AMD Graphics Driver Installer Vulnerability

Bulletin ID: AMD-SB-6015 Potential Impact: Incorrect Default Permissions Leading to Arbitrary Execution Severity: High Summary A researcher reported an incorrect default permissions vulnerability within AMD HIP SDK Software. The AMD HIP SDK is a software development kit SDK designed to allow...

CVE-2024-46962

The SYQ com.downloader.video.fast (also known as Master Video Downloader ) application for Android, affecting version 2.0 and earlier , contains a security vulnerability. An attacker can exploit the com.downloader.video.fast.SpeedMainAct component to execute arbitrary JavaScript code . The provid...

D-Link DI-8003 command injection vulnerability

The D-Link DI-8003 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in the D-Link DI-8003 version 16.07.16A1, which stems from the parameter path in the file /upgradefilter.asp failing to correctly filter construct command special characters, commands, et...

CVE-2024-10261

The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not...

CVE-2024-10640 The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution

The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.2. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-10640

CVE-2024-10640 concerns the FOX – Currency Switcher Professional for WooCommerce (WordPress) plugin. It allows unauthenticated users to trigger arbitrary shortcode execution because the value passed to do_shortcode is not properly validated. Affected versions are up to and including 1.4.2.2; the ...

NETGEAR R8500 ether.cgi Component Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the ether.cgi component failing to correctly filter constructed command special characters, commands, and so on. An attacker...

Tenda FH1206 Telnet Command Execution

The vulnerability of the function in the /goform/telnet part of the Tenda FH1206 router’s microprogramming system is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created HTTP request...

CVE-2024-10263

CVE-2024-10263 affects Tickera – WordPress Event Ticketing (Tickera – WordPress Event Ticketing) up to version 3.5.4.4 . The flaw allows unauthenticated attackers to execute arbitrary shortcodes via a value passed to do_shortcode, due to insufficient validation in the shortcode execution path. Im...

NETGEAR R8500 security vulnerabilities

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the ether.cgi component failing to correctly filter constructed command special characters, commands, and so on. An attacker...

CVE-2024-51253

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function...

CVE-2024-51253

The Draytek Vigor3900 router, specifically version 1.5.1.3 , is vulnerable to an OS command injection flaw. Attackers can inject malicious commands into mainfunction.cgi and execute them by calling the doL2TP function. This vulnerability allows for the execution of arbitrary commands without prop...

CVE-2024-51247

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function...

CVE-2024-51244

CVE-2024-51244 affects DrayTek Vigor3900 (firmware 1.5.1.3). The vulnerability stems from lack of input neutralization in mainfunction.cgi’s doIPSec path, allowing remote attackers to inject commands and execute arbitrary code. Documented impact is arbitrary command execution with the associated ...

CVE-2024-51301

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packetmonitor function...

CVE-2024-9846 Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution

The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-51304

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldapsearchdn function...

HikCentral Professional SQL Injection

The vulnerability of the software for managing and monitoring HikCentral Professional video surveillance and security systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code...

CVE-2024-9772

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-9772 Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...