PUB-A-313798746

In DeregAcceptProcINT of cnNrmmStateDeregInit.cpp, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-322327032

In lwisprocesstransactionsinqueue of lwistransaction.c, there is a possible use after free due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-320994624

In ProtocolCdmaCallWaitingIndAdapter::GetCwInfo of protocolsmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation...

PUB-A-326279145

In handlemsg of main.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-WP8J-C736-C5R3 TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors

It has been discovered that link tags generated by typolink functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability. As second and...

PT-2024-23426 · WordPress · Site Reviews

Name of the Vulnerable Software and Affected Versions: Site Reviews WordPress plugin versions prior to 7.0.0 Description: The issue allows an attacker to manipulate client IP addresses retrieved from potentially untrusted headers, which can be used to bypass IP-based blocking. Recommendations: Fo...

PT-2024-26233 · F Logic · F-Logic Datacube3

Name of the Vulnerable Software and Affected Versions: F-logic DataCube3 version 1.0 Description: The issue is related to command injection due to improper string filtering at the command execution point in the ./admin/transceiver schedule.php file. An unauthenticated remote attacker can exploit...

PT-2024-4025

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 125.0.6422.112 Description: The issue is related to a type confusion vulnerability in the V8 engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox via a...

PT-2024-26999 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: Newsletter Popup WordPress plugin versions 1.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised a...

CVE-2024-3460

In KioWare for Windows versions all through 8.34 it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. ...

Important: flatpak

Issue Overview: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of...

Medium: clamav

Issue Overview: A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in ...

PT-2024-25863 · Unknown · Canvasio3D Light

Name of the Vulnerable Software and Affected Versions: canvasio3D Light versions n/a through 2.5.0 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type. This allows for the upload of files that could potentially be dangerous. Recommendations: For versions n/a...

PT-2024-25499 · Globitel · Globitel Ksa Speechlog

Name of the Vulnerable Software and Affected Versions: Globitel KSA SpeechLog version 8.1 Description: A stored cross-site scripting XSS issue was found in the Save Query function. Recommendations: For version 8.1, consider disabling the Save Query function until a patch is available to prevent...

PT-2024-15566 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the plugin's element...

PT-2024-4483 · Lenovo · Lenovo Service Bridge

Name of the Vulnerable Software and Affected Versions: Lenovo Service Bridge versions prior to 5.0.2.17 Description: A privilege escalation issue was reported that could allow operating system commands to be executed if a specially crafted link is visited. The vulnerability is related to the...

PT-2024-25867 · Unknown · Thim Elementor Kit

Name of the Vulnerable Software and Affected Versions: Thim Elementor Kit versions 1.1.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Stored XSS. This allows for the storage of malicious scripts in a website, which...

CVE-2024-23707

In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2024-25123 · Roothub · Roothub

Name of the Vulnerable Software and Affected Versions: Roothub version 2.6 Description: A SQL injection issue was discovered in Roothub via the s parameter in the search function. This allows for potential exploitation. No information is provided about the estimated number of potentially affected...

CVE-2023-27322

Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host...