CVE-2024-25165

SWFTools v0.9.2 is affected by a global-buffer-overflow in the LineText function (lib/swf5compiler.flex). Impacted component: SWFTools, version 0.9.2. Root cause: LineText reads or processes input without proper bounds checking. Reported across multiple feeds (NVD, CNVD, CNNVD, Red Hat, Ubuntu, O...

CVE-2024-25226

CVE-2024-25226 : The connected sources consistently describe a Cross-Site Scripting (XSS) vulnerability in Simple Admin Panel App v1.0, exploitable via a crafted payload injected into the Category Name parameter of the Add Category function. Impacted component: the Add Category workflow; vulnerab...

CVE-2024-25218

CVE-2024-25218 is a cross-site scripting (XSS) vulnerability in Task Manager App v1.0 where an attacker can inject arbitrary scripts via the Project Name parameter in /TaskManager/Projects.php. The issue originates from unsanitized input in the API endpoint, enabling script execution in a user’s ...

CVE-2023-50387

CVE-2023-50387 (KeyTrap) affects DNSSEC processing in DNS resolvers. Multiple advisories note excessive CPU/DoS risk when validating DNSKEY/RRSIG in zones with many records. Affected products include Bind (bind9) and Unbound across Linux distributions (e.g., AL2, AlmaLinux) with patches/released ...

CVE-2024-25222

CVE-2024-25222 affects Task Manager App v1.0, with a SQL injection vulnerability in the /TaskManager/EditProject.php endpoint, exploitable via the projectID parameter. The CVSSv3.1 vector/metrics indicate a CRITICAL impact (CVSS 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Connected sources confirm...

CVE-2024-25211

CVE-2024-25211 affects Simple Expense Tracker v1.0 and is a SQL injection vulnerability via the category parameter in /endpoint/delete_category.php. The issue is rated CVSSv3.1 9.8 (CRITICAL) with network attack vector, no user interaction, and total impact on confidentiality, integrity, and avai...

CVE-2024-25210

Simple Expense Tracker v1.0 is affected by a SQL injection in the expense parameter of /endpoint/delete_expense.php. CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no authentication, no user interaction. The root cause is injectable SQL via the expense parameter, affecting confid...

CVE-2024-25225

CVE-2024-25225 affects Simple Admin Panel App v1.0, with a cross-site scripting (XSS) flaw in the Add Category function, exploitable via crafted payloads in the Category Name field. Root cause: input that is not properly sanitized in the Add Category workflow. Impact is described as arbitrary web...

CVE-2024-25216

CVE-2024-25216 affects the Employee Management System v1.0. A SQL injection vulnerability exists via the mailud parameter in /aprocess.php. The CVSS v3.1 score is 9.8 (CRITICAL) with impacts to confidentiality, integrity, and availability. Exploit details are not provided in the connected documen...

CVE-2024-25224

CVE-2024-25224 affects Simple Admin Panel App v1.0, with a cross-site scripting (XSS) vulnerability in the Add Size function, exploitable via crafted payloads to the Size Number parameter. Root cause is improper handling of input in that parameter, enabling arbitrary web script/HTML execution. Th...

CVE-2024-1485

CVE-2024-1485 affects the registry-support library’s decompression logic. An unauthenticated attacker can trick a user into parsing a devfile that uses the parent or plugin keywords, causing the decompressor to extract archives with relative paths that write outside the intended scope. This can l...

Design/Logic Flaw

TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force techniques. Exploiting this...

Design/Logic Flaw

Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory...

CVE-2024-25118

CVE-2024-25118 describes an information-disclosure vulnerability in TYPO3 where password hashes were reflected in backend editing forms. Exploitation requires a valid backend user account. Affected versions include 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1; upgr...

CVE-2024-25119

TYPO3 information disclosure (CVE-2024-25119): The plaintext value of the encryption key used to cryptographically sign HTTP request parameters was exposed in the Install Tool frontend. This requires an administrator-level backend account to exploit and could enable forging request parameters due...

CVE-2023-6152

CVE-2023-6152 describes an Incorrect Authorization flaw where a user can change their email after signup/verification without re-verification due to verify_email_enabled validating only at sign-up. Connected docs indicate Grafana/OpenTelemetry-Go Contrib prior to v0.46.0 contains a related issue ...

Sql injection

Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter...

Information disclosure

Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests...

Design/Logic Flaw

Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 kernel mode privileged access to bypass protections potentially resulting in loss of integrity and availability...

Design/Logic Flaw

Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address space potentially leading to privilege escalation...