CVE-2024-26349

CVE-2024-26349 affects Flusity-CMS v2.33, with a Cross-Site Request Forgery (CSRF) in the component /core/tools/delete_translation.php. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base score 4.3 (Medium), indicating network access without authentication but limited impact on confi...

CVE-2024-25385

CVE-2024-25385 affects flvmeta v1.2.2, where a local attacker can cause a denial of service via the function flv_close in flvmeta/src/flv.c:375:21. The issue is confirmed across multiple sources (NVD, Red Hat, Ubuntu, OSV, CVE registries). Practical impact is local, with availability disruption; ...

CVE-2024-26483

CVE-2024-26483 affects Kirby CMS v4.1.0: an unrestricted file upload in the Profile Image module allows arbitrary code execution via a crafted PDF. The issue is confirmed by multiple sources (Veracode/GitHub advisory) and is mitigated by upgrades to Kirby releases (e.g., 3.6.6.5, 3.7.5.4, 3.8.4.3...

CVE-2024-26482

The CVE-2024-26482 entry concerns Kirby CMS v4.1.0, specifically the Edit Content Layout module, with an HTML injection vulnerability. The NVD entry notes a vendor dispute over the impact, citing that some HTML formatting is allowed and backend sanitization would prevent malicious script injectio...

CVE-2024-23120

CVE-2024-23120 (and related entries) describe a vulnerability in Autodesk AutoCAD where parsing malicious STP/STEP files via ASMIMPORT228A.dll and ASMIMPORT229A.dll can cause an Out-of-Bounds Write. The weakness is triggered during file parsing of STP/STEP content, potentially leading to a crash,...

CVE-2024-0410

CVE-2024-0410 affects GitLab with an authorization bypass: a developer could bypass CODEOWNERS approvals by creating a merge conflict. Affected versions are 15.1 before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1. The vulnerability has a HIGH impact (CVSS 7.7) with a network attack vector,...

CVE-2024-1525

GitLab CE/EE contains CVE-2024-1525: an authentication bypass where, under certain conditions, an LDAP user can reset their password via their verified secondary email and sign in with reset credentials, bypassing LDAP. Affected versions are GitLab 16.1–16.7.6, 16.8 (except 16.8.3 and later), and...

CVE-2024-0861

CVE-2024-0861 affects GitLab EE. Affected: all versions starting from 16.4 before 16.7.6; 16.8 before 16.8.3; 16.9 before 16.9.1. Description: Users with the Guest role can change the Custom dashboard projects settings contrary to permissions. Impact: permission misuse that could lead to unauthor...

CVE-2024-0446

This CVE (CVE-2024-0446) affects Autodesk AutoCAD parsing of STP/CATPART/MODEL files via ASMKERN228A.dll and ASMdatax229A.dll, causing an Out-of-Bounds Write with potential crash, data corruption, or arbitrary code execution in the current process. The issue is triggered by parsing crafted files ...

Information disclosure

An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated...

CVE-2023-3509

CVE-2023-3509 affects GitLab across versions: before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1. The issue allows group members with sub-maintainer rights to rename privately accessible deploy keys associated with projects within the group. Mitigations are published by GitLab in fixed rel...

CVE-2024-26148

CVE-2024-26148 affects Querybook prior to v3.31.1, where the rich text editor accepts arbitrary URLs without validation, enabling the use of the javascript: protocol and potentially triggering client-side execution. The most severe impact could allow an admin to be compromised via a crafted XSS U...

Unrestricted file upload

File Upload vulnerability in pmb/cameraupload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files...

Command injection

Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816A2v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd parameter...

Stack overflow

A stack overflow vulnerability in Tenda AC23 with firmware version USAC23V1.0reV16.03.07.45cnTDC01 allows attackers to run arbitrary commands via schedStartTime parameter...

Sql injection

SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in exportskos.php...

Server side request forgery (ssrf)

discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with different AI services are vulnerable to admin-initiated SSRF attacks. Versions of the plugin that include commit...

Sql injection

SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/exportz3950.php endpoint...

CVE-2023-6640

CVE-2023-6640 involves Silicon Labs PC Controller (v5.54.0 and earlier). The vulnerability stems from malformed S2 Nonce Get Command Class packets that can crash the PC Controller, yielding a Denial of Service in affected versions. The NVD entry lists a CVSSv3.1 base score of 6.5 (Attack Vector: ...

Cross site scripting

A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jspsettings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiat...