CVE-2021-34981

Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to...

CVE-2024-3240 ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection

The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settingsencoded' attribute of the 'smileinfobar' shortcode. This makes it possible for authenticated attackers, with...

CVE-2023-42093

Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2023-38109

Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2024-32359

An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster...

Typora cross-site scripting vulnerability

Typora is an editor. A cross-site scripting vulnerability exists in Typora versions v1.0.0 through v1.7, which stems from a cross-site scripting vulnerability in the Markdown editor that can be exploited by an attacker to upload a Markdown file to execute arbitrary code...

CVE-2024-23774

An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components of Quest KACE Agent for Windows versions 12.0.38 and 13.1.23.0 . This flaw allows local attackers to execute arbitrary code with NT Authority\SYSTEM privileges. To remediate, users are advise...

Devellion CubeCart security vulnerabilities

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images, etc. in an online store. A security vulnerability exists in Devellion CubeCart versions prior to 6.5.5, which...

CVE-2024-32418

An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the addaddon.php component...

Pandora FMS Path Traversal

The vulnerability of the Pandora FMS system for monitoring and managing IT environments stems from incorrect restrictions on the path name used to access the restricted catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files into the system and execute arbitrary...

CVE-2023-49502

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ffbwdiffilterintrac function in the libavfilter/bwdifdsp.c:125:5 component...

CVE-2024-31784

An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component...

Typora security vulnerability

Typora is an editor. A security vulnerability exists in Typora v.1.8.10 and earlier versions that originated from a vulnerability that allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted src component payload...

CVE-2024-30885

Reflected Cross-Site Scripting XSS vulnerability in HadSky v7.6.3, allows remote attackers to execute arbitrary code and obtain sensitive information via the chklogin.php component...

CVE-2024-31492

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

Vulnerabilities fixed in Microsoft Defender for IoT

Microsoft has fixed vulnerabilities in Defender for IoT. A malicious party can exploit the vulnerabilities to afford elevated permissions and execute arbitrary code with permissions of the process. Microsoft has made updates available that fix the described vulnerabilities described. We recommend...

PT-2024-18163 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: The issue arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within...

Microsoft Windows Internet Shortcut SmartScreen Bypass Vulnerability

This vulnerability allows remote attackers to bypass the SmartScreen security feature to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The...

PT-2024-3000 · Microsoft · Windows 7 +2

Name of the Vulnerable Software and Affected Versions: Lenovo preloaded Windows versions 7 through 8 Description: A buffer overflow vulnerability was reported in a system recovery bootloader that could allow a privileged attacker with local access to execute arbitrary code. The vulnerability is...

CVE-2024-29863

A race condition exists in the Qlik Qlikview installer executable in versions prior to May 2022 SR3 (12.70.20300) and May 2023 SR2 (12.80.20200) . The vulnerability stems from improper synchronization when using a shared resource, specifically during an MSI repair operation. An attacker can explo...