CVE-2024-0559

The CVE-2024-0559 entry concerns the Enhanced Text Widget WordPress plugin (pre-1.6.6). The issue is that certain Widget options are not properly validated or escaped before being echoed in attributes, allowing Stored XSS by high-privilege users (e.g., administrators) even when unfiltered_html is...

CVE-2024-1273

CVE-2024-1273 affects the Starbox WordPress plugin prior to 3.5.0. The issue arises from insufficient sanitization/escaping of certain parameters, allowing users with a Contributor role to perform Cross-Site Scripting (stored XSS) attacks. Affected version:

CVE-2024-1068

CVE-2024-1068 affects the WordPress plugin 404 Solution prior to version 2.35.8 . The issue is an improper sanitisation/escaping of a parameter used in a SQL statement, enabling a SQL injection . The exploit is described as usable by high-privilege users (e.g., admins) and is supported by multipl...

CVE-2023-6444

Seriously Simple Podcasting WordPress plugin versions prior to 3.0.0 disclose the Podcast owner's email via an unauthenticated crafted request. Impact: unauthorized disclosure of administrator email addresses; remediation: upgrade to version 3.0.0 or later.

Code injection

In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for...

Out-of-bounds

In Santesoft Sante FFT Imaging versions 1.4.1 and prior once a user opens a malicious DCM file on affected FFT Imaging installations, a local attacker could perform an out-of-bounds write, which could allow for arbitrary code execution...

Heap overflow

In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Input validation

In accesssecureservicefromtempbond of btmsec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Heap overflow

In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Information disclosure

In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Out-of-bounds

In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead to a local non-security issue with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-0050

CVE-2024-0050 involves an out-of-bounds write in the getConfig path of SoftVideoDecoderOMXComponent.cpp. The issue is triggered via missing validation and results in a local, non‑security impact with no additional execution privileges required (no user interaction). Affected detail: the vulnerabi...

CVE-2024-0049

CVE-2024-0049 is an Android framework elevation-of-privilege issue caused by an out-of-bounds heap buffer write. The NVD entry cites local EoP with no extra privileges or user interaction required. Android’s March 2024 security bulletin documents this CVE under the Framework cluster with fixes in...

CVE-2024-0047

CVE-2024-0047 corresponds to a DoS in Android (Android Open Source Project) caused by a logic error in UserManagerService.java: writeUserLP serializes a device policy with an incorrect tag, enabling local denial of service when policies are deserialized on reboot. Exploitation requires local acce...

CVE-2024-0048

CVE-2024-0048 affects Android (AccountManagerService.java) where NULL-response handling can allow local elevation of privileges. Exploitation requires local access; no user interaction documented. Root cause: incorrect handling of NULL responses in the AccountManagerService session. Android secur...

CVE-2024-0052

In healthconnect, a vulnerability exists where a missing permission check in several functions can leak exercise route data, causing local information disclosure without extra privileges. The issue is described as a data leakage risk with no user interaction required. CVSS data shows a local atta...

CVE-2024-0046

CVE-2024-0046 involves a logic error in InstallPackageHelper.java (installExistingPackageAsUser) that can bypass carrier restrictions, enabling local privilege escalation without additional execution privileges or user interaction. The vulnerability affects Android framework code and is rated hig...

CVE-2024-0044

CVE-2024-0044 is an Android framework issue in PackageInstallerService where createSessionInternal accepts an installerPackageName that is not properly validated, allowing a local attacker with adb access to run-as any app. The root cause is insufficient validation of the installerPackageName arg...

CVE-2024-0039

CVE-2024-0039 affects Android Bluetooth stack with an out-of-bounds write in attp_build_value_cmd of att_protocol.cc, enabling remote code execution over the network without user interaction. The issue stems from a missing bounds check and is present in att_protocol.cc as described across multipl...

Input validation

An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions...