CVE-2024-20923

CVE-2024-20923 is a vulnerability affecting Oracle Java SE (JavaFX) and Oracle GraalVM Enterprise Edition (JavaFX component). Public details in connected advisories indicate affected versions: Oracle Java SE 8u391 and Oracle GraalVM Enterprise Edition 20.3.12 and 21.3.8. The issue is exploitable ...

CVE-2024-20925

CVE-2024-20925 is a vulnerability affecting Oracle Java SE (JavaFX) and Oracle GraalVM Enterprise Edition (JavaFX). Affected versions include Oracle Java SE 8u391 and GraalVM EE 20.3.12 / 21.3.8. The issue is described as difficult to exploit, requiring network access via multiple protocols and u...

CVE-2024-20919

CVE-2024-20919 affects Oracle Java SE and GraalVM family (Hotspot component). Affected: Oracle Java SE 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; GraalVM for JDK 17.0.9, 21.0.1; GraalVM Enterprise 20.3.12, 21.3.8, 22.3.4. Vulnerability allows unauthenticated network access via multiple protocols...

CVE-2024-20909

CVE-2024-20909 affects Oracle Audit Vault and Database Firewall (Firewall component) for versions 20.1–20.9. The issue allows an unauthenticated attacker with network access via Oracle Net to compromise data, enabling unauthorized creation, deletion or modification of critical data. The base scor...

CVE-2024-20903

CVE-2024-20903 affects Oracle Database Server Java VM component. Affected versions are 19.3–19.21 and 21.3–21.12. The vulnerability allows a low-privileged attacker with Create Session and Create Procedure privileges and network access via Oracle Net to compromise the Java VM, potentially leading...

CVE-2023-21833

The CVE-2023-21833 entry affects Oracle ZFS Storage Appliance Kit (Object Store) version 8.8. The vulnerability allows a low-privilege, network-access attacker (HTTP) to read a subset of data. CVSS v3.1 base score 4.3 (Confidentiality impact: Low). Connected sources confirm the issue and indicate...

CVE-2024-22727

CVE-2024-22727 affects Teltonika TRB1-series gateways running firmware earlier than TRB1_R_00.07.05.2. Reports across sources consistently describe a firmware vulnerability exploitable over Ethernet LAN or USB. The Red Hat and NVD entries corroborate the affected device family and version boundar...

CVE-2024-25468

CVE-2024-25468 affects TOTOLINK X5000R (v9.1.0u.6369_B20230113). The issue is in the NTPSyncWithHost component, where the host_time parameter can be abused by a remote attacker to trigger a denial of service. The available documents describe a high-severity impact (CVSS v3.1 base score 7.5) with ...

Cross site scripting

StorageGRID formerly StorageGRID Webscale versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting XSS vulnerability. Successful exploit requires the attacker to know specific information about the target instance and trick a privileged user into clicking a...

CVE-2024-21984

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. Exploitation requires a targeted user to click a crafted link, after which an attacker could view or modify configuration settings or add/modify user accounts. Multipl...

CVE-2024-21983

CVE-2024-21983 affects NetApp’s StorageGRID (formerly StorageGRID Webscale). Public sources confirm versions prior to 11.8 are susceptible to a DoS where an authenticated attacker could trigger an out-of-memory condition or node reboot. The vulnerability is described consistently across multiple ...

Null pointer dereference

ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/libtermcap.c...

CVE-2024-25627

CVE-2024-25627 affects Alf.io. The vulnerability is an XSS via HTML file upload that requires administrative access to trigger a JavaScript payload, enabling persistence if an attacker gains admin rights. Affected software is Alf.io prior to version 2.0-M4-2402; the issue has been addressed in ve...

CVE-2024-21987

CVE-2024-21987 affects NetApp SnapCenter: versions 4.8 prior to 5.0 are vulnerable due to insufficient authorization, allowing an authenticated SnapCenter Server user to modify the system logging configuration. Documented impact is limited to changing logging settings; no exploit details are prov...

CVE-2024-25628

CVE-2024-25628 affects Alf.io, an open source event attendance management system. The vulnerability is described as insufficient session expiration: in versions prior to 2.0-M4-2402, users can access the admin area even after being invalidated or deleted. The issue has been addressed in version 2...

Out-of-bounds

In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Design/Logic Flaw

In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is need...

Out-of-bounds

In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Heap overflow

In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-0023

CVE-2024-0023: In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not needed for exploitation. Connected...