395396 matches found
CVE-2024-26642
Technical details about CVE-2024-26642 are not publicly available in the provided documents. No affected products, impact, or remediation details are disclosed here. Monitor for updates.
CVE-2023-52495
CVE-2023-52495 affects the Linux kernel PMIC GLINK altmode driver (qcom) and is caused by an incomplete port sanity check. The driver supports at most two ports; a notification for an unsupported port could access memory beyond the port array, risking memory corruption. The issue is addressed by ...
CVE-2024-1563
CVE-2024-1563 affects Mozilla Firefox for iOS Focus prior to version 122. The issue is a timeout race condition involving opening an external URL with a custom Firefox scheme, allowing an attacker to run unauthorized scripts on the top-origin page via a JavaScript URI. Connected documents confirm...
CVE-2024-25801
SKINsoft S-Museum 7.02.3 is affected by CVE-2024-25801: an XSS vulnerability where the attack payload is delivered in the filename of an uploaded file (not its content). Product: SKINsoft S-Museum; Vulnerable component: filename handling during upload via Add Media. Impact: stored/ reflected XSS ...
CVE-2023-51770
CVE-2023-51770 affects Apache DolphinScheduler and is described as an Arbitrary File Read Vulnerability exploitable before version 3.2.1. The vulnerability affects DolphinScheduler components (disclosed across multiple feeds) and is mitigated by upgrading to version 3.2.1. Exploitation details or...
CVE-2024-6151
CVE-2024-6151 is a Local Privilege Escalation in the Windows Virtual Delivery Agent (VDA) used by Citrix Virtual Apps and Desktops and Citrix DaaS. The bulletin CTX678035 states affected versions are: Current Release (CR) before 2402; 1912 LTSR before CU9; 2203 LTSR before CU5. Fixes are availabl...
CVE-2024-26921
CVE-2024-26921 affects the Linux kernel inet_defrag path. The issue arises when ip_local_out() and similar calls pass skb->sk as an argument and the skb is a fragment undergoing reassembly; if reassembly happens before the call returns, the socket (skb->sk) must not be released. This can oc...
CVE-2022-20652
Cisco Tetration contains a command-injection vulnerability in the web-based management interface and API subsystem. An authenticated remote attacker with administrator credentials can submit crafted HTTP messages to execute commands with root privileges due to insufficient input validation. Impac...
CVE-2016-20012
CVE-2016-20012 : OpenSSH up to 8.7 may leak information by testing whether a given username/public key combination is known to the SSH server, since a challenge is sent only if that combo could be valid for a login. This could enable user enumeration. The IBM bulletin notes the vendor does not re...
CVE-2024-30726
This CVE-2024-30726 entry is rejected/not used and does not represent an active vulnerability.
CVE-2024-29455
Consolidated data shows a concrete issue in ROS2 Humble Hawksbill: an arbitrary file upload vulnerability in the file upload mechanism affecting versions 2, enabling potential arbitrary code execution, denial of service, and exposure of sensitive information. The root cause and exact affected fil...
CVE-2020-11022
CVE-2020-11022 affects jQuery versions >=1.2 and =3.5.0 or apply vendor guidance where applicable.
CVE-2024-30667
This CVE entry is rejected and not used; it does not represent an active vulnerability entry.
CVE-2024-26925
CVE-2024-26925 affects the Linux kernel netfilter nf_tables module. The root cause is releasing the commit mutex during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), which allows an async GC worker to collect expired objects and acquire the released commit lock within the ...
CVE-2024-27004
CVE-2024-27004 in the Linux kernel affects the clk subsystem, where runtime PM resuming/suspending a device while holding the clk prepare_lock can deadlock (ABBA) when walking the clock tree during disable_unused. The issue manifests as hung tasks (e.g., swapper/0 and a kworker) and a deadlock be...
CVE-2024-1865
The CVE-2024-1865 entry is a duplicate of CVE-2023-2813. Public data in connected documents describe a reflected XSS in several WordPress themes mediated by the search box, allowing an unauthenticated attacker to exploit users via a malicious link. Affected themes include Aapna (1.3), Anand (1.2)...
