🚨 CVE-2024-23080
Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
Gist
[CVE-2024-23080]
[CVE-2024-23080]. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2024-23083
Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
Gist
[CVE-2024-23083]
[CVE-2024-23083]. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2024-29296
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
🎖@cveNotify
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
🎖@cveNotify
GitHub
GitHub - ThaySolis/CVE-2024-29296: CVE-2024-29296 - User enumeration on Portainer CE - 2.19.4
CVE-2024-29296 - User enumeration on Portainer CE - 2.19.4 - ThaySolis/CVE-2024-29296
🚨 CVE-2023-52070
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
Gist
[CVE-2023-52070 / CVE-2024-23077]
[CVE-2023-52070 / CVE-2024-23077]. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2024-23077
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
🎖@cveNotify
Gist
[CVE-2023-52070 / CVE-2024-23077]
[CVE-2023-52070 / CVE-2024-23077]. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2023-51141
An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component
🎖@cveNotify
An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component
🎖@cveNotify
Gist
CVE-2023-51141
CVE-2023-51141. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2023-51142
An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.
🎖@cveNotify
An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.
🎖@cveNotify
Gist
CVE-2023-51142.md
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2024-32206
A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter.
🎖@cveNotify
A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter.
🎖@cveNotify
GitHub
vulnerability/POC/WUZHICMS4.1.0 Stored Xss In Affiche Model.md at main · majic-banana/vulnerability
poc. Contribute to majic-banana/vulnerability development by creating an account on GitHub.
🚨 CVE-2024-32409
An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.
🎖@cveNotify
An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.
🎖@cveNotify
Sem-Cms
外贸网站建设,英文网站建设,外贸网站设计 - semcms
黑蚂蚁外贸网站系统SemCms是专注于英文网站建设,外贸网站制作,响应式模板设计,程序功能定制,多语言网站开发（俄语,西班牙,阿拉伯语,葡萄牙语等）小语种及网站优化(seo)推广,使用简单、稳定性好、性价比高，是soho或外贸企业建站的首选。
🚨 CVE-2024-28722
Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint
🎖@cveNotify
Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint
🎖@cveNotify
Innovaphone
ReleaseNotes14r1:Firmware
This is the Firmware 14r1 Release Notes Document.
Service Releases are planned for the second Monday each month. For each of the service release, the complete set of tests is executed. If problems show...
Service Releases are planned for the second Monday each month. For each of the service release, the complete set of tests is executed. If problems show...
🚨 CVE-2024-28699
A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.
🎖@cveNotify
A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.
🎖@cveNotify
GitHub
GitHub - flexpaper/pdf2json: PDF2JSON is a conversion library based on XPDF (3.02) which can be used for high performance PDF page…
PDF2JSON is a conversion library based on XPDF (3.02) which can be used for high performance PDF page by page conversion to JSON and XML format. It also supports compressing data to minimize size. ...
🚨 CVE-2024-28328
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.
🎖@cveNotify
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.
🎖@cveNotify
GitHub
CSV Injection CVE‐2024‐28328
Contribute to ShravanSinghRathore/ASUS-RT-N300-B1 development by creating an account on GitHub.
🚨 CVE-2024-28327
Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
🎖@cveNotify
Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
🎖@cveNotify
GitHub
Insecure Credential Storage CVE‐2024‐28327
Contribute to ShravanSinghRathore/ASUS-RT-N300-B1 development by creating an account on GitHub.
🚨 CVE-2024-25343
Tenda N300 F3 router vulnerability allows users to bypass intended security policy and create weak passwords.
🎖@cveNotify
Tenda N300 F3 router vulnerability allows users to bypass intended security policy and create weak passwords.
🎖@cveNotify
GitHub
Password Policy Bypass Vulnerability CVE‐2024‐25343
Contribute to ShravanSinghRathore/Tenda-N300-F3-Router development by creating an account on GitHub.
🚨 CVE-2024-28326
Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface.
🎖@cveNotify
Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface.
🎖@cveNotify
GitHub
Privilege Escalation CVE‐2024‐28326
Contribute to ShravanSinghRathore/ASUS-RT-N300-B1 development by creating an account on GitHub.
🚨 CVE-2024-33270
An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php component.
🎖@cveNotify
An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php component.
🎖@cveNotify
Prestashop
Customer File Upload:Attach/Upload File on Product,Cart
Prestashop Upload File provides your customers a mean to upload or attach files on product, cart, checkout and order detail pages. Display merchant uploaded files as downloadable on product pages with attractive icons.
🚨 CVE-2024-22830
Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level.
🎖@cveNotify
Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level.
🎖@cveNotify
Anticheatexpert
Anti-Cheat Expert
Since 2005, Anti-Cheat Expert (ACE) has strived to protect games and players from a broad range of security threats, offering developers a one-stop game defense System. From basic game protection strategies to industry-leading technologies, ACE offers safeguarding…
🚨 CVE-2024-32359
An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.
🎖@cveNotify
An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.
🎖@cveNotify
Gist
CVE-2024-32359 References
CVE-2024-32359 References. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2024-33844
The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attacker to cut off the connection between a controller and the drone by sending MAVLink MISSION_COUNT command with a wrong MAV_MISSION_TYPE.
🎖@cveNotify
The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attacker to cut off the connection between a controller and the drone by sending MAVLink MISSION_COUNT command with a wrong MAV_MISSION_TYPE.
🎖@cveNotify
Parrot Developers Forum
CVE-2024-33844, Bugs in ANAFI Thermal/USA Firmware
As the mavlink_itf_reset_mission_data function does not sanitize the MAV_MISSION_TYPE(0, 1, 2, 255) so that when I send MAVLink MISSION_COUNT payload with MAV_MISSION_TYPE=17, the ‘control’ crashes by freeing 0-filled memory addresses. Tested on Parrot ANAFI…