1785 matches found
CVE-2024-42191
CVE-2024-42191 affects HCL Traveler for Microsoft Outlook (HTMO). The vulnerability is a COM hijacking issue that could allow an attacker to modify or replace the HTMO application with malicious content. Documented impact indicates potential high integrity and confidentiality impact; the NVD/CVE ...
CVE-2024-42190 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
HCL Traveler for Microsoft Outlook HTMO is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content...
CVE-2024-13915
CVE-2024-13915 describes preloaded Android apps on Ulefone and Krüger&Matz devices where com.pri.factorytest exposes com.pri.factorytest.emmc.FactoryResetService, allowing any installed app to trigger a device factory reset. Affected behavior is explicitly stated; the entry notes that the APK ver...
PT-2025-23334 · Unknown · Application-Urlshortener
Name of the Vulnerable Software and Affected Versions: application-urlshortener versions prior to 1.2.4 Description: The issue allows users with view access to create arbitrary pages, including guest users who do not have existing accounts. This can lead to the creation of a large number of pages...
VulnCheck KEV: CVE-2025-48928
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dum...
CVE-2024-52597
2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One o...
CVE-2024-45240
The TikTok aka com.zhiliaoapp.musically application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal in the application's exposed WebView. On Android 12 and later, this is only exploitable by third-party applications...
CVE-2024-33535
An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion LFI in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without...
CVE-2024-31846
An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access to a resource from an unauthorized actor...
CVE-2024-2464
This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...
CVE-2024-28745
Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displaye...
CVE-2024-7749
A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function of the file /endpoint/add-account.php. The manipulation of the argument accountname leads to cross site scripting. It is possible to launch the attack...
CVE-2024-33118
LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController...
CVE-2024-46962
The SYQ com.downloader.video.fast aka Master Video Downloader application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component...
CVE-2024-28141
The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...
CVE-2024-4786
An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on...
CVE-2024-25619
Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue...
CVE-2024-26311
Archer Platform 6.x before 6.14 P2 HF1 6.14.0.2.1 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then...