CVE-2023-5947
CVE-2023-5947 is a duplicate of CVE-2023-7247 and should reference CVE-2023-7247 instead. The connected records (Red Hat and NVD) describe CVE-2023-7247 as a vulnerability in the WordPress plugin Login as User or Customer (
CVE-2024-26936
CVE-2024-26936 affects the Linux kernel component ksmbd. The issue arises because the response buffer is allocated in smb2_allocate_rsp_buf() only after validating the request, while the patch shows that fields in the payload and the SMB2 header are used within smb2_allocate_rsp_buf(), enabling a...
CVE-2019-8076
The CVE-2019-8076 entry concerns Adobe Application Manager (AAM) installer version 10.0 with an Insecure Library Loading (DLL hijacking) vulnerability that could allow Arbitrary Code Execution in the current user context. Multiple sources corroborate that the flaw is located in the AAM installer ...
CVE-2023-20154
CVE-2023-20154 affects Cisco Modeling Labs external authentication. An unauthenticated, remote attacker could log in to the web interface with administrative privileges by exploiting improper handling of messages from the external authentication server. The attack requires valid credentials store...
CVE-2024-30724
CVE-2024-30724 entry rejected; this candidate was withdrawn and does not represent an active vulnerability.
CVE-2024-30687
CVE-2024-30687 has been withdrawn; multiple sources (NVD, CNNVD, CVE List) state: “DO NOT USE THIS CANDIDATE NUMBER. This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.” Consequently, there is ...
CVE-2024-27000
Summary: CVE-2024-27000 is a Linux kernel vulnerability in the serial mxs-auart driver where uart_handle_cts_change() could be invoked without holding uport->lock, risking mis-synchronization. The issue is resolved by adding a spinlock around changing the CTS state. The described scenario invo...
CVE-2024-30723
CVE-2024-30723 is rejected/not used; this candidate was withdrawn by its CNA and has no vulnerability entry.
CVE-2024-6286
CVE-2024-6286 affects Citrix Workspace app for Windows. The vulnerability is a Local Privilege Escalation allowing a low-privileged user to gain SYSTEM privileges. Affected versions are Citrix Workspace app for Windows before 2403.1 (Current Release) and before 2402 LTSR (Long Term Service Releas...
CVE-2024-5491
CVE-2024-5491 affects Citrix NetScaler ADC and NetScaler Gateway. The security bulletin CTX677944 details that the following ranges are vulnerable when using affected builds: NetScaler ADC/Gateway 14.1 before 14.1-25.53; 13.1 before 13.1-53.17; 13.0 before 13.0-92.31; 13.1-FIPS before 13.1-37.183...
CVE-2024-25422
The CVE-2024-25422 entry concerns a SQL injection vulnerability in SEMCMS v.4.8. The issue affects the SEMCMS_Menu.php component and could allow a remote attacker to execute arbitrary code and access sensitive information. Several connected sources consistently describe this flaw as SQL injection...
CVE-2024-26897
CVE-2024-26897 — Linux kernel (ath9k/ath9k_htc): A race in the ath9k_wmi_event_tasklet can occur due to init-order data-structure initialization exposed to USB before driver init completes. This may cause NULL-pointer dereferences under certain WMI commands. A partial fix existed (aborting WMI_TX...
CVE-2024-26937
CVE-2024-26937 is a Linux kernel bug in the Intel i915 GPU driver where a preempt-to-busy race during engine parking could leave queue_priority_hint set. The heartbeat can trigger completion during parking, causing an assertion failure and a crash. The issue was resolved by resetting queue_priori...
CVE-2024-29291
CVE-2024-29291 affects Laravel Framework 8–11. Affected: PHP-based Laravel; issue: remote attacker may discover database credentials logged in storage/logs/laravel.log. Root cause cited in sources: sensitive connection data captured in logs via Laravel’s database connectors, enabling credential l...
CVE-2024-5492
CVE-2024-5492 is a real open redirect vulnerability in Citrix NetScaler ADC and NetScaler Gateway (remote unauthenticated attacker) described in the CTX677944 advisory. Affected versions include NetScaler ADC/Gateway 14.1 before 14.1-25.53, 13.1 before 13.1-53.17, 13.0 before 13.0-92.31, 13.1-FIP...
