231579 matches found
CVE-2024-37019
CVE-2024-37019 affects Northern.tech Mender Enterprise with weak authentication. Documented impact includes total impact on confidentiality, integrity, and availability (CVSS v3.1: 9.8). Affected versions are Mender Enterprise prior to 3.6.4 and 3.7.x prior to 3.7.4. Remediation exists: upgrade t...
CVE-2024-4332
Summary of CVE-2024-4332 (Tripwire Enterprise 9.1.0) : Affects the REST and SOAP API components when TE is configured to use LDAP/Active Directory SAML authentication and the optional “Auto-synchronize LDAP Users, Roles, and Groups” feature is enabled. The vulnerability enables unauthenticated at...
CVE-2024-31330
CVE-2024-31330 is listed in the 2024-11-01 Wear OS security bulletin under the System component with a local escalation-of-privilege (EoP) vulnerability (High severity). Affected software is Wear OS (System), with the issue mapped to AOSP version 13. The bulletin indicates exploitation could occu...
CVE-2024-31329
CVE-2024-31329 is documented in the Wear OS June 2024 security bulletin as a System-component elevation of privilege (EoP) with High severity. The bulletin notes it could lead to local EoP with no additional execution privileges. Affected devices should apply the 2024-06-01 patch level (or later)...
CVE-2024-36674
CVE-2024-36674 affects LyLme_spage v1.9.5, with a Cross Site Scripting (XSS) vulnerability exploitable via the admin/link.php endpoint. The NVD entry lists CVSS v3.1 base score 6.1 (Medium), with a network attack vector, low complexity, no privileges required, user interaction needed, and a chang...
CVE-2024-4540
CVE-2024-4540 affects Keycloak deployments using OAuth 2.0 Pushed Authorization Requests (PAR). The vulnerability is that client-provided parameters can be exposed in plain text in the KC_RESTART cookie returned in the HTTP response to a request_uri-based authorization request, enabling informati...
CVE-2024-32983
Misskey (open source decentralized microblogging platform) is affected by a vulnerability in the handling of incoming signed ActivityPub activity objects: improper normalization of JSON structures allowed spoofing of signed content and impersonation of original authors. Root cause: lack of proper...
CVE-2024-36128
Directus (Real-time API/dashboard for SQL databases) is affected by CVE-2024-36128 prior to version 10.11.2. Providing a non-numeric length to the random string generation utility triggers a memory issue that disrupts random session IDs, causing a denial of service where logged-in sessions can no...
CVE-2024-36127
The CVE pertains to the apko tool (apk-based OCI image builder) where HTTP basic auth credentials from repository and keyring URLs were exposed in log output. The issue is fixed in v0.14.5. Impact is High (log exposure of credentials) with CVSS 3.1 base score 7.5. Connected sources corroborate th...
CVE-2024-36124
Summary: CVE-2024-36124 affects the iq80 Snappy compression/decompression library. During uncompression, data may read outside the bounds of input byte arrays because Snappy uses sun.misc.Unsafe for memory access, skipping bounds checks and enabling out-of-bounds behavior that can cause non-deter...
CVE-2024-36123
Citizen is a MediaWiki skin. The page MediaWiki:Tagline can render unescaped content, enabling stored cross-site scripting via editing the MediaWiki namespace (e.g., users with editinterface or sysop privileges). Root cause: unescaped output in MediaWiki:Tagline. Impact: potential HTML/JavaScript...
CVE-2024-0336
CVE-2024-0336 affects EMTA Grup PDKS (V3.04 and earlier, before 20240603). The root cause is Missing Authentication for Critical Function due to Incorrectly Configured Access Control, described as an improper access-control misconfiguration that enables unauthorized access to sensitive functions....
CVE-2024-36728
CVE-2024-36728 affects TRENDnet TEW-827DRU devices up to firmware 2.06B04. The issue is a stack-based buffer overflow in the embedded ssi binary that an authenticated user can trigger by sending a POST to apply.cgi with the action vlan_setting and a sufficiently long dns1 or dns2 key, potentially...
CVE-2024-36729
TRENDnet TEW-827DRU routers (≤2.06B04) contain a stack-based overflow in the ssi binary. An authenticated user can trigger arbitrary code execution by POSTing to apply.cgi via the wizard_ipv6 action with a sufficiently long reboot_type key. The vulnerability affects the ssi binary and is exploita...
CVE-2024-5197
Summary: Multiple connected advisories confirm CVE-2024-5197 affects libvpx with integer overflows in vpx_img_alloc() and vpx_img_wrap(), leading to overflowed buffer calculations and potentially invalid fields in vpx_image_t for versions prior to 1.14.1. The issue is described across Amazon Linu...
CVE-2024-36569
CVE-2024-36569 affects Sourcecodester Gas Agency Management System v1.0. The vulnerability is described as arbitrary code execution via the editClientImage.php file. Documents indicate a high-severity issue (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Root cause/details are not explicitly pro...
CVE-2024-36568
Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. The root cause is unsanitized input in the id parameter, enabling attackers to manipulate queries. This vulnerability is rated critical (CVSS 3.1: 9.8) with potential impact on confiden...
CVE-2024-35632
CVE-2024-35632 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin suite “Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms” (affected versions up to 1.1.5). The vulnerability can be exploited via forged requests, with a CVSS v3.1 base score of...