Information disclosure

In Dell Secure Connect Gateway Application and Secure Connect Gateway Appliance between v5.10.00.00 and v5.18.00.00, a security concern has been identified, where a malicious user with a valid User session may inject malicious content in filters of IP Range Rest API. This issue may potentially le...

CVE-2023-44293

CVE-2023-44293 affects Dell Secure Connect Gateway Application and Secure Connect Gateway Appliance (versions 5.10.00.00–5.18.00.00). The root cause is an SQL injection vulnerability in the IP Range Rest API filters, which could allow a malicious user with a valid session to inject content and ca...

CVE-2023-25535

The CVE-2023-25535 entry describes a local privilege escalation in Dell SupportAssist for Home PCs Installer Executable prior to version 3.13.2.19 used during initial installation, affecting first-time installs before 8 March 2023. Affected software/version: Dell SupportAssist for Home PCs Instal...

Input validation

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access...

Input validation

Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access...

Privilege escalation

Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access...

Information disclosure

Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access...

Authentication flaw

Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access...

CVE-2024-24690

The CVE-2024-24690 entry concerns Zoom clients with improper input validation that can allow an authenticated user to trigger a denial of service over the network. Connected documents corroborate affected Zoom products (e.g., Zoom Client for Meetings and Zoom VDI Client) and show vulnerable versi...

CVE-2024-25217

CVE-2024-25217 corresponds to a SQL injection vulnerability in Online Medicine Ordering System v1.0, exploitable through the id parameter in /omos/?p=products/view_product. Connected sources repeatedly confirm the issue is SQL injection with potential for high impact on confidentiality, integrity...

CVE-2024-25223

CVE-2024-25223 affects Simple Admin Panel App v1.0. A SQL injection in the orderID parameter of /adminView/viewEachOrder.php is documented, with CVSS v3.1 base score 9.8 (CRITICAL) affecting confidentiality, integrity, and availability. Connected sources consistently identify the same vector. A f...

CVE-2024-25219

CVE-2024-25219 affects Task Manager App v1.0. The vulnerability is a cross-site scripting (XSS) flaw in the Task Name parameter of the /TaskManager/Task.php endpoint, enabling attackers to inject and execute arbitrary web scripts/HTML. Affected component: Task Manager App, file /TaskManager/Task....

CVE-2024-25301

CVE-2024-25301 affects Redaxo v5.15.1, with a remote code execution (RCE) vulnerability exposed via the component "/pages/templates.php". Multiple connected sources corroborate the same issue and version. The exact root cause is not fully detailed in the provided documents, but the vulnerability ...

CVE-2024-25215

CVE-2024-25215 affects Employee Management System v1.0, vulnerable via the pwd parameter in /aprocess.php to a SQL injection. Root cause: improper input handling enabling unauthenticated network access with high impact on confidentiality, integrity, and availability. Connected docs mention remedi...

CVE-2024-25212

CVE-2024-25212 – SQL injection in Employee Management System v1.0 affects the delete.php endpoint, exploitable via the id parameter. The vulnerability is confirmed to enable SQL injection with an attack vector described as network access, requiring no user interaction, and with high impact on con...

CVE-2024-24301

CVE-2024-24301 is a command-injection vulnerability in 4ipnet EAP-767 v3.42.00 exposed through the device’s web interface. The issue allows attackers with valid credentials to inject arbitrary shell commands executed with root privileges, as indicated by the CVSSv3.1 vector (AV:N/AC:L/PR:L/UI:N/S...

CVE-2024-24300

4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials regardless of logins, and the cookie content does not change. This affects authentication/authorization behavior as described in multiple sources (Red Hat, NVD, CVE listing). The CVE not...

CVE-2024-25220

CVE-2024-25220 : Task Manager App v1.0 is affected by a SQL injection vulnerability exploitable via the taskID parameter on /TaskManager/EditTask.php. The CVSS v3.1 metrics in the public entry show a_CRITICAL_ base score of 9.8 with NETWORK attack vector, LOW attack complexity, and NONE privilege...

CVE-2024-25213

CVE-2024-25213 affects the Employee Management System v1.0, where a SQL injection vulnerability exists in the SQL query executed via the id parameter on the endpoint /edit.php . The root cause is a lack of proper input handling leading to possible data disclosure, modification, or corruption; the...

CVE-2024-25214

CVE-2024-25214 affects the Employee Managment System v1.0. The issue allows authentication bypass by injecting a crafted payload into the E-mail and Password parameters at the /alogin.html endpoint. Public reports consistently describe a critical impact (C/H/I/A) with network access and no user i...