1172 matches found
CVE-2023-3343 User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection
The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP...
Out-of-bounds
In DMPixelLoggerProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
DRUPAL-CONTRIB-2023-030
This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential. This vulnerability is mitigated ...
CVE-2023-33901
In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-33902
In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-33890
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-33880
In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-30931
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-30918
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
Information disclosure
In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-33901
In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-30941
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-30917
In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges...
CVE-2023-29406
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...
squidex 安全漏洞
squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0 that stems from improper handling of additional special elements...
[SECURITY] Fedora 38 Update: yt-dlp-2023.07.06-1.fc38
yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...
DRUPAL-CONTRIB-2023-023
This module enables you to define configurable GDPR alert messages. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be...
MagicAI 1.55R Cross Site Scripting
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...
Design/Logic Flaw
endpattern called from internalfnmatch in the GNU C Library aka glibc or libc6 before 2.22 might allow context-dependent attackers to cause a denial of service application crash, as demonstrated by use of the fnmatch library function with the ! pattern. NOTE: this is not the same as CVE-2015-8984...
