CVE-2024-24839

CVE-2024-24839 affects the WordPress plugin "Structured Content (JSON-LD)" (formerly known as Structured Content, wpsc). The issue is an authenticated Stored XSS (Contributor+ and above) via the plugin’s Classic Editor Shortcode, due to improper input sanitization/output escaping for JSON-LD cont...

CVE-2024-24841

CVE-2024-24841 affects the WordPress plugin Add Customer for WooCommerce (

Input validation

Brandon Rothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impac...

Type confusion

In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08358560; Issue ID: ALPS08358560...

Out-of-bounds

In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03961601; Issue ID: DTV03961601...

Out-of-bounds

In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477148; Issue ID: ALPS08477148...

Integer overflow

In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation Patch ID: ALPS07835901; Issue ID: ALPS07835901...

Information disclosure

In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441146; Issue ID: ALPS08441146...

Input validation

In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...

Out-of-bounds

In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03961715; Issue ID: DTV03961715...

Race condition

In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441369; Issue ID: ALPS08441369...

Out-of-bounds

In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08471742; Issue ID: ALPS08308608...

Input validation

In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10...

CVE-2024-24848

PT Sign Ups – Beautiful volunteer sign ups and management made easy (WordPress plugin by MJS Software PT)

CVE-2024-24866

CVE-2024-24866 affects the WordPress plugin Biteship (Ongkos Kirim Kurir Instant, Reguler, Kargo). The vulnerability is a Reflected Cross-Site Scripting (XSS) in input handling during web page generation, impacting versions through 2.2.24. PatchStack confirms the fix is in 2.2.25; Red Hat and CVE...

CVE-2024-20004

CVE-2024-20004 affects Modem NL1. The issue is improper input validation in NR RRC Connection Setup handling, potentially causing a remote denial of service with no privileges and no user interaction. Documented base metrics show CVSS v3.1: 7.5 (HIGH) with NETWORK attack vector, LOW attack comple...

CVE-2024-20001

The CVE-2024-20001 issue affects TVAPI and is caused by a missing bounds check leading to an out-of-bounds write, enabling local escalation of privilege with System privileges required; no user interaction is needed. Multiple connected sources (NVD, Red Hat, CVE lists) confirm the same descriptio...

CVE-2024-20016

Inged ged module, CVE-2024-20016 involves a possible out-of-bounds write caused by an integer overflow, leading to local denial of service with system execution privileges required and no user interaction. Patch ID ALPS07835901 is noted; issue ID ALPS07835901. Red Hat and other feeds corroborate ...

CVE-2024-20015

CVE-2024-20015 involves a permissions bypass in the telephony stack that can enable local privilege escalation with no user interaction. Documentation across sources (NVD, Red Hat, CVE lists) notes a local-privilege escalation impact and identifies a patch/Issue ID: ALPS08441419. The exact affect...