Important: cifs-utils

Issue Overview: A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. CVE-2022-27239 A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be...

CVE-2024-0041

In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not...

CVE-2023-40122

In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40113

In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-12855 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a confused deputy, which could lead to a cross-user read. This might result in the local information disclosure of photos or oth...

PT-2024-20883 · Code Projects · Code-Projects Hotel Managment System

Name of the Vulnerable Software and Affected Versions: Code-projects Hotel Managment System version 1.0 Description: The issue allows SQL Injection via the sid parameter in the "Hotel/admin/show.php?sid=2" endpoint. This means an attacker could potentially inject malicious SQL code by manipulatin...

PT-2024-17034 · Snow · Snow Software Inventory Agent

Name of the Vulnerable Software and Affected Versions: Snow Software Inventory Agent on Unix versions through 7.3.1 Description: The issue is related to an Improper Verification of Cryptographic Signature vulnerability, which allows File Manipulation through Snow Update Packages. Recommendations:...

PT-2024-12897 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX version 11.3 Description: The issue is related to authentication bypass when an OAuth2 Client uses client secret jwt as its authentication method. This can be exploited via specially crafted requests. Recommendations: For version...

Out-of-bounds

In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441150; Issue ID: ALPS08441150...

Out-of-bounds

In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477148; Issue ID: ALPS08477148...

Out-of-bounds

In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08471742; Issue ID: ALPS08308608...

PT-2024-14189 · WordPress · Crm Perks Forms – Wordpress Form Builder

Name of the Vulnerable Software and Affected Versions: CRM Perks Forms – WordPress Form Builder versions 1.1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that...

PT-2024-19232 · Unknown · Magazine3 Schema & Structured Data For Wp & Amp

Name of the Vulnerable Software and Affected Versions: Magazine3 Schema & Structured Data for WP & AMP versions 1.25 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an...

PT-2024-13670 · Buffalo · Buffalo Ls210D

Name of the Vulnerable Software and Affected Versions: Buffalo LS210D version 1.78-0.03 Description: The issue allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root due to command injection in the ping utility. Recommendations: For Buffalo LS210D version...

MAL-2024-499 Malicious code in wlwz-2312-3605 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8e20d7791f6d48303630a98a99136a6291477da487e84b0fa772d70d69f762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-19394 · Nextcloud · Nextcloud Files Zip App

Name of the Vulnerable Software and Affected Versions: Nextcloud files Zip app versions prior to 1.2.1 Nextcloud files Zip app versions prior to 1.4.1 Nextcloud files Zip app versions prior to 1.5.0 Description: The Nextcloud files Zip app is a tool to create zip archives from one or multiple fil...

PT-2024-15004 · WordPress · Email Subscription Popup

Name of the Vulnerable Software and Affected Versions: Email Subscription Popup WordPress plugin versions prior to 1.2.20 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back ...

PT-2024-14541 · WordPress · Ovic Responsive Wpbakery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Ovic Responsive WPBakery WordPress plugin versions prior to 1.2.9 Description: The issue allows attackers with a subscriber+ account to update blog options, such as users can register and default role, via some of its AJAX actions. It also...

CVE-2023-46742 CubeFS leaks users key in logs

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

CVE-2023-32876

In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308612; Issue ID: ALPS08308612...