Critical Severity Vulnerability

Google Chromium V8 | CVE-2024-7971: is a critical vulnerability affecting Microcks before version 1.10.0. The vulnerability allows non-administrator access to the POST /api/import and POST /api/export endpoints.

dingfanzu CMS checkin.php sql injection | CVE-2024-8301: A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely.

Apache OFBiz Incorrect Authorization | CVE-2024-38856: A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely.

code-projects Hospital Management System Login index.php sql injection | CVE-2024-8368: A vulnerability was found in code-projects Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login.

SourceCodester Sentiment Based Movie Rating System User Registration Users.php sql injection | CVE-2024-8343: A vulnerability was found in SourceCodester Sentiment Based Movie Rating System 1.0. Affected is an unknown function of the file /classes/Users.php?f=save_client of the component User Registration Handler.

High Severity Vulnerability

Kroxylicious: missing upstream kafka tls hostname verification | CVE-2024-8285: A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server’s hostname, resulting in an insecure connection.

Medium Severity Vulnerability

CRLF Injection in RestSharp’s `RestRequest.AddHeader` method | CVE-2024-45302: RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The same applies to `RestRequest.AddOrUpdateHeader` and `RestClient.AddDefaultHeader`. The way HTTP headers are added to a request is via the `HttpHeaders.TryAddWithoutValidation` method which does not check for CRLF characters in the header value. This means that any headers from a `RestSharp.RequestHeaders` object are added to the request in such a way that they are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests.

Libvirt: crash of virtinterfaced via virconnectlistinterfaces() | CVE-2024-8235: A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer.

Campcodes Supplier Management System edit_area.php sql injection | CVE-2024-8344: A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_area.php. The manipulation of the argument id leads to sql injection.

Insufficient control of region value length in discourse-calendar | CVE-2024-21658: discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space.

Contact Form Plugin by Fluent Forms for WordPress | CVE-2024-5053: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18.