CVE-2023-50303

IBM InfoSphere Information Server 11.7 is affected by a cross-site scripting (XSS) vulnerability in the Web UI. The issue allows an attacker to embed arbitrary JavaScript and could lead to credentials disclosure within a trusted session. The CVE-2023-50303 entry is corroborated by multiple source...

CVE-2024-1932

CVE-2024-1932 affects the Freescout project (freescout-helpdesk/freescout). The entry describes an Unrestricted Upload of File with Dangerous Type vulnerability in Freescout, enabling upload of dangerous files. Multiple sources (NVD, Red Hat, OSV, CVE list) report a network-based issue with high ...

CVE-2024-24146

CVE-2024-24146 affects libming v0.4.8, where a memory leak in the parseSWF_DEFINEBUTTON function can be exploited via a crafted SWF file to trigger a denial of service. The root cause is unfreed heap allocations made for Characters and Actions within that function (per Veracode description and re...

CVE-2024-22983

The CVE-2024-22983 entry describes a SQL injection vulnerability in Projectworlds Visitor Management System v1.0 (PHP). The flaw allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint. Red Hat, NVD, CNNVD, CVE records corroborate the vulnerability detail...

CVE-2024-25830

DataCube3 v1.0 suffers from an Incorrect Access Control due to an improper directory access restriction. An unauthenticated remote attacker can exploit this by sending a URI that includes the path of the configuration file, potentially extracting the root and admin passwords . Multiple connected ...

CVE-2023-52048

RuoYi v4.7.8 contains a cross-site scripting (XSS) vulnerability in the /system/notice/ component (CVE-2023-52048). The CVSS 3.1 base score is 4.7 (Medium) with network access, requiring user interaction; no public exploit details are provided in the documents. Remediation/fix status is not expli...

CVE-2023-49338

CVE-2023-49338 affects Couchbase Server versions 7.1.x through 7.2.3 (before 7.2.4). The vulnerability arises from endpoints /admin/stats and /admin/vitals on localhost TCP port 8093 not requiring authentication, enabling potential unauthorized access to sensitive operational data. The cited CVSS...

CVE-2024-25832

Summary (CVE-2024-25832) : F-logic DataCube3 v1.0 is reported vulnerable to unrestricted file upload by manipulating the filename extension. The issue is classified with high impact (CVSSv3.1: 8.8, HIGH) and requires authentication with low privileges; exploitation could lead to code execution, d...

CVE-2024-25868

CVE-2024-25868 concerns CodeAstro Membership Management System (PHP v1.0). Affected component: add_type.php, specifically the membershipType parameter, exploited via stored XSS to trigger arbitrary code execution. Public references consistently describe a cross-site scripting vulnerability in thi...

CVE-2024-25859

Blesta (before v5.9.2) is affected by CVE-2024-25859 due to a path traversal in the /path/to/uploads/ directory. The vulnerability allows an attacker to takeover user accounts and execute arbitrary code. Affected versions are prior to 5.9.2. Mitigation: upgrade to Blesta 5.9.2 or later. As a temp...

CVE-2023-45873

CVE-2023-45873 affects Couchbase Server versions through 7.2.2. The issue is triggered when a data reader reads large volumes of documents, potentially triggering the OS out-of-memory killer and causing the application to terminate (denial of service). The Red Hat and NVD records reiterate the sa...

CVE-2024-24147

CVE-2024-24147 affects libming v0.4.8, where memory leak in parseSWF_FILLSTYLEARRAY can cause denial of service via crafted SWF files. CVSS: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Connected sources (PT-2024-20295, CNVD/CNNVD, OSV/UBUNTU, NVD) confirm the component and impact; no explicit vendor pat...

CVE-2024-27515

Osclass 5.1.2 is vulnerable to SQL Injection per multiple sources (CVE-2024-27515). The connected documents confirm the affected software and vulnerability class but do not provide concrete exploit vectors, affected modules, root-cause details, or a patch/fix. No remediation details are specified...

CVE-2024-26342

CVE-2024-26342 affects ASUS AC68U firmware version 3.0.0.4.384.82230. The vulnerability is a null pointer dereference in usr/sbin/httpd that allows remote attackers to trigger a denial of service via a network packet. Documented impact: availability loss (I: N; A: H) with network access and no re...

CVE-2024-24150

Libming 0.4.8 contains a memory leak in parseSWF_TEXTRECORD that can be exploited via a crafted SWF file to cause a denial of service. Affected component: libming/library function parseSWF_TEXTRECORD. Impact: availability degradation (DoS). Public references across multiple sources (NVD/NASL/OSV/...

CVE-2023-43769

CVE-2023-43769 affects Couchbase Server up to 7.1.4 (before 7.1.5) and before 7.2.1. The issue is that unauthenticated RMI service ports are exposed in Analytics, enabling potential unauthorized access. The available sources consistently identify Analytics as the exposed interface and indicate th...

CVE-2024-25866

CVE-2024-25866 concerns CodeAstro Membership Management System (PHP v1.0). Multiple sources describe a SQL Injection vulnerability enabling a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component. The issue is categorized with high severity (CVSS 3.1...

CVE-2024-25170

Mezzanine v6.0.0 contains a vulnerability where attackers can bypass access controls by manipulating the Host header. Descriptions across Red Hat, GHSA, OSV, NVD, and related advisories consistently reference Host header-based bypass with potential unauthorized access to information or systems. T...

CVE-2024-25351

Summary: CVE-2024-25351 is a SQL injection vulnerability affecting PHPGurukul Zoo Management System 1.0, located in the /zms/admin/changeimage.php endpoint and exploitable via the editid parameter. The issue allows an attacker to execute arbitrary SQL commands, enabling potential data disclosure ...

Fedora: Security Advisory (FEDORA-2024-d16d94b00d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...