CVE-2024-25452

CVE-2024-25452 affects Bento4 v1.6.0-640, with an out-of-memory bug in AP4_UrlAtom::AP4_UrlAtom(). Public document set confirms the vulnerable component and impact (OOM; Availability), but exploitation details are not provided. Red Hat notes the issue; PT-2024-20954 suggests disabling AP4 UrlAtom...

CVE-2024-25451

CVE-2024-25451 concerns Bento4 v1.6.0-640, which contains an out-of-memory bug in the AP4_DataBuffer::ReallocateBuffer() function. Multiple sources confirm the issue and tie it to Bento4’s MP4 reading/writing library, with the vulnerability enabling an OOM condition that can impact system availab...

CVE-2024-25678

Summary: CVE-2024-25678 affects the LiteSpeed QUIC (LSQUIC) Library prior to 4.0.4, due to mishandled DCID validation. The issue is tied to the authentication/DCID handling behavior in LSQUIC. Affected software: LiteSpeed QUIC (LSQUIC) Library versions before 4.0.4. Root cause (as stated): Mishan...

CVE-2024-24820

CVE-2024-24820 concerns Icinga Director, a tool for managing Icinga 2 configurations. The issue is a CSRF vulnerability in Director’s forms that could let an attacker perform changes to the monitoring environment without the victim’s awareness. Affected guidance in the sources specifies upgrading...

CVE-2024-25450

CVE-2024-25450 concerns imlib2 v1.9.1, where memory allocation is mishandled in the function init_imlib_fonts() . The vulnerability is documented with a high severity (CVSS v3.1 base score 8.8) and an attacker could exploit it via network conditions without user installation privileges, with user...

CVE-2024-25448

CVE-2024-25448 affects imlib2 1.9.1; the vulnerability is in imlib_free_image_and_decache and allows a heap buffer overflow via parsing a crafted image. The provided documents describe the affected component and the impact (memory corruption) but do not include remediation details or patched vers...

CVE-2024-25302

CVE-2024-25302 affects Sourcecodester Event Student Attendance System 1.0. The vulnerability is a SQL Injection in the parameter named student , as reported across sources (NVD/Red Hat/CNNVD/etc.). The root cause is improper handling of input leading to database query manipulation; no explicit ex...

CVE-2024-25318

Code-projects Hotel Managment System 1.0 is affected by CVE-2024-25318, where the pid parameter in Hotel/admin/print.php?pid=2 enables SQL injection. Root cause is unsafe handling/validation of the pid value, permitting attacker-crafted queries that could disclose or manipulate data. CVSS 3.1 bas...

CVE-2024-25445

CVE-2024-25445 affects Hugin 2022.0.0 where HuginBase::PTools::Transform::transform mishandles input values, triggering an assertion failure (crash). This is listed with high impact (Confidentiality/Integrity/Availability High) and local exploitability with user interaction required. OpenSUSE/Fed...

CVE-2024-25304

The CVE-2024-25304 affects Code-projects Simple School Management System 1.0, where an SQL Injection flaw exists in the School/index.php entry point via the 'apass' parameter. The root cause is lack of input validation for this parameter, enabling attackers to manipulate queries and potentially a...

CVE-2024-25307

CVE-2024-25307 affects Code-projects Cinema Seat Reservation System 1.0: SQL Injection via the id parameter in /Cinema-Reservation/booking.php?id=1. Root cause is unsafe SQL construction that allows attacker-controlled input to influence queries, with reported CVSS v3.1 base metrics of 9.8 (CRITI...

CVE-2024-25305

CVE-2024-25305 affects Code-projects Simple School Managment System 1.0. The issue is an authentication bypass via the username and password parameters on the School/index.php endpoint, enabling bypass of login to gain administrative access. The connected documents corroborate the vulnerability a...

CVE-2024-25454

Bento4 v1.6.0-640 contains a NULL pointer dereference in AP4_DescriptorFinder::Test(). The CVE entry documents this as the root cause, with a high availability impact (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The official sources in the provided documents consistently reference Bento4 1.6.0-640 and ...

CVE-2024-24821

CVE-2024-24821 affects Composer (PHP dependency manager). In affected versions, local directory files can be included during invocation, enabling arbitrary code execution from the executing user context and potentially leading to local privilege escalation, lateral movement, or malicious code exe...

Security feature bypass

Rejected reason: Red Hat Product Security does not consider this to be a vulnerability. Upstream has not acknowledged this issue as a security flaw...

Cross site scripting

An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site Scripting XSS in the administration component via Access Request...

CVE-2024-25107

WikiDiscover, an extension for CreateWiki, contains an XSS vulnerability in Special:WikiDiscover where Language::date uses unescaped interface messages from MONTH/DAY translations, yielding unescaped output. Exploitation requires the (editinterface) right. The issue is addressed in commit 267e763...

Unrestricted file upload

File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request...

Cross site scripting

Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, readbook, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components...

Sql injection

SQL Injection vulnerability in Employee Management System v.1.0 allows a remote attacker to execute arbitrary SQL commands via the txtusername and txtpassword parameters in the login.php components...