CVE-2024-24479

CVE-2024-24479 describes a potential buffer overflow in Wireshark before 4.2.0, via wsutil/to_str.c and format_fractional_part_nsecs, which could lead to a remote DoS. The initial entry notes the vendor disputes that 4.2.0 or any release was affected, so the applicability of this CVE is contested...

CVE-2023-24330

Summary: D-Link DIR-882 devices with firmware DIR882A1_FW130B06 are reported vulnerable to a command-injection via a crafted POST to /HNAP1/, allowing remote attackers with no privileges to execute arbitrary commands. Impact: CVSS v3.1 base score 8.8 (HIGH); Confidentiality, Integrity, and Availa...

CVE-2023-24333

CVE-2023-24333 concerns a stack overflow in the Tenda AC21 router firmware US_AC21V1.0re_V16.03.08.15_cn_TDC01 that permits arbitrary command execution via a crafted POST to /goform/openSchedWifi. Affected component is the device firmware; root cause is a stack overflow in the handling of the ope...

CVE-2023-51828

CVE-2023-51828 concerns PMB (Paper Management/Bibliography) prior to version 7.4.7 where a SQL injection exists in the admin/convert/export.class.php file. The vulnerability allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in the get_next_notice fu...

CVE-2022-45177

LIVEBOX Collaboration vDesk (through v031) is affected. A vulnerability described as an Observable Response Discrepancy occurs on /api/v1/vdeskintegration/user/isenableuser, /api/v1/sharedsearch?search={NAME]+{SURNAME], and /login, where the web app reveals internal state information to unauthori...

CVE-2024-25249

CVE-2024-25249 affects He3 App for macOS (version 2.0.17). The issue allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings in the app, with CVSSv3.1 base score 9.8 (CRITICAL) and attack vector/network, requiring no privileges and no user in...

CVE-2024-25896

Summary: CVE-2024-25896 affects ChurchCRM 5.5.0, specifically the EventEditor.php page, where a time-based blind SQL injection can be triggered via the EID POST parameter. This is confirmed by multiple connected sources. The vulnerability is described as a time-based blind SQL injection affecting...

CVE-2024-24476

CVE-2024-24476 relates to a reported buffer overflow in Wireshark prior to version 4.2.0 that could allow a remote attacker to cause a denial of service via the pan/addr_resolv.c and ws_manuf_lookup_str() components. The Azure Linux 3.0 Nessus update notes that the Wireshark package on a host ins...

CVE-2023-50975

TD Bank TD Advanced Dashboard client for macOS (3.0.3 and earlier) is affected by arbitrary code execution due to ELECTRON_RUN_AS_NODE being usable in production, caused by missing electron::fuses::IsRunAsNodeEnabled. This enables a compromised process to access banking information. Connected adv...

CVE-2023-52155

PMB 7.4.7 and earlier are affected by a SQL Injection in /admin/sauvegarde/run.php via the sauvegardes parameter. The issue allows remote authenticated attackers to execute arbitrary SQL commands. The vulnerable component is the /admin/sauvegarde/run.php endpoint; root cause and exact vulnerabili...

CVE-2024-25891

ChurchCRM 5.5.0 is vulnerable in FRBidSheets.php to a time-based blind SQL injection via the CurrentFundraiser GET parameter. Affected component: FRBidSheets.php; vulnerability type: blind SQLi (time-based) with potential disclosure of database information. CVSS metrics indicate NETWORK access, h...

CVE-2023-52153

Summary: CVE-2023-52153 is a SQL injection vulnerability in PMB 7.4.7 and earlier, located in /pmb/opac_css/includes/sessions.inc.php, exploitable via the PmbOpac-LOGIN cookie value. Technical details from connected documents: Remote unauthenticated attackers could inject arbitrary SQL commands t...

CVE-2024-24478

Wireshark CVE-2024-24478 concerns a remote denial-of-service in Wireshark before 4.2.0 via the BGP dissector (packet-bgp.c, dissect_bgp_open). The issue is reported to affect the BGP Open handling, with an alleged vulnerability path through optlen, leading to resource exhaustion. Several connecte...

CVE-2023-38844

CVE-2023-38844 affects PMB (PMB Services/popular PMB library management system) up to v7.4.7. The vulnerability is an SQL injection in export_skos.php via the thesaurus parameter, enabling remote code execution. The CVSS metrics indicate high impact to confidentiality with no impact on integrity ...

CVE-2022-45179

LIVEBOX Collaboration vDesk (through v031) has a basic XSS vulnerability in the /api/v1/vdeskintegration/todo/createorupdate endpoint via the title parameter, and in /dashboard/reminders. A remote authenticated user can inject arbitrary HTML into the reminder title, potentially corrupting the pag...

CVE-2023-24331

Affected device: D-Link DIR-816 router, firmware DIR-816_A2_v1.10CNB04. Issue: Command Injection via the urlAdd parameter that enables attackers to execute arbitrary commands. Documents do not specify exploit details beyond this vector or a concrete remediation; no explicit exploit availability i...

CVE-2024-26310

Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could exploit this to access API information that should only be accessible with extra privileges. The available sources describe the affected version range and t...

CVE-2023-52154

CVE-2023-52154 affects PMB 7.4.7 and earlier, with a file upload vulnerability in pmb/camera_upload.php that allows an attacker to upload crafted PHTML files to achieve arbitrary code execution. The Red Hat and NVD entries corroborate the vulnerability description; no exploitation details or affe...

CVE-2023-49100

TF-A before 2.10 has CVE-2023-49100: a read-out-of-bounds in the SDEI service due to insufficient validation of the x1 parameter in sdei_interrupt_bind, passing to plat_ic_get_interrupt_type and bypassing plat_ic_is_sgi checks. A compromised Normal World (Linux) can issue arbitrary SMC calls, con...

CVE-2024-25892

ChurchCRM 5.5.0 is affected by a Blind SQL Injection (time-based) in ConfirmReport.php, exploitable via the familyId GET parameter. The CVE indicates a high-severity issue with impact on confidentiality, integrity, and availability, and a network attack vector with no user interaction required. R...