CVE-2024-31326

CVE-2024-31326 affects the Android Framework. The issue is a logic error in policy migration code that can lead to local elevation of privilege without extra privileges or user interaction. The Android bulletin notes this as an EoP vulnerability with High severity, and lists updated AOSP versions...

CVE-2024-31317

CVE-2024-31317 is a Zygote command-injection vulnerability affecting Android 9–13, enabling a non-privileged app with WRITE_SECURE_SETTINGS to trigger code execution in the Zygote process via unsafe deserialization and manipulated Zygote arguments (e.g., runtime-flags, hidden_api_blacklist_exempt...

CVE-2024-31310

CVE-2024-31310 affects Android: in AutofillManagerServiceImpl.newServiceInfoLocked, improper input validation can allow hiding an enabled Autofill service in the Autofill service settings. Impact is local privilege escalation with high confidentiality/integrity/availability implications, requirin...

CVE-2023-21113

CVE-2023-21113 is an Android System elevation-of-privilege vulnerability caused by a confused deputy, enabling local escalation with no user interaction. Affected: Android devices; payload in multiple locations. Evidence in Android Security Bulletin shows updated AOSP versions (12, 12L, 13) and p...

CVE-2024-36041

KSmserver in KDE Plasma Workspace aka plasma-workspace before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the...

SUSE CVE-2024-38998

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2024-33871

CVE-2024-33871 affects Artifex Ghostscript prior to 10.03.1. The issue is in contrib/opvp/gdevopvp.c where the Driver parameter for opvp (and oprp) devices can specify an arbitrary dynamic library name, which is then loaded when processing a crafted PostScript document. This allows arbitrary code...

QNAP QTS OpenSSH RCE Vulnerability (QSA-24-31, regreSSHion)

QNAP QTS is prone to a remote code execution RCE vulnerability in OpenSSH dubbed SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-10000

Technical details for CVE-2016-10000 are not publicly provided in the supplied documents. No affected products, vectors, or fixes are given. Monitor for updates as new information becomes available.

UBUNTU-CVE-2024-38998

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

...

June 28, 2024—KB5039304 (OS Build 26100.1000) Preview

None None...

CVE-2024-22232

CVE-2024-22232 describes a directory traversal in Salt’s file server triggered by a specially crafted URL. The underlying issue is input validation that allows traversal sequences, enabling a malicious user to read arbitrary files from a Salt master’s filesystem. Affected component: Salt master/f...

CVE-2023-35049

CVE-2023-35049 affects the WordPress WooCommerce Stripe Payment Gateway plugin

CVE-2023-41805

CVE-2023-41805 is a Missing Authorization (Broken Access Control) issue in Brainstorm Force Premium Starter Templates and Brainstorm Force Starter Templates astra-sites, affecting Premium Starter/Templates ≤ 3.2.5. Root cause: insufficient authorization checks enabling access to data/configs. Pat...

CVE-2023-47681

CVE-2023-47681 is a Missing/Broken Access Control vulnerability in QuadLayers WooCommerce Checkout Manager (WordPress plugin). It affects plugins up to version 7.3.0, allowing unauthenticated actors to exploit due to insufficient authorization checks. Patch details: fixed in version 7.3.1. Public...

CVE-2023-47783

CVE-2023-47783 is a Missing Authorization (Broken Access Control) vulnerability in Thrive Theme Builder up to version 3.23.x (before 3.24.0). The issue affects Thrive Theme Builder and is caused by a missing capability check in a function, enabling authenticated users with subscriber-level access...

SUSE CVE-2024-35326

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2024-5934

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2023-40603

CVE-2023-40603 affects the WordPress plugin Simple Org Chart (versions up to and including 2.3.4). The root cause is Missing Authorization (Broken Access Control) allowing unauthenticated access to tree settings. The vulnerability is currently unpatched in the sources provided (no fixed version i...