flaw that can allow attackers to download backup files and leak sensitive information. The issue is described across sources (including Red Hat and NVD records) as an access-control error affecting Dreamer CMS 4.0.1. There is no detailed root-cause br...

CVE-2024-27661

CVE-2024-27661 affects D-Link DIR-823G (A1V1.0.2B05). The issue is a null-pointer dereference in function sub_4484A8(), which can be triggered by a crafted input to cause Denial of Service. Affected product is the DIR-823G router; impact is availability (DoS) with a CVSS v3.1 base score 6.5 (AV:A...

CVE-2024-26141

CVE-2024-26141 affects Rack, the modular Ruby web server interface. The issue arises when handling Range headers, allowing a server to respond with an unexpectedly large payload and potentially causing a denial of service in vulnerable Rack-based apps (including Rails) that use Rack::File or Rack...

CVE-2024-25126

Rack (Ruby) is affected by CVE-2024-25126, a Denial of Service caused by pathological parsing of Content-Type headers in Rack’s media type parser. The issue is disclosed across multiple advisories and is addressed by patches in Rack versions 3.0.9.1 and 2.2.8.1. In connected advisories, related D...

CVE-2024-26146

CVE-2024-26146 affects Rack (Ruby web server interface). It describes a Denial of Service due to header parsing delays caused by crafted Accept and Forwarded headers. Public details in connected sources confirm the impact is a DoS threat from header parsing in Rack; affected code path is Rack::Re...