CVE-2022-43935

The CVE-2022-43935 entry describes an information exposure in Brocade SANnav prior to version 2.2.2, where Fabric OS switch passwords and authorization IDs are printed in the embedded MLS DB file. This local-attack surface could lead to disclosure of sensitive credentials (confidentiality impact ...

WordPress WordPress Announcement & Notification Banner Plugin – Bulletin Plugin <= 3.11.7 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Announcement & Notification Banner Plugin – Bulletin Type Plugin Vulnerable versions = 3.11.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10682 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownersh...

WordPress plugin Announcement & Notification Banner – Bulletin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

CVE-2018-9484

CVE-2018-9484 describes an out-of-bounds read in the Android Bluetooth L2CAP implementation: in l2cu_send_peer_config_rej within l2c_utils.cc, a missing bounds check can cause a remote information disclosure without requiring privileges or user interaction. The issue is labeled with a HIGH severi...

CVE-2018-9472

The CVE-2018-9472 entry concerns a flaw in xmlMemStrdupLoc within xmlmemory.c, causing an out-of-bounds write due to an integer overflow. This could enable remote code execution in an unprivileged process with no extra privileges, and requires user interaction to exploit. Red Hat and CVE sources ...

CVE-2024-51887

creationtimestamp| type| source ---|---|--- 2024-11-20 01:53:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113512781003848320...

CVE-2018-9456

CVE-2018-9456 affects Google Android components, specifically the SDP utility: sdpu_extract_attr_seq in sdp_utils.cc. The issue is a possible out-of-bounds read due to an incorrect bounds check, enabling remote denial-of-service without extra privileges or user interaction. Connected sources (Red...

CVE-2018-9412

CVE-2018-9412 concerns a DoS in the Android Media framework due to a resource exhaustion condition in ID3.cpp’s removeUnsynchronization, caused by improper input validation. Exploitation requires user interaction; the vulnerability is local in scope with availability impact high and no confidenti...

CVE-2018-9371

CVE-2018-9371 affects the Mediatek Preloader/bootloader. It describes out-of-bounds reads/writes via an exposed interface that permits arbitrary peripheral memory mapping due to insufficient blacklisting/whitelisting. Under the described conditions, this can enable local elevation of privilege wi...

CVE-2020-26063

CVE-2020-26063 — Cisco Integrated Management Controller (IMC) API endpoints have improper authorization checks, enabling an authenticated remote attacker to bypass authorization and actions on the vulnerable system. Exploitation involves sending crafted API requests that could download files or m...

CVE-2021-1132

CVE-2021-1132 affects Cisco Network Services Orchestrator (NSO) API and web-management interface. The issue arises from improper validation of user-supplied input, allowing an unauthenticated, remote attacker to send crafted HTTP requests containing directory traversal sequences to access sensiti...

CVE-2021-1379

CVE-2021-1379 affects Cisco IP Phone Series 68xx/78xx/88xx via Cisco Discovery Protocol and LLDP processing. Root cause: missing checks when handling Cisco Discovery Protocol or LLDP packets, allowing an unauthenticated, adjacent attacker (Layer 2) to execute code remotely or cause a reload, resu...

CVE-2021-1461

Cisco SD-WAN Software is affected by a vulnerability in the Image Signature Verification feature that could let an authenticated, administrator-level attacker install an unsigned patch and boot a malicious software image. The root cause is improper verification of digital signatures for patch ima...

CVE-2020-25720

CVE-2020-25720 concerns Samba: a delegated administrator who can create objects in Active Directory can subsequently write to all attributes of the newly created object, including security-sensitive ones. The underlying cause is the absence of an ACL at creation time, resulting in the creator-own...

CVE-2017-13310

The CVE-2017-13310 issue is described as a read/write serialization bug in ViewPager.java.createFromParcel, causing a permissions bypass and enabling local escalation of privilege (an app could start an activity with system privileges without extra execution privileges). The vulnerability affects...

CVE-2021-1464

CVE-2021-1464 affects Cisco SD-WAN vManage Software. The issue is insufficient input validation for certain commands, allowing an authenticated, remote attacker to bypass authorization and gain restricted access to configuration data by sending crafted requests. Cisco has released software update...

CVE-2021-34752

CVE-2021-34752 : A vulnerability in the Cisco Firepower Threat Defense (FTD) CLI allows an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying OS due to insufficient validation of user-supplied command arguments. Affect...

CVE-2021-34751

CVE-2021-34751 affects Cisco Firepower Management Center (FMC) software. The vulnerability stems from improper encryption of sensitive information stored in the FMC GUI configuration manager, allowing an authenticated, low-privilege, remote attacker to view sensitive configuration parameters in c...

CVE-2022-20849

CVE-2022-20849 affects Cisco IOS XR Software PPPoE functionality. An unauthenticated, adjacent attacker can send a crafted PPPoE packet sequence that the PPPoE feature does not handle correctly, causing the PPPoE process to repeatedly crash and restart, resulting in denial of service. The issue i...

CVE-2022-20939

CVE-2022-20939 refers to a privilege-escalation vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) via the web-based management interface. The root cause is inadequate protection of sensitive user information, enabling an authenticated, remote attacker to access certain logs and ...