23596 matches found
CVE-2024-4756
The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-43188
IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation...
CVE-2024-35425
vmir e8117 was discovered to contain a segmentation violation via the functionprepareparse function at /src/vmirfunction.c...
CVE-2024-27529
wasm3 139076a contains memory leaks in Readutf8...
CVE-2024-27532
wasm-micro-runtime aka WebAssembly Micro Runtime or WAMR 06df58f is vulnerable to NULL Pointer Dereference in function blocktypegetresulttypes...
CVE-2024-35426
vmir e8117 was discovered to contain a stack overflow via the initlocalvars function at /src/vmirwasmparser.c...
CVE-2024-29384
An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules functions...
CVE-2024-36063
The Goodwy com.goodwy.dialer aka Right Dialer application through 5.1.0 for Android enables any application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.goodwy.dialer.activities.DialerActivity component...
CVE-2024-33437
An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS Style Rules...
CVE-2024-20511
A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...
CVE-2024-10826
Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2024-34682
Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode...
CVE-2024-49402
Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles...
CVE-2024-49405
Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario...
CVE-2024-49407
Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles...
CVE-2024-50994
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6fix.cgi via the ipv6wanipaddr, ipv6lanipaddr, ipv6wanlength, and ipv6lanlength parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted POST...
CVE-2024-32870
Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info name, version and parameters can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...