CVE-2024-26455

The fluent-bit software version 2.2.2 is vulnerable to a Use-After-Free vulnerability located in the /fluent-bit/plugins/custom_calyptia/calyptia.c component. This flaw allows for potential high availability impact as indicated by its CVSS score of 7.5. Remediation involves upgrading the package ...

CVE-2021-0937

CVE-2021-0937 entry is rejected/not used per the Initial Description.

CVE-2023-40115

A use after free memory corruption vulnerability exists in the readLogs function of StatsService.cpp within the StatsD component. This flaw could allow a local attacker to achieve local escalation of privilege without requiring additional execution privileges or user interaction. While the specif...

CVE-2024-54134

CVE-2024-54134 affects the Solana JavaScript library solana/web3.js, specifically versions 1.95.6 and 1.95.7. A publish-access account was compromised, enabling attackers to publish unauthorized malicious packages that could exfiltrate private key material and drain funds from dapps that handle p...

CVE-2024-26941

CVE-2024-26941 affects the Linux kernel DRM subsystem, specifically the DP DisplayPort driver. Description from the provided documents shows a divide-by-zero regression when unplugging a StarTech MSTDP122DP DisplayPort 1.2 MST hub while using the nouveau driver. The regression occurs in the drm_d...

CVE-2024-25398

In Srelay (the SOCKS proxy and Relay) version v.0.4.8p3 , a specially crafted network payload can trigger a denial of service (DoS) condition, resulting in service disruption. The vulnerability is characterized by uncontrolled resource consumption and has been identified as a race condition . No ...

CVE-2024-39884

A regression in the core of Apache HTTP Server 2.4.60 causes it to ignore certain legacy content-type based configurations for handlers, such as AddType . Under specific circumstances where files are requested indirectly, this oversight can lead to the source code disclosure of local content. For...

CVE-2024-24310

The ecgeneratebarcode module (

CVE-2024-26491

A cross-site scripting (XSS) vulnerability exists in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 . The root cause is the improper neutralization of input during web page generation, specifically allowing attackers to inject a crafted payload into the Gallery ...

CVE-2024-21540

CVE-2024-21540: Directory Traversal in the retrieveSourceMap function of the source-map-support package. Affected IBM products (as per IBM security bulletins) include Instana/Process Mining and IBM Event Processing components, with multiple builds affected. Root cause: improper handling of pathna...

CVE-2024-26481

Kirby CMS v4.1.0 contains a reflected self-XSS (self-cross-site scripting) vulnerability within the URL field used in blueprints. The root cause is a lack of validation or sanitization when the application copies the entered URL into the link target of the link button. An attacker could use a jav...

CVE-2023-49959

Indo-Sol PROFINET-INspektor NT (versions 2.4.0 and earlier) contains a command injection vulnerability in the gedtupdater service of the firmware. A remote attacker can execute arbitrary system commands with root privileges by sending a crafted filename parameter in a POST request to the /api/upd...

CVE-2024-55949

MinIO is affected by a privilege-escalation flaw in the IAM import API. The issue impacts all users since the commit 580d9db85e04f1b63cc2909af50f0ed08afa965f, with a fix introduced in commit f246c9053f9603e610d98439799bdd2a6b293427 and released in RELEASE.2024-12-13T22-19-12Z. There are no workar...

CVE-2023-7167

The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-27507

The libLAS library (version 1.8.1 ), which is used for reading and writing LAS LiDAR geospatial data, contains a memory leak vulnerability in the /libLAS/apps/ts2las.cpp component. The root cause is attributed to memory release errors , which could allow an attacker to cause a service failure . R...

CVE-2024-25385

The command-line utility flvmeta v.1.2.2 contains a vulnerability that allows a local attacker to cause a denial of service . The root cause is located in the flv_close function at flvmeta/src/flv.c:375:21. As a temporary workaround, it is recommended to disable the flv_close() function until a f...

CVE-2023-29181

CVE-2023-29181 is a vulnerability caused by a use of an externally-controlled format string (CWE-134) in Fortinet products, including FortiOS, FortiProxy, and FortiPAM, across multiple versions (FortiOS 7.x/6.x, FortiProxy, FortiPAM) that allows a remote attacker to execute arbitrary code or comm...

CVE-2024-26988

CVE-2024-26988 concerns the Linux kernel where a memory overflow could occur in init/main.c during static_command_line construction. The bug stemmed from allocating xlen + strlen(boot_command_line) + 1 bytes for static_command_line but then copying extra_command_line and command_line into it, ins...

