CVE-2024-53833

In prepareresponselocked of lwistransaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-53833

CVE-2024-53833 is reported in the Android LWIS stack, specifically in the function prepare_response_locked within lwis_transaction.c . The vulnerability stems from improper input validation, enabling a possible out-of-bounds write. Impact described as local escalation of privilege with no additio...

CVE-2024-53833

In prepareresponselocked of lwistransaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ZenML < 0.58.0 XSS

The version of ZenML installed on the remote host is prior to 0.57.1. It is, therefore, affected by a A reflected Cross-Site Scripting XSS vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation,...

CVE-2024-47924 Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2024-1609

In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation...

CVE-2024-1610

In OPPO Store APP, there's a possible escalation of privilege due to improper input validation...

CVE-2024-11254

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqusname parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11254 AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqusname parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11254

CVE-2024-11254 (AMP for WP – Accelerated Mobile Pages, WordPress) Vulnerability: Reflected cross-site scripting via the disqus_name parameter. Affected product: AMP for WP plugin for WordPress. Impact: Unauthenticated attackers can inject arbitrary scripts into pages executed in user browsers whe...

CVE-2024-8798 Bluetooth: classic: avdtp: missing buffer length check

No proper validation of the length of user input in olcpindhandler in zephyr/subsys/bluetooth/services/ots/otsclient.c...

CVE-2024-11858 Radare2: command injection via pebble application files in radare2

A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing​...

CVE-2024-10494

An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and pri...

CVE-2024-55545

CVE-2024-55545 affects ORing IAP-420 devices (web interface) with input validation failure leading to Reflected XSS in versions 2.01e and earlier. The root cause is missing input validation in the IAP-420 web UI, enabling cross-site scripting. Impact is client-side compromise through injected scr...

CVE-2024-55545 Reflected Cross-Site Scripting

Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting XSS.This issue affects IAP-420 version 2.01e and below...

PT-2024-16481

Name of the Vulnerable Software and Affected Versions System Dashboard WordPress plugin versions prior to 2.8.15 Description The issue is related to the plugin not validating user input used in a path, which could allow high privilege users, such as admin, to perform path traversal attacks and re...

CVE-2024-12353

CVE-2024-12353 affects SourceCodester Phone Contact Manager System 1.0, specifically the User Menu component’s UserInterface::MenuDisplayStart function. The vulnerability arises from improper input validation caused by manipulating the name argument, enabling a local attack. Public exploit detail...

CVE-2024-10771 SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution

Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts...

PT-2024-16908

Name of the Vulnerable Software and Affected Versions Hi e-learning Learning Management System LMS versions prior to 06.12.2024 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS...

CVE-2024-53982 Arbitrary file download in Zoo-Project Echo Example

ZOO-Project is a C-based WPS Web Processing Service implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is...