CVE-2024-30697
CVE-2024-30697 entry is rejected/not used and does not represent an active vulnerability.
CVE-2024-27001
CVE-2024-27001 is described in the Linux kernel context as a fix for a USB endpoint checking flaw in the comedi vmk80xx driver. The issue arose because vmk80xx_find_usb_endpoints() did not fully account for varying endpoint types (bulk vs interrupt) across hardware models, which could lead to an ...
CVE-2024-30711
CVE-2024-30711 entry is rejected/not used and does not represent an active vulnerability.
CVE-2024-27437
CVE-2024-27437 — Linux kernel (vfio/pci) intrinsic IRQ handling: The issue arises from auto-enabling of exclusive INTx IRQs during masking/unmasking, creating a window where an interrupt could fire and double-increment the disable depth. The fix in the sources inlines the kernel logic to never au...
CVE-2021-44228
CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...
CVE-2024-26955
CVE-2024-26955 is a Linux kernel vulnerability in nilfs2. The issue arises when nilfs_get_block() can return success in a state where both searching and inserting a block fail due to a race, potentially leading to a read of an unmapped buffer and triggering a BUG_ON in submit_bh_wbc() via BH_Mapp...
CVE-2024-26965
CVE-2024-26965 affects the Linux kernel clk/qcom:mmcc-msm8974. The issue stems from frequency table arrays not being terminated with an empty element, which can lead to out-of-bounds traversal by qcom_find_freq() or qcom_find_freq_floor(). The fix adds a terminating empty entry at the end of the ...
CVE-2024-26997
CVE-2024-26997 concerns the Linux kernel USB stack, specifically the dwc2 host controller. A dereference issue in the DDMA completion flow is fixed in the connected Astra Linux advisory, noting that a variable dereference was resolved in the DDMA completion flow. The advisory confirms the vulnera...
CVE-2024-30690
This CVE ID is rejected and not used per the initial description.
CVE-2024-26951
CVE-2024-26951 (Linux kernel, WireGuard) : The bug occurs in the netlink dump when peers are removed with wg_peer_remove_all(): a cursored peer that has been removed can lead to iterating freed peers, causing a use-after-free. The fix changes the check from an empty peer_list to the dedicated is_...
CVE-2024-30710
CVE-2024-30710 is rejected/not used and does not represent an active vulnerability entry.
CVE-2024-27410
CVE-2024-27410 is a Linux kernel issue in the wifi nl80211 path. The vulnerability arises when changing the mesh ID and the interface type (iftype) in a single operation, which can cause data overwrite in the wdev->u union and lead cfg80211_change_iface() to misbehave during a switch to mesh m...
CVE-2024-26935
Concrete details confirm CVE-2024-26935 affects the Linux kernel SCSI core procfs host directory handling. The issue stems from a race/regression where procfs directories created during scsi_host_alloc() could be mishandled when hosts were allocated but not added, or removed during dev_release(),...
CVE-2024-30662
CVE-2024-30662 is rejected/not used and does not represent an active vulnerability entry.
CVE-2024-27075
CVE-2024-27075 targets Linux kernel media/dvb-frontends, specifically the stv0367 driver. The root cause is a stack-frame growth issue (stack frame size 3624 exceeds 2048) exposed by clang/KASAN_STACK, due to temporary i2c_msg structures on the stack in stv0367ter_set_frontend. The fix reworks st...
CVE-2024-27065
CVE-2024-27065 is a Linux kernel issue affecting nf_tables: the verifier could incorrectly compare internal table flags during updates. The public advisories in connected documents reference a fix that “restores skipping transaction if table update does not modify flags,” applied as part of kerne...
CVE-2023-52652
CVE-2023-52652 affects the Linux kernel NTB path: ntb_register_device() could leak the device name if device_register() failed, due to a missing put_device() in the error path. The fix releases the reference so that kobject_cleanup() can free the name. The NTB error path previously removed put_de...
CVE-2023-50380
CVE-2023-50380 describes an XML External Entity (XXE) injection in Apache Ambari (affecting versions ≤ 2.7.7) due to improper input validation in the Oozie Workflow Scheduler. The issue could allow reading arbitrary server files (root-level) and may enable privilege escalation from low-privilege ...