CVE-2024-24186

Jsish v3.5.0 is affected by a stack overflow in the IterGetKeysCallback path (file /jsish/src/jsiValue.c). The issue is documented across multiple sources with a CRITICAL impact (CVSS: 9.8) and a network attack vector, no user interaction required. Technical details consistently point to the Iter...

CVE-2024-25201

The CVE-2024-25201 entry concerns Espruino 2v20 (commit fcc9ba4) with an Out-of-bounds Read in the jsvStringIteratorPrintfCallback function located at src/jsvar.c. Public sources in the dataset (NVD, Red Hat, CVE lists, CNNVD, etc.) consistently describe a read past array bounds in this component...

CVE-2024-0971

CVE-2024-0971 is a SQL injection vulnerability in Tenable Nessus. The linked documents confirm that an authenticated, low-privileged remote attacker could potentially alter contents of the scan DB. Exploitation details are not provided beyond this CVE entry. A remediation path is indicated by Ten...

CVE-2024-1264

Juanpao JPShop up to version 1.5.02 is affected. The vulnerability resides in the function actionUpdate of /api/controllers/common/UploadsController.php, where manipulating the argument imgage enables unrestricted file uploads. Exploitation is remote and publicly disclosed. Affected versions: JPS...

CVE-2024-1283

The connected records corroborate CVE-2024-1283: a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 121.0.6167.160. The vulnerability allows remote attackers to trigger heap corruption via a crafted HTML page, potentially enabling code execution. Affected software includes Chr...

Design/Logic Flaw

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

Design/Logic Flaw

A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers/merchant/shop/PosterController.php of the component API. The manipulation of the argument picurl leads to unrestricted upload. It is...

CVE-2024-1263

The CVE-2024-1263 entry concerns Juanpao JPShop (up to v1.5.02). The vulnerability is in the API component, specifically the function actionUpdate in /api/controllers/merchant/shop/PosterController.php, where manipulation of the pic_url argument allows unrestricted file uploads. Impact is describ...

CVE-2024-1262

CVE-2024-1262 affects Juanpao JPShop up to version 1.5.02, targeting the API component: /api/controllers/merchant/design/MaterialController.php, in actionUpdate. The arg pic_url can be manipulated to achieve unrestricted uploads. Exploitability is remote and disclosures exist. Technical details e...

Code injection

An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications...

Code injection

A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device...

Heap overflow

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to gitindexadd can cause heap corruption that could be leveraged for arbitrary code execution. There...

Design/Logic Flaw

A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument picurl leads to unrestricted upload. It is possible to...

Design/Logic Flaw

An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets...

Cross site scripting

An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration...

Design/Logic Flaw

An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets...

Cross site scripting

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

Out-of-bounds

A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument picurl leads to unrestricted upload. The attack...

CVE-2024-1261

Juanpao JPShop up to version 1.5.02 contains a vulnerability in the API component, specifically the actionIndex function in /api/controllers/merchant/app/ComboController.php. The issue arises from manipulation of the pic_url parameter, enabling unrestricted file uploads. The vulnerability is expl...

CVE-2023-45735

CVE-2023-45735 affects Westermo Lynx devices (206-F2G) running Westermo WeOS. The vulnerability is classified as Code Injection (CWE-94) with improper input handling in web interface, allowing a remote attacker with network access and low attack complexity to execute malicious code and potentiall...