CVE-2024-24402

CVE-2024-24402 affects Nagios XI 2024R1.01, enabling privilege escalation via a crafted script targeting /usr/local/nagios/bin/npcd. Multiple sources (Red Hat, CIRCL, NVD/NASL/Nessus and CVE repositories) confirm the issue and its association with Nagios XI. In published timelines, Nagios has rel...

CVE-2024-27456

CVE-2024-27456 concerns rack-cors 2.0.1 with insecure file permissions: .rb files shipped as 0666, potentially impacting integrity, confidentiality, and availability. Root cause: default permissive file permissions. Public exposure documented by Red Hat and other sources; exploitation details are...

CVE-2024-27447

pretix prior to 2024.1.1 has an improper file validation vulnerability in its upload handling. This misvalidation can affect confidentiality, integrity, and availability, with a CVSS v3.1 base score of 9.8 (CRITICAL) and network attack vector, no user interaction. Public details from connected so...

CVE-2024-25751

The CVE-2024-25751 entry affects the Tenda AC9 router (v3.0) with firmware v15.03.06.42_multi. It is a Stack-Based Buffer Overflow in the fromSetSysTime function that enables a remote attacker to execute arbitrary code. The threat is described as remote code execution with a high impact; the CVSS...

CVE-2023-49959

Summary of CVE-2023-49959 : A command injection in the firmware’s gedtupdater service affects Indo-Sol PROFINET-INspektor NT up to version 2.4.0. An attacker can send a crafted filename in a POST to the path /api/updater/ctrl/start_update to execute arbitrary commands with root privileges. Exploi...

CVE-2024-26468

CVE-2024-26468 describes a DOM-based XSS in the jstrieb/urlpages project, affecting the code path in the index.html component prior to commit 035b647. An attacker can trigger arbitrary Javascript by sending a crafted URL. The available sources consistently cite the same issue without extending in...

CVE-2024-26458

CVE-2024-26458 is documented in IBM Security Bulletins as affecting IBM Application Gateway (versions 23.10–25.09) with Kerberos 5 (krb5) 1.21.2 memory leak in /krb5/src/lib/rpc/pmap_rmt.c. IBM lists remediation: update to fixed IBM Application Gateway release and container image. Upgrading via d...

CVE-2024-26465

CVE-2024-26465 concerns a DOM-based cross-site scripting (XSS) in the component/beep/Beep.Instrument.js of the Stewdio Beep.js project, prior to commit ef22ad7. The issue allows an attacker to execute arbitrary JavaScript by sending a crafted URL. The vulnerability is described across multiple so...

CVE-2024-24401

CVE-2024-24401 affects Nagios XI version 2024R1.01 and is described in connected exploits as an authenticated SQL Injection targeting the monitoringwizard.php endpoint (Nagios XI

CVE-2024-25344

CVE-2024-25344 relates to ITFlow.org prior to commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378, described as a Cross Site Scripting/CSRF issue affecting multiple settings components (settings.php, settings+company.php, settings_defaults.php, settings_integrations.php, settings_invoice.php, setti...

CVE-2024-26466

The CVE-2024-26466 entry describes a DOM-based XSS in web-platform-tests/wpt within the Range-test-iframe.html component, exposed before commit 938e843. The vulnerability allows an attacker to execute arbitrary Javascript by sending a crafted URL, with the impact aligned to a DOM-XSS type and use...

CVE-2024-25248

Niushop B2B2C V5 is affected by a SQL Injection in the orderGoodsDelivery() function, exploitable via the order_id parameter. The CVE-2024-25248 entry shows a critical impact (C/H/I/A = High) with network access and no privileges required, per CVSS 3.1 metrics. Connected documents corroborate the...

CVE-2024-25247

Niushop B2B2C V5 is affected by a SQL injection in the /app/api/controller/Store.php endpoint. The vulnerability stems from unsanitized latitude/longitude inputs, enabling attackers to execute arbitrary SQL commands. Impact is high on confidentiality, integrity, and availability as per CVSS metri...

CVE-2024-26462

CVE-2024-26462 affects krb5 1.21.2 and is a memory-leak vulnerability in /krb5/src/kdc/ndr.c. The issue can cause memory exhaustion and potential denial of service; exploitation status is not provided in the documents, but related advisories/patches indicate upgrading to 1.21.3 or newer to mitiga...

CVE-2024-27455

The CVE-2024-27455 issue affects Bentley Assetwise ALIM Web and Assetwise Information Integrity Server. A configuration-related flaw can cause exposure of a user’s ALIM session token when downloading files. Affected versions are Assetwise ALIM Web prior to 23.00.04.04 and Assetwise Information In...

CVE-2024-25081

FontForge (fontforge) is affected by CVE-2024-25081: command injection via crafted filenames in Splinefont up to version 20230101. Connected advisories confirm the issue also for crafted archives/compressed files (CVE-2024-25082) and indicate patches released in multiple distributions (e.g., Debi...

CVE-2024-26467

CVE-2024-26467 affects the tabatkins/railroad-diagrams project, specifically the generator.html component. A DOM-based cross-site scripting (XSS) flaw is present in versions before commit ea9a123, allowing an attacker to execute arbitrary JavaScript by sending a crafted URL. The issue is triggere...

CVE-2024-25770

CVE-2024-25770 affects libming 0.4.8 with a memory leak in /libming/src/actioncompiler/listaction.c. The issue can be exploited to cause a denial of service. Multiple connected sources corroborate the vulnerable component and file, and there is no publicly documented vendor patch or remediation i...

CVE-2024-1875

CVE-2024-1875 affects SourceCodester Complaint Management System 1.0, specifically the Lodge Complaint Section file users/register-complaint.php, where unrestricted file upload is possible. The issue is exploitable remotely and exploitation/public disclosure status is noted. Connected sources con...

CVE-2024-0440

CVE-2024-0440 describes an SSRF-type flaw where an attacker with permission to submit a link or submit via POST a link using the file:// protocol can introspect host files and other relatively stored files. Affected exposure is described across multiple feeds; CVSS data vary by source (NVD: 3.1, ...