CVE-2024-28995

CVE-2024-28995 is a directory traversal vulnerability in SolarWinds Serv-U that allows unauthenticated attackers to read sensitive host files. The flaw affects Serv-U and can be triggered via crafted directory/file paths (e.g., using InternalDir/InternalFile payloads) to access local logs and sys...

CVE-2024-5221

The CVE-2024-5221 entry concerns the Qi Blocks WordPress plugin. Public records here show a Stored XSS vulnerability in the plugin’s file uploader affecting all versions up to and including 1.2.9, caused by insufficient input sanitization and output escaping. Exploitation requires authentication ...

CVE-2024-36394

SysAid CVE-2024-36394 is an OS command injection vulnerability caused by improper neutralization of special elements in OS commands. The public details indicate the flaw affects SysAid’s on-premise deployments and can lead to arbitrary command execution within the application’s context. A remedia...

CVE-2024-36393

CVE-2024-36393 concerns SysAid with a CWE-89 SQL injection flaw. Public records in NVD/NVD-derived sources describe an SQL-injection vulnerability arising from improper neutralization of special SQL elements in SysAid software. The connected EUVD/NVD/CVE/CVE records corroborate the vulnerability ...

CVE-2024-0972

CVE-2024-0972 affects BuddyPress Members Only for WordPress (all versions

CVE-2024-5141

CVE-2024-5141 – Rotating Tweets (Twitter widget and shortcode) for WordPress is vulnerable to Stored Cross‑Site Scripting in all versions up to 1.9.10 due to insufficient input sanitization and output escaping on user‑supplied attributes. This allows authenticated attackers with contributor‑level...

CVE-2024-2017

CVE-2024-2017 (Countdown, Coming Soon, Maintenance – Countdown & Clock) affects WordPress plugin Countdown Builder on all versions up to 2.7.8. Red Hat’s security entry confirms an unauthorized access flaw caused by a missing capability check in the conditionsRow and switchCountdown functions, al...

CVE-2024-0912

CVE-2024-0912 affects Johnson Controls Software House C•CURE 9000 running on IIS. In certain conditions, the IIS web host can log Windows credentials within the application logs, exposing sensitive information. Affected product/version: Software House C•CURE 9000 v3.00.2 (hosted on IIS). Technica...

CVE-2024-5171

CVE-2024-5171: Integer overflow in libaom’s internal function img_alloc_helper can cause a heap buffer overflow when large d_w/d_h/align values are used. The overflow can affect the returned aom_image_t fields via calls to aom_img_alloc(), aom_img_wrap(), or aom_img_alloc_with_border(), as descri...

CVE-2024-27374

CVE-2024-27374 concerns Samsung Mobile Processor Exynos models 980, 850, 1280, 1380, and 1330. The vulnerability is in the function slsi_nan_publish_get_nl_params() where there is no input validation for hal_req->service_specific_info_len sourced from userspace, allowing a potential heap overw...

CVE-2024-27372

CVE-2024-27372 affects Samsung Mobile Processor Exynos 980, 850, 1280, 1380, and 1330. The vulnerability resides in the function slsi_nan_config_get_nl_params() where there is no input validation for disc_attr->infrastructure_ssid_len from userspace, enabling a potential heap overwrite. The is...

CVE-2024-27381

CVE-2024-27381 affects Samsung Mobile Processor Exynos 980/850/1280/1380/1330. The issue is in the function slsi_send_action_frame_ut() where there is no input validation on len from userspace, enabling a heap over-read. Impact is labeled as Confidentiality HIGH and Availability HIGH, with Local ...

CVE-2024-36129

OpenTelemetry Collector is affected by CVE-2024-36129, an unsafe decompression vulnerability that allows unauthenticated remote DoS via excessive memory consumption. The issue affects the OpenTelemetry Collector and its modules, with fixes published in version 0.102.1 of the collector and 0.102.1...

CVE-2024-4009

This CVE (CVE-2024-4009) affects ABB KNX hardware and related components: ABB, Busch-Jaeger, FTS Display (v1.00), and BCU (v1.3.0.33). The vulnerability allows an attacker with Local access to capture and replay KNX telegrams on the local KNX Bus-System. Documented impact includes high confidenti...

CVE-2024-35674

CVE-2024-35674 – Missing Authorization in Unlimited Elements for Elementor (Free Widgets, Addons, Templates) affects Unlimited Elements For Elementor up to version 1.5.109. Public exploitation details are not provided in the supplied documents; no remediation details are specified here.

CVE-2024-20404

CVE-2024-20404 affects Cisco Finesse web-based management interface. The issue is an SSRF caused by insufficient validation of user-supplied input in HTTP requests sent to the device. An unauthenticated, remote attacker can exploit crafted HTTP requests to obtain limited sensitive information fro...

CVE-2024-24790

Summary: CVE-2024-24790 concerns the behavior of the Go networking IsPrivate/IsLoopback (and related) methods when given IPv4-mapped IPv6 addresses. The connected advisories/entries confirm a mismatch where these addresses could be treated as non-private, non-loopback in Go’s net/ip logic, potent...

CVE-2024-4812

The CVE-2024-4812 entries describe a stored cross-site scripting (XSS) vulnerability in the Katello plugin for Foreman, where malicious JavaScript can be saved in a user Description field and executed when loading pages such as Host Collections. Root cause: insufficient input sanitization of the ...

CVE-2024-5629

CVE-2024-5629 describes an out-of-bounds read in the PyMongo BSON deserializer. The advisory notes that PyMongo 4.6.2 and earlier can deserialize malformed BSON provided by a server, potentially raising an exception that may contain arbitrary memory. Affected component: PyMongo’s bson module. Imp...

CVE-2024-35673

CVE-2024-35673 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Pure Chat – Live Chat & More! WordPress plugin, affecting version range up to 2.22. The vulnerability is categorized as a CSRF issue with a Medium risk (CVSS v3.1 score 4.3 in NVD metrics). The connected documents i...