CVE-2023-43537

CVE-2023-43537 is an information-disclosure issue in Qualcomm/WLAN host handling of T2LM Action Frame. Connected sources confirm affected area is WLAN stack (Qualcomm components) and reference public advisories (Red Hat CVE page, CVE listings, and Qualcomm bulletin). The descriptions identify inf...

CVE-2024-35633

CVE-2024-35633 is a Server-Side Request Forgery (SSRF) vulnerability in CreativeThemes Blocksy Companion for WordPress, affecting Blocksy Companion versions up to 2.0.42. The affected condition requires Administrator-level access; the issue is exploitable via network-based vectors and impacts con...

CVE-2024-35635

CVE-2024-35635 is a Server-Side Request Forgery (SSRF) vulnerability in Ninja Tables by WPManageNinja LLC, affecting Ninja Tables versions up to and including 5.0.9. The issue has been fixed in version 5.0.10. Public sources (Patchstack) identify the affected plugin as vulnerable to SSRF with a l...

CVE-2024-23665

CVE-2024-23665 : FortiWeb contains multiple improper authorization vulnerabilities (CWE-285) that allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests. Affected FortiWeb versions are 7.4.2 and below, 7.2.7 and below, 7.0.10 and below, 6.4.3 and below, and 6...

CVE-2024-23664

Fortinet FortiAuthenticator contains an open redirect (untrusted URL redirection) affecting FortiAuthenticator v6.6.0 and older (v6.5.3 and below; v6.4.9 and below). An attacker can lure users to an arbitrary site via a crafted URL. Public references confirm an open redirect issue in FortiAuthent...

CVE-2024-23667

Fortinet FortiWebManager is affected by CVE-2024-23667 due to improper authorization that allows an attacker to execute unauthorized code or commands via HTTP requests or CLI. Affected FortiWebManager versions include 6.0.2; 6.2.3–6.2.4; 6.3.0; 7.0.0–7.0.4; and 7.2.0. CVSS metrics indicate high i...

CVE-2024-23668

Fortinet FortiWebManager is affected by CVE-2024-23668 due to improper authorization in the HTTP Request Handler. Affected versions: 6.0.2; 6.2.3–6.2.4; 6.3.0; 7.0.0–7.0.4; 7.2.0. Exploitation via HTTP requests or CLI could allow executing unauthorized code or commands. Remediation: upgrade to th...

CVE-2024-23670

CVE-2024-23670 describes an improper authorization in Fortinet FortiWebManager affecting multiple versions (6.0.2; 6.2.3–6.2.4; 6.3.0; 7.0.0–7.0.4; 7.2.0). The underlying issue is an authorization weakness that allows an attacker to execute unauthorized code or commands via HTTP requests or the C...

CVE-2024-5404

The CVE-2024-5404 vulnerability affects the moneo appliance, where an unauthenticated remote attacker can change the admin password due to a weak password recovery mechanism. The issue is documented with a HIGH/CRITICAL impact (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and indicates total i...

CVE-2024-35637

CVE-2024-35637 affects the WordPress Church Admin plugin (versions n/a–4.3.6). It is a Server-Side Request Forgery (SSRF) vulnerability requiring Administrator access. The vulnerability is mitigated in version 4.4.0; CVSS 3.1 base score reported as 4.4 (Low). No exploitation or in‑the‑wild detail...

CVE-2024-35638

CVE-2024-35638 corresponds to the WordPress ActiveDEMAND plugin (versions <= 0.2.43). According to Patchstack, it is a CSRF vulnerability that can be triggered without authentication; impact is described as low severity (CVSS 4.3). The issue is fixed in version 0.2.44. This CVE entry is active...

CVE-2024-35639

CVE-2024-35639 affects the WordPress plugin Simple Spoiler (Webliberty) up to version 1.2. The vulnerability is a stored XSS via admin/settings context, enabling injected scripts in pages viewed by users. Severity is cited as low (CVSS 3.1/3.1: 5.9), and exploitation is described as unlikely. The...

CVE-2023-48789

Fortinet FortiPortal suffers a vulnerability (CVE-2023-48789) due to client-side enforcement of server-side security that can allow improper access control via specially crafted HTTP requests. Affected software: FortiPortal versions 6.0.0 through 6.0.14. Root cause: insecure client-side security ...

CVE-2024-31493

FortiSOAR is affected by CVE-2024-31493 due to an improper removal of sensitive information before storage or transfer. An authenticated low-privilege user can read connector passwords in plain text via HTTP responses. Affected versions: FortiSOAR 7.3.0, 7.2.2 and below, and 7.0.3 and below. Root...

CVE-2024-23107

FortiWeb is affected (versions 7.4.0, 7.2.4 and below, 7.0.8 and below, and 6.3 all versions) by CVE-2024-23107, a vulnerability that allows an authenticated attacker to read password hashes of other administrators via CLI commands due to exposure of sensitive information (CWE-200). The issue is ...

CVE-2024-36963

CVE-2024-36963 affects the Linux kernel tracefs feature. The issue arises from how permissions are generated for tracefs files: they default to the root inode’s permissions unless the user changes them, and a remount with permissions should update all files, but currently leaves unchanged files t...

CVE-2024-36964

CVE-2024-36964 affects the Linux kernel fs/9p implementation. It allows garbage in the 9P2000 perm bits to pass through, enabling the setting of the suid bit due to improper translation of RWX permissions; the unix extended bits are handled only on .u. The issue is local and relates to a permissi...

CVE-2024-36962

CVE-2024-36962 affects the Linux kernel KS8851 driver (net: ks8851). The vulnerability arises when RX packets are queued inside an IRQ handler that is protected by a mutex, which could lead to hanging due to a potential lock conflict with net_rx_action(). The fix replaces BH manipulation (local_b...

CVE-2024-36961

CVE-2024-36961 affects the Linux kernel. The issue is in the thermal debugfs code: when a user opens the mitigations file for a thermal zone before tz_debugfs is initialized, tze_seq_start() can dereference NULL. A second race can allow thermal_debug_tz_remove() to run while another thread access...

CVE-2024-36960

The CVE-2024-36960 entry maps to a Linux kernel issue in drm/vmwgfx where the length field for drm_event was incorrectly set to the parent structure, causing out-of-bounds reads when drm_read copies events to userspace. The provided documents confirm the root cause and fix: set drm_event length t...