CVE-2024-20770

CVE-2024-20770 affects Adobe Photoshop Desktop up to versions 24.7.2 and 25.3.1 (and earlier). The issue is an out-of-bounds read that could disclose sensitive memory and potentially bypass ASLR. Exploitation requires user interaction (victim must open a malicious file). Several connected sources...

CVE-2023-2794

ofono on Linux is affected by a stack-based buffer overflow in decode_deliver() during SMS decoding, due to a missing bound check that exists in decode_submit(). This can enable remote code execution when an attacker sends crafted SMS or via a compromised modem/malicious base station. Connected a...

CVE-2024-2243

CVE-2024-2243 affects the csmock component used with OSH (OAuth? Kerberos-based) in Tencent/TencentOS and Fedora/RHEL packaging. The vulnerability allows a regular OSH-service user (anyone with a Kerberos ticket) to disclose the confidential Snyk authentication token and to run arbitrary commands...

CVE-2024-20737

Adobe After Effects is affected by CVE-2024-20737: an out-of-bounds read in RGB file parsing that can disclose sensitive memory and bypass ASLR. Affected versions include 24.1, 23.6.2 and earlier. Exploitation requires user interaction (victim opens a malicious file) and may have a high confident...

CVE-2024-26097

CVE-2024-26097 affects Adobe Experience Manager versions 6.5.19 and earlier, with a stored XSS vulnerability in vulnerable form fields that could allow malicious JavaScript to execute in a user’s browser. The underlying issue is a stored XSS in the affected input handling. Remediation is to updat...

CVE-2024-26087

Adobe Experience Manager 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields (CVE-2024-26087). Root cause: stored XSS allowing injection of malicious scripts, leading to JavaScript execution in the victim’s browser when visiting a page containing the vulnerable...

CVE-2024-20780

CVE-2024-20780 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. A stored Cross-Site Scripting (XSS) vulnerability exists in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when visiting a page containing the vulnerable...

CVE-2024-26084

CVE-2024-26084 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when the page containing the field is loaded. A...

CVE-2024-26047

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue could allow an attacker to inject JavaScript that executes in a victim’s browser when visiting a page containing the vulnerable field. ...

CVE-2024-20778

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser when visiting pages containing those fields. The issue is a stored XSS (CWE-79) and is ...

CVE-2024-26079

CVE-2024-26079 affects Adobe Experience Manager 6.5.19 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Malicious JavaScript could execute in a user’s browser when visiting a page containing the affected field. The weakness is documented across multip...

CVE-2024-1780

CVE-2024-1780 refers to the BizCalendar Web plugin for WordPress, which is vulnerable to Reflected Cross-Site Scripting via the tab parameter in versions up to 1.1.0.19. The vulnerability enables unauthenticated attackers to inject scripts into pages executed when a user is tricked into taking an...

CVE-2024-22448

CVE-2024-22448 concerns Dell BIOS: an Out-of-Bounds Write vulnerability in Dell BIOS, exploitable by a local, authenticated attacker with admin privileges, causing denial of service. Affected software/tooling is the Dell BIOS on Dell systems; the root cause is an out-of-bounds write in the BIOS c...

CVE-2024-3540

CVE-2024-3540 affects Campcodes Church Management System 1.0. Affected component: /admin/add_sundaysch.php where the Gender parameter can be manipulated to trigger SQL injection. Root cause: unsanitized input in a server-side query, enabling remote exploitation. Publicly disclosed exploit exists....

CVE-2024-3539

CVE-2024-3539 affects Campcodes Church Management System 1.0. A SQL injection vulnerability exists in the /admin/addgiving.php file, caused by improper handling of the amount parameter. The attack is remotely exploitable and has publicly disclosed exploit information. Affected CVSS metrics indica...

CVE-2024-2428

The Ultimate Video Player For WordPress plugin (version

CVE-2023-6385

CVE-2023-6385 affects the WordPress Ping Optimizer plugin up to version 2.35.1.3.0. The vulnerability stems from missing CSRF checks in certain areas, enabling an attacker to cause logged-in users to perform unwanted actions (e.g., clearing logs) via CSRF. Several trusted sources (NVD, CVE feeds,...

CVE-2024-1042

CVE-2024-1042 affects the WP Radio plugin for WordPress (versions up to 3.1.9). Description shows unauthorized modification of data via missing capability checks on several AJAX actions, allowing authenticated users with subscriber+ privileges to import stations, remove countries, and alter plugi...

CVE-2024-3020

CVE-2024-3020 affects WP Carousel Free (and related WP Carousel variants) with PHP Object Injection via deserialization in the import function (shortcode param). Exploitation requires administrator authentication; a POP chain with another plugin/theme could lead to file deletion, data disclosure,...

CVE-2024-2733

Bold Page Builder for WordPress is affected by CVE-2024-2733: a Stored XSS via the Separator element in all versions up to 4.8.8. Attack requires authentication (Contributor+) and can inject scripts that run when pages are viewed. The linked documents indicate the issue has a patch and that updat...