CVE-2024-21836

CVE-2024-21836 affects llama.cpp (GGUF library header.n_tensors parsing). Talos reports a heap-based buffer overflow caused by an integer overflow when allocating ctx->infos for a crafted .gguf file, which can lead to a heap overflow during reading tensor names (info->name). Vulnerable comp...

CVE-2024-23605

Affected: llama.cpp with GGUF header.n_kv parsing (commit 18c2e17). TALOS details a heap-based buffer overflow in gguf_init_from_file caused by allocating ctx->kv with header.n_kv, risking overflow when writing kv->key strings if header.n_kv overflows the allocation. Result: potential code ...

CVE-2024-1436

CVE-2024-1436 affects the WordPress plugin set “WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit,” exposing sensitive data to unauthorized actors via unauthenticated access. The vulnerability impacts versions up to 1.0.9 (no fixed version listed in the provided data). Connected RH/Wordfen...

CVE-2024-24568

CVE-2024-24568 affects Suricata before version 7.0.3. The issue is a vulnerability in rules inspecting HTTP/2 headers that can be bypassed by crafted traffic, allowing potential bypass of defenses. It has been patched in 7.0.3; no exploitation details are provided in the linked documents. Remedia...

CVE-2024-23836

CVE-2024-23836 affects Suricata before versions 6.0.16 and 7.0.3. A crafted network traffic pattern can cause the engine to consume excessive CPU and memory, resulting in extreme slowdowns and a denial of service. Affected component: Suricata’s protocol app-layer parsers; root cause involves heav...

CVE-2024-23835

CVE-2024-23835 affects Suricata, a network IDS/IPS/MNS engine. The issue arises in the pgsql parser, where excessive memory use prior to version 7.0.3 can cause OOM-related crashes. A fix is available in Suricata 7.0.3; as a workaround, administrators can disable the pgsql app-layer parser. Multi...

CVE-2024-25913

CVE-2024-25913 concerns the WordPress plugin MoveTo by Skymoonlabs. Affected: MoveTo versions ≤ 6.2. Issue: Unrestricted Upload of File with Dangerous Type, enabling unauthenticated arbitrary file uploads. Impact is described as critical, with high confidentiality, integrity, and availability con...

CVE-2024-25925

CVE-2024-25925 describes an Unrestricted Upload of File with Dangerous Type vulnerability in the SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts WordPress plugin. Affected versions are up to 3.5.12; the issue allows unauthenticated arbitrary file uploads, enabling potential rem...

CVE-2024-26606

CVE-2024-26606 affects the Linux kernel binder subsystem. In (e)poll mode, a binder thread that issues a BINDER_WRITE_READ without a read buffer may later rely on epoll_wait to process responses, but if the epoll/wakeup signaling is not triggered for the thread’s own enqueued work, the thread can...

CVE-2024-1890

CVE-2024-1890 affects Sunny WebBox firmware 1.6.1 and earlier. Affected component is the WebBox UI vulnerable to clickjacking when an authenticated operator is served a malicious link, enabling potential UI interaction manipulation. Public sources (NVD/NVD-derived entries) describe the issue and ...

CVE-2024-1889

CVE-2024-1889 affects SMA Cluster Controller (version 01.05.01.R). The vulnerability is a Cross-Site Request Forgery (CSRF) that can be triggered when an authenticated user visits a malicious link, allowing actions with the user’s permissions on the affected device. Impact is described as high fo...

CVE-2024-22371

Summary (CVE-2024-22371) Apache Camel contains a vulnerability where crafting a malicious EventFactory and supplying a custom ExchangeCreatedEvent could expose sensitive data. This affects Camel releases across multiple branches: 3.21.x (up to 3.21.3), 3.22.x (up to 3.22.0), 4.0.x (up to 4.0.3), ...

CVE-2024-1885

CVE-2024-1885 affects LG Signage webOS. Multiple sources confirm a remote code execution vulnerability allowing arbitrary code execution on the webOS platform. The NVD entry lists CVSSv3.1 metrics with a base score of 9.8 (CRITICAL) under AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-ba...

CVE-2024-1735

CVE-2024-1735 affects armeria-saml prior to 1.27.2, where the SAML message handling allows bypass of authentication due to improper validation of unsigned messages. Impact: authentication bypass when processing specially crafted or unsigned SAML messages. The issue has been fixed in Armeria on ve...

CVE-2024-27454

The CVE-2024-27454 issue affects the orjson project: orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. Affected component is the orjson loader/parse path (orjson.loads) with potential recursion explosion. The vulnerability is reflected in CVSS 3.1 as HIGH impact to a...

CVE-2024-25763

CVE-2024-25763 affects openNDS 10.2.0 with a Use-After-Free in /openNDS/src/auth.c. The Red Hat/OSV/Ubuntu/NASL entries confirm the same description across multiple sources. The CVE’s metrics show a CVSS v3.1 base score of 5.5 (Medium) with network attack vector, low attack complexity, and privil...

CVE-2024-25082

FontForge (through 20230101) is affected by CVE-2024-25081 and CVE-2024-25082, allowing shell command injection via specially crafted filenames or archives/compressed files. Public advisories from Debian (DSA-5641-1), AlmaLinux (ALSA-2024-2495 / ALSA-2024-565), and Amazon Linux (ALAS2024-2495 / A...

CVE-2023-49960

CVE-2023-49960 affects Indo-Sol PROFINET-INspektor NT up to version 2.4.0. A path-traversal in the firmware’s httpuploadd service allows remote attackers to write arbitrary files via a crafted filename parameter in requests to the /upload endpoint. Connected sources confirm the details and indica...

CVE-2024-25767

CVE-2024-25767 affects nanomq 0.21.2. The vulnerability is a Use-After-Free in the file /nanomq/nng/src/core/socket.c. It is described in multiple sources (NVD/Red Hat/CVE lists) with a Medium base score (CVSS 3.1: 6.5) and a Network attack vector with low attack complexity, no privileges, and no...

CVE-2024-26461

CVE-2024-26461 affects Kerberos 5 (krb5) 1.21.2, with a memory leak in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Several advisories (e.g., AlmaLinux ALSA-2024:3268, Astra Linux bulletin, CBLMARINER entries) confirm the issue and indicate a patched version: krb5 1.21.3-1 (or newer). The connected docu...