CVE-2024-12803

The connected SonicWall advisory confirms CVE-2024-12803 in SonicOS: a post-authentication stack-based buffer overflow in the SonicOS management interface can be exploited remotely over the network to crash the firewall and potentially achieve code execution. Affected: SonicOS management componen...

CVE-2024-56509 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read LFR or path traversal attacks. These vulnerabilities occur when user input is...

CVE-2024-52542

Dell AppSync, version 4.6.0.x, contain a Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information tampering...

CVE-2024-11877 Cricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cricketscore' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11940

CVE-2024-11940 relates to the Property Hive Mortgage Calculator plugin for WordPress. The flaw is a Stored Cross-Site Scripting (XSS) via the price parameter in all versions up to 1.0.6. Authenticated users with Contributor+ access can inject scripts that execute when pages are loaded by other us...

Cisco Identity Services Engine Path Traversal Vulnerability (CNVD-2025-06671)

Cisco Identity Services Engine is an environment-aware platform from Cisco, USA. A path traversal vulnerability exists in Cisco Identity Services Engine that can be exploited by an attacker to read or delete arbitrary files...

Google Pixel Input Validation Error Vulnerability (CNVD-2024-45893)

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from an input validation error vulnerability that stems from improper input validation in smmemcompatgetvmmobj in lib/sm/sharedmem.c, which can be exploited by an attacker to cause memory access...

PT-2024-08: Reading arbitrary files when scanning a project linked to a git repository in PT Application Inspector (PT AI)

The vulnerability was identified in PT AI affecting versions 4.3.1 to 4.7.2. The vulnerability can be exploited by an attacker with network access to the PT AI control server to read source code files of other user's projects. The vulnerability can be exploited for privilege escalation...

Siemens SINEC Traffic Analyzer Input Validation Error Vulnerability

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communication between controllers and IO devices. The software detects PROFINET communication problems and reports them to the user via Web-UI. An input validation error vulnerability exists in Siemens SINEC Traffi...

Fortinet FortiWAN Path Traversal Vulnerability

Fortinet FortiWAN is a network appliance from Fortinet, Inc. It is used to perform load balancing and fault tolerance between different networks. A path traversal vulnerability exists in Fortinet FortiWAN, which stems from improperly restricting pathnames to restricted directories, and can be...

SUSE CVE-2020-14559

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple...

PT-2023-29117 · Lg · Com.Lge.Bluetoothsetting

Name of the Vulnerable Software and Affected Versions: com.lge.bluetoothsetting affected versions not specified Description: The issue is related to the use of implicit PendingIntents with the PendingIntent.FLAG MUTABLE set, which can lead to the theft and/or over-write of arbitrary files with...

PT-2023-28359 · Unknown · Com.Full.Dialer.Top.Secure.Encrypted

Name of the Vulnerable Software and Affected Versions: com.full.dialer.top.secure.encrypted application version 1.0.1 Description: The issue allows any installed application, without requiring permissions, to place phone calls without user interaction. This is achieved by sending a crafted intent...

PT-2023-36422 · Gnu +2 · Linux +2

Уязвимость функции drm mode setcrtc модуля drivers/gpu/drm/drm crtc.c драйвера DRM ядра операционной системы Linux связана с доступом к неинициализированной динамической памяти. Эксплуатация уязвимости может позволить нарушителю оказать влияние на целостность и доступность информации и выполнить...

CVE-2023-28345

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to t...

CVE-2023-28126

An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message...

CVE-2023-24567

Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and may launch target-specific attacks...

PT-2022-21416 · Typec · Typec

Name of the Vulnerable Software and Affected Versions: typec affected versions not specified Description: The issue is related to an incorrect calculation of buffer size in typec, which could lead to a possible out of bounds write. This might result in local escalation of privilege for an attacke...

CVE-2022-2434 String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization

The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site...

ASB-A-231275473

In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...