CVE-2024-54143

CVE-2024-54143 affects OpenWrt ASU (image-on-demand server). The build request hash truncates SHA-256 to 12 characters, lowering entropy and enabling potential hash collisions. An attacker could poison the artifact cache by serving a previously built malicious image, possibly combined with a comm...

CVE-2024-22547

The WayOS IBR-7150 intelligent flow control router is vulnerable to Cross-Site Scripting (XSS) in versions prior to 17.06.23 . The vulnerability stems from the improper neutralization of input during web page generation, which could allow an attacker to execute malicious scripts in a user's brows...

CVE-2024-36610

CVE-2024-36610 is associated with Symfony’s VarDumper deserialization issue in the Stub class, reportedly allowing crafted serialized data to trigger code execution. The primary public entries treat the candidate as withdrawn/invalid (e.g., advisories and sources noting withdrawal or removal). A ...

CVE-2024-25166

The 71CMS v.1.0.0 smart party building system contains a Cross Site Scripting (XSS) vulnerability. A remote attacker can exploit this by targeting the uploadfile action parameter within the controller.php file to execute arbitrary code. While the impact is described as a breach of security, speci...

CVE-2024-22776

Wallos version 0.9 , an open-source personal subscription tracker, is vulnerable to Cross-Site Scripting (XSS) . The root cause is a lack of proper validation in all text-based input fields, though fields requiring specific formats (such as date fields) are reportedly unaffected. An attacker coul...

CVE-2024-0020

CVE-2024-0020 affects the Android platform component NotificationSoundPreference.java. The flaw arises in onActivityResult, enabling a confused deputy to disclose audio files belonging to another user on the same device. Exploitation is local, requires no user interaction, and can lead to local i...

CVE-2023-51518

Apache James prior to versions 3.7.5 and 3.8.0 is vulnerable to pre-authentication deserialization of untrusted data via a JMX endpoint exposed on localhost. An attacker possessing a deserialization gadget could exploit this to achieve privilege escalation or remote code execution . For Java vers...

CVE-2024-26445

flusity-CMS v2.33 is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the /core/tools/delete_place.php component. Exploitation of this vulnerability could allow an attacker to perform unauthorized actions on behalf of a user. No specific remediation or exploit links are prov...

CVE-2024-25840

The PrestaShop module Account Manager | Sales Representative & Dealers | CRM (prestasalesmanager) versions up to 9.0 by Presta World is vulnerable to a path traversal attack. A guest user can exploit this flaw to download personal information without restriction. As of the provided documentation,...

CVE-2024-8534

Summary: CVE-2024-8534 is a memory safety vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can cause memory corruption and Denial of Service when the device is configured as a Gateway/VPN Vserver with RDP features enabled (or with an RDP Proxy Server Profile) or when the Auth Serv...

CVE-2024-25874

A cross-site scripting (XSS) vulnerability exists in the New/Edit Article module of Enhavo CMS v0.13.1 . The flaw allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Create Tag text field. As of the current documentation, no patched version has been r...

CVE-2023-52601

The CVE-2023-52601 entry refers to a Linux kernel flaw in the XFS-like JFS file system: a missing bound check in dbAdjTree when accessing dmt_stree can cause an array-index-out-of-bounds. The fix introduces a bool is_ctl to determine size, as described in the cited kernel commits. Affected/affect...

CVE-2024-26928

CVE-2024-26928 relates to the Linux kernel SMB/CIFS client. The advisory notes a use-after-free (UAF) in cifs_debug_files_proc_show() triggered by session teardown. The fix adds a guard to skip sessions in status SES_EXITING during teardown, preventing UAF. Multiple connected sources (Astra Linux...

CVE-2023-42838

CVE-2023-42838 is an Apple macOS sandbox-related access issue fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, and macOS Monterey 12.7.2. The description indicates an app may be able to execute arbitrary code outside its sandbox or with certain elevated privileges, driven by a sandbox-related vu...

CVE-2023-40104

CVE-2023-40104 affects ca-certificates with an information-disclosure flaw due to untrusted cryptographic certificates, enabling remote read of encrypted TLS data and requiring no user interaction. Connected sources confirm this vulnerability across multiple ecosystems (NVD/Red Hat/NASL/Nessus pl...

CVE-2024-26810

CVE-2024-26810 (Linux kernel) concerns the vfio/pci path where masking operations for external INTx were not properly synchronized with INTx configuration changes. The description in the initial document notes a race between config-space changes to DisINTx and ioctl-driven updates to interrupt co...

CVE-2024-26461

The Kerberos 5 (krb5) 1.21.2 software contains a memory leak vulnerability in the file /krb5/src/lib/gssapi/krb5/k5sealv3.c. This issue impacts various distributions, including Astra Linux , AlmaLinux , and Amazon Linux 2/2023 . Practical remediation involves updating the krb5 package to a patche...

CVE-2024-25843

The Import/Update Bulk Product from any Csv/Excel File Pro (ba_importer) module for PrestaShop , developed by Buy Addons, is vulnerable to SQL injection in versions up to 1.1.28 . This flaw allows an unauthenticated guest to perform SQL injection attacks. To remediate this issue, users should upd...

CVE-2024-2616

The CVE-2024-2616 entry describes a vulnerability in ICU handling for out-of-memory conditions that causes a crash instead of continued operation. Affected products include Firefox ESR and Thunderbird versions prior to 115.9. The change is intended to harden against exploitation, with the impact ...

CVE-2024-0794

Certain HP LaserJet Pro , HP Enterprise LaserJet , and HP LaserJet Managed Printers are vulnerable to Remote Code Execution (RCE) . The root cause is a stack-based buffer overflow within the CFF parsing mechanism when rendering fonts embedded in a PDF file, specifically due to a lack of proper va...

CVE-2024-26993

The CVE-2024-26993 issue in the Linux kernel’s fs: sysfs_break_active_protection() leaks a kobject reference in the error path if kernfs_find_and_get() fails. The root cause was an obvious reference leak when kn is NULL, which prevented the corresponding sysfs_unbreak_active_protection() from rel...

CVE-2024-24323

A SQL injection vulnerability exists in linlinjava litemall v.1.8.0 within the AdminOrdercontroller.java component. A remote attacker can exploit this flaw by manipulating the nickname, consignee, orderSN, and orderStatusArray parameters to obtain sensitive information from the database. To mitig...

CVE-2024-24100

The Code-projects Computer Book Store 1.0 (also referred to as Scholars Tracking System version 1.0 ) is vulnerable to SQL Injection via the PublisherID parameter. This vulnerability, identified as CWE-89 , allows for potential unauthorized access to sensitive data . While there is no information...

CVE-2019-11072

The issue is in lighttpd before 1.4.54 where a signed integer overflow in burl_normalize_2F_to_slash_fix could be triggered by crafted input via HTTP GET requests, potentially causing a denial of service (application crash) and possibly other impact. The vulnerability is tied to a feature introdu...

CVE-2024-27043

In CVE-2024-27043, the Linux kernel vulnerability is a use-after-free in DVB convolution: dvb_register_device assigns *pdvbdev to dvbdev and frees dvbdev in error paths without nulling *pdvbdev, enabling UAFs via the dvb device lifecycle. A fix exists (kernel patch) to null the pointer after free...

CVE-2024-25748

The Tenda AC9 AC9 v.3.0 wireless router is affected by a Stack Based Buffer Overflow vulnerability in firmware version v.15.03.06.42_multi . The root cause involves reading data beyond the buffer boundaries in memory within the fromSetIpMacBind function (also referenced as fromSetLPMacBind ). A r...

CVE-2024-0040

CVE-2024-0040 centers on a heap buffer overflow in the setParameter function of MtpPacket.cpp, causing a possible out-of-bounds read and remote information disclosure without privileges or user interaction. Multiple trusted sources (NVD, Red Hat, PRION, Vuln enrichment, CVE lists, and Android sec...

CVE-2024-25873

The Enhavo CMS (version v0.13.1 ) contains an HTML injection vulnerability (CWE-80) located in the Author text field of the Blockquote module. A specially crafted payload can be used by an attacker to execute arbitrary code. As a temporary workaround, it is recommended to disable the Author text ...

CVE-2023-52585

The Linux kernel contains a vulnerability in the drm/amdgpu component involving a potential NULL dereference in the amdgpu_ras_query_error_status_helper() function. The issue arises because the system incorrectly assumed the 'info' variable could be null, leading to an invalid error code -EINVAL ...

CVE-2024-25746

The Tenda AC9 v.3.0 dual-band wireless router is vulnerable to a Stack Based Buffer Overflow in the add_white_node function. This flaw exists in firmware version v.15.03.06.42_multi and allows a remote attacker to execute arbitrary code . While the vulnerability's technical details are confirmed ...

CVE-2024-0034

Technical details beyond the BAL Bypass description are not publicly provided in the supplied documents. Monitor Android security advisories and vendor advisories for affected products, versions, and fixes.

CVE-2024-27508

Atheme version 7.2.12 is affected by a memory leak vulnerability located in the /atheme/src/crypto-benchmark/main.c file. This issue is categorized as CWE-401 (Missing Release of Memory after Effective Lifetime), where memory is not properly released after its lifetime, potentially impacting syst...