CVE-2024-7965

CVE-2024-7965 affects Google Chrome’s V8 engine (Chromium) with an inappropriate implementation vulnerability that allows remote heap corruption via a crafted HTML page. Impact is High (CVE entry notes potential exploitation, with network attack vector and user interaction required). Affected sof...

CVE-2024-28000

CVE-2024-28000 affects WordPress LiteSpeed Cache (LiteSpeed Cache plugin) versions from 1.9 through 6.3.0.1. The issue is an Incorrect Privilege Assignment that allows unauthenticated escalation to administrator, enabling full site control. Mitigation: update to plugin version 6.4.0+ (or a patche...

CVE-2024-7928

FastAdmin CVE-2024-7928 affects the application up to version 1.3.3.20220121, where the /index/ajax/lang parameter is vulnerable to path traversal due to improper filtering. The issue can be triggered remotely and has publicly disclosed exploits/POCs. Upgrading to version 1.3.4.20220530 (or later...

SQL Injection Vulnerability in Intelligent Cloud Gateway Registration Management Platform of Zhejiang Dahua Technology Co.(CNVD-2024-38747)

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A SQL injection vulnerability exists in the Smart Cloud Gateway registration management platform of Zhejiang Dahua Technology Co. Ltd, which can be exploited...

CVE-2024-7262

Kingsoft WPS Office for Windows is affected by CVE-2024-7262 due to improper path validation in promecefpluginhost.exe. Versions 12.2.0.13110–12.2.0.16412 (exclusive) are exploitable via a weaponized, single-click embedded spreadsheet document that can load an arbitrary Windows library. Connected...

CVE-2024-38653

CVE-2024-38653 (Ivanti Avalanche 6.3.1, SmartDeviceServer) exposes an XML External Entity (XXE) flaw that allows a remote unauthenticated attacker to read arbitrary files on the server. Root cause: XXE in SmartDeviceServer. Impact: confidential data exposure; no integrity/availability impact expl...

CVE-2024-28986

SolarWinds Web Help Desk

CVE-2024-7593

Ivanti Virtual Traffic Manager (vTM) is affected by CVE-2024-7593: an authentication bypass in the management interface that lets a remote, unauthenticated attacker bypass admin login. Affected versions include 22.2R1 and 22.7R2 being excluded from the bypass fix; exploitation is demonstrated in ...

CVE-2024-38189

CVE-2024-38189 is a remote code execution vulnerability in Microsoft Project. The CVE description and CNNVD/MSRC references indicate an input validation error in Microsoft Project that can allow remote code execution, with a CVSS v3.1 base score of 8.8 (HIGH) and exploitability requiring user int...

CVE-2024-38107

CVE-2024-38107 is a Windows Privilege Escalation vulnerability in the Power Dependency Coordinator. Affected component: Windows Power Dependency Coordinator. Impact: local attacker with low privileges can obtain SYSTEM privileges (vector: local, no user interaction). Root cause details are not pr...

CVE-2024-38106

CVE-2024-38106 is a Windows kernel local privilege escalation vulnerability. The Windows kernel race condition allows a local attacker with low privileges to gain SYSTEM-level access and execute code with high impact. Microsoft lists this CVE as being actively exploited in the wild. The advisory ...

CVE-2024-38213

CVE-2024-38213 is a Windows Mark of the Web (MoTW) security feature bypass vulnerability. Affected software involves Windows MoTW handling; the flaw allows downloaded web-origin files to bypass warnings/ protections, enabling potentially malicious content to execute. Exploitation information in c...

CVE-2024-38196

CVE-2024-38196 is tied to the Windows Common Log File System Driver and is described as an Elevation of Privilege (local) vulnerability. The CVE is listed with a CVSSv3.1 base score of 7.8 (HIGH) and a local attack vector with low attack complexity, requiring low privileges and no user interactio...

CVE-2024-38193

CVE-2024-38193 concerns the Windows Ancillary Function Driver for WinSock (AFD) used by Winsock. The vulnerability is a local privilege-escalation issue in the AFD/WinSock stack, with a resource-management error cited by CNNVD and a privilege-escalation capability described by CISA KEV. Public ex...

CVE-2024-38178

CVE-2024-38178 is a Microsoft Windows Scripting Engine memory corruption vulnerability that exists in Edge when running Internet Explorer mode. It enables remote code execution and is being actively exploited in the wild, with public pressure reflected in multiple advisories and exploit catalogs....

CVE-2024-43360

ZoneMinder is affected by a time-based SQL Injection (CWE-89) vulnerability. The issue affects ZoneMinder installations and is publicly documented in multiple sources, including a dedicated Nuclei template for CVE-2024-43360. The underlying problem is a time-based SQL injection that can be exploi...

CVE-2024-7694

ThreatSonar Anti-Ransomware (TeamT5) suffers an unrestricted file upload vulnerability: uploaded files are not properly validated, enabling remote attackers with administrator privileges to upload malicious files and execute arbitrary system commands on the server. Impact is high (arbitrary code ...

CVE-2024-27443

CVE-2024-27443 affects Zimbra Collaboration (ZCS) 9.0 and 10.0, with a cross-site scripting flaw in the CalendarInvite feature caused by improper input validation of the calendar header. An attacker can embed a payload in a crafted calendar header sent via email; when a recipient views the messag...

CVE-2024-41710

The CVE-2024-41710 issue affects Mitel 6800/6900/6900w Series SIP Phones (including the 6970 Conference Unit) up to version R6.4.0.HF1 (R6.4.0.136). It stems from insufficient parameter sanitization during boot, allowing an authenticated attacker with administrative privileges to perform an argum...

CVE-2024-7399

CVE-2024-7399 affects Samsung MagicINFO 9 Server prior to 21.1050. A path-traversal flaw in the SWUpdateFileUploader servlet allows writing arbitrary JSP files with SYSTEM privileges, enabling remote code execution (RCE) and full server compromise. Exploitation is reported as unauthenticated via ...