CVE-2024-4443

CVE-2024-4443 affects the WordPress plugin “Business Directory Plugin – Easy Listing Directories for WordPress” up to version 6.4.2. The vulnerability is a time-based SQL Injection in the listingfields parameter caused by insufficient escaping and poor query preparation, allowing unauthenticated ...

CVE-2024-21683

CVE-2024-21683 is an authenticated Remote Code Execution in Atlassian Confluence Data Center and Server. The issue arises from the Rhino script engine parsing tainted data in uploaded text/files, allowing an attacker with necessary privileges (e.g., admin) to execute arbitrary host code. Affected...

CVE-2024-27130

CVE-2024-27130 affects QNAP QTS and QuTS hero (NAS devices) with a stack-based buffer overflow in a network-facing path. The root cause, as reported in connected exploit handling, is unsafe use of strcpy in the share.cgi No_Support_ACL function, allowing remote code execution via crafted network ...

CVE-2024-34193

The connected PT-2024-25731 entry provides concrete technical details for CVE-2024-34193: in Smanga version 3.2.7, the file parameter at the PHP/get file flow.php interface is not properly filtered, enabling a path traversal vulnerability that can lead to arbitrary file reads. There is no publish...

CVE-2024-2782

CVE-2024-2782 affects WordPress plugin Fluent Forms (Contact Form Plugin for Quiz, Survey, and Drag & Drop WP Form Builder) versions

CVE-2024-2771

CVE-2024-2771 affects the Contact Form Plugin by Fluent Forms for WordPress. The issue is an unauthenticated privilege-escalation caused by a missing capability check on the REST endpoint /wp-json/fluentform/v1/managers. Vulnerable in all versions up to 5.1.16, allowing an unauthenticated attacke...

CVE-2024-27954

WordPress Automatic plugin

CVE-2023-37999

HT Mega (Absolute Addons for Elementor) for WordPress

CVE-2024-4956

Affected product: Sonatype Nexus Repository 3. Vulnerability: Path Traversal (CWE-22) allowing an unauthenticated attacker to read system files. Root cause / details: Unauthenticated path traversal in Nexus Repository 3 enables access to sensitive files; fixed in version 3.68.1. Impact (as stated...

CVE-2024-4947

The CVE-2024-4947 entry corresponds to a Type Confusion vulnerability in Google Chrome/Chromium V8 that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected software is the Chrome/Chromium stack using V8 prior to version 125.0.6422.60. The root c...

CVE-2024-30051

CVE-2024-30051 is an Elevation of Privilege in the Windows Desktop Window Manager (DWM) core library dwmcore.dll. The root cause is a heap-based buffer overflow in CCommandBuffer::Initialize caused by a size miscalculation (integer division) that can overflow the heap during a heap spray, allowin...

CVE-2024-30040

CVE-2024-30040 is a Windows MSHTML Platform Security Feature Bypass vulnerability. The affected component is MSHTML (Windows), with a root cause described as a security feature bypass in the MSHTML engine. Impact per CVSS: CVSS 3.1 base score 8.8 (High) affecting confidentiality, integrity, and a...

CVE-2024-4761

CVE-2024-4761: Out-of-bounds memory write in V8 used by Google Chrome/Chromium prior to 124.0.6367.207 via a crafted HTML page. A remote attacker could trigger an out-of-bounds write, with impact described as high for confidentiality, integrity, and availability. Affected software is Chrome/Chrom...

CVE-2024-29895

CVE-2024-29895 affects Cacti 1.3.x DEV builds. The vulnerability is in cmd_realtime.php : when PHP is configured with register_argc_argv = On, the poller_id parameter is taken from $_SERVER['argv'] and can be controlled via URL, enabling unauthenticated command execution (RCE) on the server. The ...

CVE-2024-4671

CVE-2024-4671 is a use-after-free vulnerability in Google Chrome’s Visuals component, reported in Chromium-based builds prior to 124.0.6367.201. The issue could allow a remote attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page, with high impact and in-...

CVE-2024-3809

CVE-2024-3809 pertains to Porto Theme - Functionality (WordPress) and is a Local File Inclusion flaw exploitable by authenticated users with Contributor+ privileges via the slideshow_type post meta in versions up to 3.0.9. The bug allows including and executing arbitrary PHP code on the server, b...

CVE-2024-3808

CVE-2024-3808 pertains to the Porto Theme – Functionality plugin for WordPress. The vulnerability enables authenticated attackers with contributor-level privileges or higher to perform a Local File Inclusion via the porto_portfolios shortcode and its portfolio_layout attribute, enabling arbitrary...

CVE-2024-3806

CVE-2024-3806 concerns the Porto theme for WordPress. It enables Unauthenticated Local File Inclusion via porto_ajax_posts in all versions up to 7.1.0, allowing arbitrary PHP code execution by including server files. Impact includes bypassing access controls and potential data exposure or code ex...

CVE-2024-3807

CVE-2024-3807 affects the WordPress Porto theme (versions up to 7.1.0). The vulnerability is a Local File Inclusion via post-meta parameters porto_page_header_shortcode_type, slideshow_type, and post_layout, allowing an authenticated attacker with contributor-level permissions to include and exec...

CVE-2024-32739

A concrete SQL injection vulnerability (CVE-2024-32739) affects CyberPower PowerPanel Enterprise prior to v2.8.3. The flaw resides in the MCUDBHelper’s query_ptask_verbose function, enabling an unauthenticated remote attacker to leak sensitive information. Affected software: CyberPower PowerPanel...