CVE-2024-14000 to CVE-2024-14999

12 CVEs with public proof-of-concept exploits.

• CVE-2024-140072 PoCsTVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure
• CVE-2024-140101 PoCTypora 1.7.4 OS Command Injection via Export PDF Preferences
• CVE-2024-140152 PoCsStudiocart <= 2.9.0 - Reflected XSS
• CVE-2024-140211 PoCLlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization
• CVE-2024-140272 PoCsxattr: switch to CLASS(fd)
• CVE-2024-140321 PoCTwitch Studio LauncherHelper XPC Missing Authorization to Root File Write
• CVE-2024-140372 PoCsRedsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob
• CVE-2024-140421 PoCOpen5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
• CVE-2024-140431 PoCOpen5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow
• CVE-2024-140441 PoCOpen5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow
• CVE-2024-140451 PoCOpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization
• CVE-2024-140461 PoCOpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload