5838 matches found
CVE-2024-23704
CVE-2024-23704 is an elevation-of-privilege vulnerability in Android’s WifiDialogActivity.onCreate that bypasses DISALLOW_ADD_WIFI_CONFIG due to a missing permission check. Exploitation requires local access with no user interaction; no remote vector is described. Multiple connected sources (NVD,...
CVE-2024-0026
CVE-2024-0026 corresponds to a DoS in Android’s SnoozeHelper.java, causing a persistent denial of service through resource exhaustion. Affected component: Android framework/system code on Google Android. Impact: local DoS with no extra execution privileges and no user interaction required. Source...
CVE-2024-23694
CVE-2024-23694 is an Android Bluetooth elevation-of-privilege issue reported in Pixel/Android bulletins. The connected OSV entry details a use-after-free in a paired Bluetooth LE audio device that can enable code execution with no user interaction, on affected Pixel and non-Pixel Android devices....
CVE-2023-31234
CVE-2023-31234: Tilda Publishing WordPress plugin
CVE-2023-27281
CVE-2023-27281 is impactfully documented in IBM’s bulletin for IBM Aspera Orchestrator 4.0.1, where the vulnerability manifests as observable response discrepancies that could allow a remote attacker to enumerate usernames. The connected IBM doc confirms affected product/version and describes the...
CVE-2023-27280
IBM Aspera Orchestrator 4.0.1 is affected by CVE-2023-27280, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt sensitive information. The IBM security bulletin for CVEs 2023-27280/27283/27281 states impact on 4.0.1 and recommends upgrading to 4.0.1 PL2 (Linux)...
Healthcare Needs To Be Laser-Focused on API Security and Its Blind Spots
API-powered tools can enhance patient access to healthcare services, but these tools also introduce risk. Learn how to protect your organization...
CVE-2024-26322
Technical details for CVE-2024-26322 are not publicly provided in the supplied documents. Monitor for updates from official advisories.
CVE-2024-26325
CVE-2024-26325 is associated with ownCloud
CVE-2024-26321
CVE-2024-26321 pertains to vulnerabilities in ownCloud as documented by a pending CVE placeholder linked to real fixes. The connected advisory indicates an Authentication Bypass Using Pre-signed URLs in ownCloud, where improper validation may allow an attacker to bypass authentication and access ...
CVE-2024-24710
CVE-2024-24710 affects WordPress plugin Feed Them Social (SlickRemix) up to version 4.2.0. The issue is a missing authorization vulnerability (broken access control) that could enable unauthorized actions on affected sites. The CVE entry notes updated versions and references Patch Stack indicatin...
CVE-2023-44472
CVE-2023-44472: Unyson WordPress plugin (<= 2.7.28) contains a Missing Authorization/Broken Access Control vulnerability. Root cause is missing authorization checks; impact is limited by documented scope (Unyson
CVE-2023-44446
CVE-2023-44446 affects GStreamer’s MXF demuxer (gstreamer1-plugins-bad-free, among others). The vulnerability is a use-after-free during MXF file parsing caused by not validating an object’s existence before operating on it. This can allow an attacker to execute code in the context of the affecte...
CVE-2023-44444
CVE-2023-44444 affects GIMP (PSP parsing). Craft data in PSP files can trigger an off-by-one when writing into a heap-based buffer, enabling remote code execution in the process context. Exploitation requires user interaction (visiting/opening a malicious file). The issue is confirmed by ZDI-Can-...
CVE-2023-44443
CVE-2023-44443 describes a Remote Code Execution in GIMP via PSP file parsing. The root cause is lack of validation of PSP data, causing an integer overflow during memory write. Impact is high: attacker-controlled code executed with the current process, with UI interaction required (user must ope...
CVE-2023-42118
CVE-2023-42118 affects Exim libspf2. The vulnerability arises in the SPF macro parser, where unvalidated user-supplied data can trigger an integer underflow before memory write, enabling remote code execution with the service account context. Exploitation appears feasible by network-adjacent atta...
CVE-2023-42117
CVE-2023-42117 affects Exim (smtp service). Root cause: Improper neutralization/validation of user-supplied data leading to a memory corruption and remote code execution, with no authentication required. Impact: remote code execution in Exim processes, on affected installations. Affected componen...
CVE-2023-42115
Exim’s SMTP service (port 25) is affected by CVE-2023-42115: an AUTH-less out-of-bounds write that enables remote code execution via improper validation of user-supplied data, allowing code execution under the service account. The vulnerability details and impact are stated in multiple sources (E...
CVE-2023-40481
7-Zip (SQFS parsing) is affected by CVE-2023-40481: an out-of-bounds write in theSquashFS file parsing path can lead to remote code execution when a user opens a malicious file or visits a malicious page. The issue stems from insufficient validation of user-supplied data, allowing a write past th...