CVE-2024-2909

CVE-2024-2909 affects Ruijie RG-EG350 up to 20240318. The vulnerability resides in the HTTP POST Request Handler function setAction (file /itbox_pi/networksafe.php?a=set) where manipulation of the bandwidth argument enables OS command injection. It can be exploited remotely; multiple sources conf...

CVE-2023-48777

Elementor Website Builder is affected by CVE-2023-48777: Unrestricted file upload to RCE via template import in versions 3.3.0–3.18.1. Exploitation requires Contributor-level access (Authenticated). The root cause involves handle_elementor_upload saving uploaded files to a temporary location befo...

CVE-2023-48275

CVE-2023-48275 affects WordPress Widgets for Google Reviews (and related Trustindex.io widgets) with an Arbitrary File Upload in versions up to 11.0.2. The public details indicate an Unrestricted/Arbitrary file upload vulnerability enabled by insufficient file-type validation, allowing an attacke...

CVE-2023-39307

CVE-2023-39307 affects the Avada WordPress theme, with versions up to 7.11.1 vulnerable to an authenticated (Contributor+) arbitrary file upload via the ajax_import_options path. The underlying issue is an unrestricted file upload of dangerous types. Wordfence notes the vulnerability in Avada

CVE-2023-38388

CVE-2023-38388 affects WordPress JupiterX Core plugin (

CVE-2023-47846

CVE-2023-47846 affects the WP Githuber MD WordPress plugin (versions

CVE-2024-2885

Chromium-based Dawn use-after-free in Google Chrome before 123.0.6312.86 can allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected component: Dawn in Chrome/Chromium. Root cause: use-after-free in Dawn logic. Impact: high (confidentiality, integrity, availability). ...

CVE-2023-27630

CVE-2023-27630 concerns the WordPress plugin Community by PeepSo (PeepSo Core). Vulnerable until version 6.0.9.0 , the issue is an exposure of sensitive information to an unauthenticated actor (server-side information disclosure). Patchstack attributes the vulnerability to low-severity data expos...

CVE-2024-2955

CVE-2024-2955 affects Wireshark’s T.38 dissector, causing a denial-of-service crash when processing crafted packets or captures. Public details in connected advisories confirm the issue in Wireshark releases 4.2.0–4.0.3 and 4.0.0–4.0.13, with impact described as DoS via packet injection or crafte...

CVE-2023-27459

CVE-2023-27459 describes a Deserialization of Untrusted Data vulnerability in the WordPress plugin WordPress User Registration (WPEverest/Masteriyo) for versions through 2.3.2.1. The vulnerability enables authenticated subscribers to achieve PHP Object Injection via untrusted data deserialization...

CVE-2024-2902

CVE-2024-2902 affects Tenda AC7 firmware version 15.03.06.44. The vulnerability is in the function fromSetWifiGusetBasic within /goform/WifiGuestSet, where manipulating the shareSpeed argument causes a stack-based buffer overflow. Exploitation can be performed remotely and the vulnerability has b...

CVE-2024-2901

CVE-2024-2901 affects Tenda AC7 (15.03.06.44) in the /goform/openSchedWifi endpoint via the setSchedWifi function. The issue is a stack-based buffer overflow caused by manipulating the schedEndTime parameter, enabling remote in‑the‑wild exploitation as disclosed. No official fix version is provid...

CVE-2023-27440

CVE-2023-27440 affects OnTheGoSystems Types plugin for WordPress (

CVE-2023-25965

CVE-2023-25965 describes exposure of sensitive information to an unauthorized actor in the WordPress plugin Upload Resume (mbbhatti), affected up to version 1.2.0. Public sources consistently state an information-disclosure flaw enabling unauthenticated access to sensitive data via the plugin’s r...

CVE-2023-23656

The CVE-2023-23656 entry concerns the WordPress MainWP File Uploader Extension. Affected component: MainWP File Uploader Extension (versions through 4.1). Root cause: Unrestricted Upload of File with Dangerous Type, enabling unauthenticated arbitrary file uploads. Impact: authenticated? It states...

CVE-2023-6091

CVE-2023-6091 affects the WordPress Theme Editor plugin (mndpsingh287) and its “Theme Editor” component, with vulnerable versions <= 2.7.1. The issue is an Unrestricted Upload of File with Dangerous Type that could enable an attacker with Administrator privileges to upload arbitrary files to t...

CVE-2024-2895

CVE-2024-2895 affects the Tenda AC7 (firmware 15.03.06.44). The vulnerability is in the function formWifiWpsOOB of /goform/WifiWpsOOB, where manipulation of the index argument causes a stack-based buffer overflow. The issue enables remote exploitation and has public exploit details. CVSS metrics ...

CVE-2023-52621

CVE-2023-52621: In the Linux kernel, a fix was added to bpf map helpers (bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem) to check rcu_read_lock_trace_held() before use when running sleepable BPF programs. The vulnerability arises when sleepable BPF programs manipulate BPF maps unde...

CVE-2024-25956

Dell Grab for Windows (Dell Grab) vulnerable in versions 5.0.4 and below due to improper file permissions. A locally authenticated attacker could potentially disclose certain system information. Root cause: incorrect/absent restrictive permissions on affected files. Impact is confidentiality risk...

CVE-2023-33855

CVE-2023-33855 affects IBM Common Cryptographic Architecture (CCA) used with the IBM 4769 Developer’s Toolkit. Affected versions are CCA 7.0.0 through 7.5.36, where RSA operations may exhibit non-constant-time behavior under certain conditions, potentially allowing a remote attacker to obtain sen...