CVE-2024-20071

CVE-2024-20071 affects the WLAN driver with an out-of-bounds read caused by improper input validation. Impact per sources is local information disclosure requiring System execution privileges, with no user interaction. Exploitation details are not provided in the documents; remediation mentioned ...

CVE-2024-20070

CVE-2024-20070 affects the modem component. The root cause is the use of a risky cryptographic algorithm during the connection establishment negotiation, which may cause information disclosure to an attacker who can observe weak encryption. The issue does not require additional privileges and doe...

CVE-2024-20069

CVE-2024-20069 affects the modem component in VoWiFi IKE where a missing DH downgrade check can lead to selection of a less-secure algorithm. This information disclosure vulnerability does not require user interaction and can be exploited remotely. The issue is documented with a patch reference M...

CVE-2024-20068

CVE-2024-20068 affects the Modem component described in multiple sources as an input validation issue that can crash the system and cause remote denial of service without extra privileges or user interaction. Public documents consistently identify Modem as the affected area and note the vulnerabi...

CVE-2024-20067

CVE-2024-20067 affects the modem component (MediaTek/MOLY stack). The advisory describes an possible out-of-bounds write caused by improper input invalidation in the modem, which could enable a remote denial of service with no required privileges and without user interaction. The issue is documen...

CVE-2024-20066

The CVE-2024-20066 issue affects MediaTek Modem, caused by an incorrect bounds check leading to a possible out-of-bounds write. This enables remote denial of service with no privileges required and no user interaction needed. Remediation is available via patch MOLY01267281 (MSV-1477).

CVE-2024-20065

CVE-2024-20065 concerns a local information-disclosure flaw in the telephony stack caused by a missing permission check. The issue allows disclosure without extra execution privileges and requires no user interaction. Connected sources tie this to Mediatek telephony components (ALPS08698617; MSV-...

CVE-2024-5590

The CVE-2024-5590 entry concerns Netentsec NS-ASG Application Security Gateway 6.3, where the JSON Content Handler’s file /protocol/iscuser/uploadiscuser.php contains exploitable code. Specifically, manipulation of the messagecontent argument causes SQL injection that can be triggered remotely. T...

CVE-2024-5589

Netentsec NS-ASG Application Security Gateway 6.3 is affected by CVE-2024-5589. The vulnerability targets the file /admin/config_MT.php?action=delete, where manipulation of the Mid parameter yields an SQL injection. The issue is exploitable remotely and has been disclosed publicly. Multiple sourc...

CVE-2024-34987

CVE-2024-34987 is a SQL Injection vulnerability in PHPGurukul Online Fire Reporting System 1.2, affecting the ofrs/admin/index.php login flow. The issue allows bypassing authentication by injecting SQL into the username field, potentially exposing database data. Affected component: PHPGurukul Onl...

CVE-2023-51219

Summary (CVE-2023-51219) : KakaoTalk 10.4.3 contains a deep link validation issue allowing a remote attacker to direct users to execute attacker-controlled JavaScript within a WebView. A chained WebView trigger can leak an access token in an HTTP header, enabling potential takeover of another use...

CVE-2024-5588

The CVE-2024-5588 entry concerns itsourcecode Learning Management System 1.0. The vulnerability affects the file processscore.php, where manipulating the LessonID parameter enables SQL injection. It is exploitable remotely and the exploit has been disclosed publicly. Multiple sources corroborate ...

CVE-2024-36392

The CVE-2024-36392 entry concerns MileSight DeviceHub with a cross-site scripting (CWE-79) weakness caused by improper input neutralization during web page generation. According to the public records, the vulnerability is network-exposed, requires user interaction, and the exploit complexity is l...

CVE-2024-36391

Technical details about CVE-2024-36391 are not publicly available in the provided connected documents; no affected products, versions, impact, or fix details are disclosed here. Monitor for updates.

CVE-2024-36390

Technical details about CVE-2024-36390 (affected components, exploit scenarios, and specific versions) are not publicly available in the provided documents. Monitor for updates.

CVE-2024-36389

The documents identify CVE-2024-36389 as affecting MileSight DeviceHub with CWE-330: Use of Insufficiently Random Values may allow Authentication Bypass. The NVD entry lists a 9.8 CVSS v3.1 score (Network attack, no privileges, high impact on confidentiality, integrity, and availability) and note...

CVE-2024-36388

Technical details (affected product, component, version, root cause, impact, or fix) are not publicly available in the provided documents. Monitor for updates.

CVE-2024-27776

CVE-2024-27776 affects MileSight DeviceHub. The issue is a CWE-22 path traversal vulnerability that may allow unauthenticated remote code execution over the network (no user interaction) with a CVSS v3.1 base score of 9.8 (CRITICAL). Root cause is improper limitation of a pathname to a restricted...

CVE-2024-2178

CVE-2024-2178 affects parisneo/lollms-webui. The path traversal exists in the copy_to_custom_personas endpoint (lollms_personalities_infos.py), allowing crafted values in category and name (e.g., ../ sequences) to read files outside the intended directory. This results in unauthorized access to s...

CVE-2024-5587

CVE-2024-5587 affects Casdoor up to 1.335.0, specifically the Configuration File Handler’s /conf/app.conf. The issue arises from a manipulation of an unknown function in that file, allowing access to files or directories. The vulnerability can be exploited remotely and an exploit has been disclos...