CVE-2024-22021

Vulnerability CVE-2024-22021 affects Veeam Recovery Orchestrator products in limited older branches: Recovery Orchestrator 6, Disaster Recovery Orchestrator 5, and Availability Orchestrator 4. A low-privileged Plan Author can retrieve plans from a Scope other than their assigned one. Root cause d...

CVE-2024-1266

CodeAstro University Management System v1.0 has a cross-site scripting vulnerability in the Student Registration Form’s /st_reg.php, caused by unsafely handling the Address parameter. The issue can be exploited remotely and has been publicly disclosed (VDB-253009). Impact is described as limited ...

Cross site scripting

A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0. Affected is an unknown function of the file /attadd.php of the component Attendance Management. The manipulation of the argument Student Name leads to cross site scripting. It is possible to...

Sql injection

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection...

Design/Logic Flaw

Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Sql injection

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection...

Sql injection

jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism...

CVE-2024-1265

CVE-2024-1265 affects CodeAstro University Management System 1.0, specifically the Attendance Management component. The vulnerability resides in the /att_add.php file where manipulating the “Student Name” argument triggers cross-site scripting. It can be exploited remotely and exploitation has be...

CVE-2024-24188

CVE-2024-24188 affects Jsish v3.5.0, with a heap-buffer-overflow in ./src/jsiUtils.c . Documented impact: high for confidentiality, integrity, and availability; CVSS v3.1 base score 9.8. Exploitation details are not provided in the supplied documents, and there is no remediation/version fix infor...

CVE-2024-24189

CVE-2024-24189 – Jsish 3.5.0 suffers a use-after-free in SplitChar (src/jsiUtils.c). Root cause: faulty handling in SplitChar leading to use-after-free. Impact is severe per CVSS: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8, CRITICAL). Connected sources confirm the issue but do not provide a pu...

CVE-2024-23769

CVE-2024-23769 affects Samsung Magician PC Software for Windows (version 8.0.0). The issue is improper privilege control for a named pipe, enabling a local attacker to read privileged data. Relevant details: impact is confidentiality (high) with local access and low attack complexity, user intera...

CVE-2023-46914

The CVE-2023-46914 issue affects the PrestaShop RM bookingcalendar module (PrestaShop v2.7.9 and earlier). A SQL Injection in the ics_export.php endpoint is the root cause, enabling remote attackers to potentially execute arbitrary code, escalate privileges, and access sensitive information. Mult...

CVE-2024-24133

Affected software: Atmail v6.6.0. Vulnerability: SQL injection via the username parameter on the login page. Root cause: improper handling of the username input leading to SQL injection (high/critical impact). CVSSv3.1 metrics indicate: Network attack vector, no privileges required, user interact...

CVE-2024-25200

CVE-2024-25200 affects Espruino 2v20 (commit fcc9ba4). The vulnerability is a Stack Overflow via the jspeFactorFunctionCall in src/jsparse.c. Documented impact is high (availability), with network attack vector and no privileges required. No remediation details are provided in the supplied source...

CVE-2024-24019

Affected software: Novel-Plus prior to 4.3.0-RC1. Vulnerable endpoint: /system/roleDataPerm/list. Root cause: SQL injection via crafted offset, limit, and sort parameters. Impact: high across confidentiality, integrity, and availability (CVSS 3.1: 9.8). Exploitation status: not detailed in the pr...

CVE-2024-24488

CVE-2024-24488 affects Shenzen Tenda Technology CP3V2.0 firmware version V11.10.00.2311090948. Reported vulnerability is an information-disclosure issue where a local attacker can obtain sensitive information via the device’s password component. Public documents identify the affected product and ...

CVE-2023-38995

CVE-2023-38995 affects SCHUHFRIED v8.22.00. A vulnerability allows a remote attacker to obtain the database password via a crafted curl request, arising from hardcoded credentials in the vulnerable build. Practical impact is exposure of DB credentials, enabling further access. Connected sources i...

CVE-2024-24311

Path Traversal in PrestaShop module lgsitemaps (Multilingual and Multistore Sitemap Pro - SEO) prior to version 1.6.6 allows a guest to download personal information. Affected: PrestaShop with the lgsitemaps module. Root cause: path traversal vulnerability in the module. Impact: unauthorized disc...

CVE-2024-24304

The CVE-2024-24304 affects the Mailjet module for PrestaShop prior to version 3.5.1. A guest can download technical information without restriction due to the underlying design in this module, enabling exposure of internal details. The issue is documented across multiple sources (NVD/Red Hat/CVE ...

CVE-2023-40355

Axigen WebMail contains an XSS vulnerability (CVE-2023-40355) in multiple released lines. Affected are Axigen WebMail server builds: 10.3.3.0–10.3.3.59, 10.4.0–10.4.19, and 10.5.0–10.5.5, where authenticated attackers can exploit the version-switching logic between the Standard and Ajax views to ...