CVE-2024-1433

KDE Plasma Workspace

Exploit for Unrestricted Upload of File with Dangerous Type in Cutephp Cutenews

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC...

Cross site request forgery (csrf)

flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery CSRF via the component /core/tools/updatemenu.php...

Stack overflow

A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result,...

CVE-2024-1151

CVE-2024-1151 is described in connected sources as a Linux kernel vulnerability affecting the Open vSwitch (OVS) sub‑component. The flaw occurs when a recursive operation calls into the same code block without validating stack depth, allowing a stack overflow that can crash the kernel or cause re...

Code injection

Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 2024 on risc-v billboard modules allows Flooding.This issue affects Hacker Hotel Badge 2024: from 0.1.0 through 0.1.3...

Sql injection

qanythingkernel/connector/database/mysql/mysqlclient.py in qanything.ai QAnything before 1.2.0 allows SQL Injection...

Design/Logic Flaw

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.getassertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry...

Memory corruption

In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resourcelimits.maxsamples. NOTE: the vendor's position is that the product is not designed to handle a maxsamples value that is too large for the amount of memory on the system...

Information disclosure

A vulnerability was found in Netgear R7000 1.0.11.13610.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file /debuginfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed ...

Open redirect

Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...

CVE-2024-1432

CVE-2024-1432 affects the DeepFaceLab pretrained DF.wf.288res.384.92.72.22. The vulnerability is in the function to apply_xseg inside main.py, where deserialization leads to a likely remote attack. The exploitation is described as possible, with high attack complexity, and public disclosures exis...

CVE-2024-1431

The CVE-2024-1431 entry concerns Netgear R7000 with Web Management Interface debuginfo.htm information disclosure (affected: version 1.0.11.136_10.2.120). Documents state that manipulation of an unknown functionality in /debuginfo.htm can disclose information, with the exploit disclosed publicly....

Information disclosure

A vulnerability has been found in Netgear R7000 1.0.11.13610.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /currentsetting.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has...

CVE-2024-1430

CVE-2024-1430 affects Netgear R7000 (firmware 1.0.11.136_10.2.120) and relates to an information-disclosure vulnerability in the Web Management Interface’s file /currentsetting.htm . The vulnerability description indicates that manipulating this unknown functionality can disclose information. Pub...

CVE-2024-25417

CVE-2024-25417 concerns flusity-CMS v2.33, where a CSRF flaw exists in the /core/tools/add_translation.php component. The vulnerability allows unauthorized actions requiring user interaction, with CVSS v3.1 base score 8.8 (High impact across confidentiality, integrity, and availability; network a...

CVE-2024-25718

The CVE-2024-25718 issue affects the Samly package for Elixir prior to 1.4.0. The vulnerability stems from Samly.State.Store.get_assertion/3 returning an expired session, and Samly.AuthHandler caching that session so it is not replaced after expiry, potentially bypassing access controls. Affected...

CVE-2024-25712

The CVE(S) concern http-swagger (Go package) affects http-swagger before 1.2.6, where an uploaded file via httpSwagger.WrapHandler and the in‑memory WebDAV filesystem (*webdav.memFile) can later be retrieved with a GET request, enabling XSS via PUT uploads. The issue is confirmed in multiple sour...

CVE-2023-52428

CVE-2023-52428 (Nimbus JOSE+JWT) : In Connect2id Nimbus JOSE+JWT prior to 9.37.2, an attacker can trigger a denial of service (resource exhaustion) by sending a large JWE p2c header value (iteration count) for the PasswordBasedDecrypter (PBKDF2) component. This is a component-level vulnerability ...

CVE-2024-25418

Summary: CVE-2024-25418 affects flusity-CMS v2.33, with a CSRF vulnerability in the /core/tools/delete_menu.php component. Root cause is CSRF in that endpoint, leading to potential unauthorized actions without user consent. The CVSS v3.1 metrics indicate a High severity (8.8) with network attack ...