231583 matches found
CVE-2024-20835
CVE-2024-20835 concerns CustomFrequencyManagerService with an improper access-control vulnerability. Multiple connected sources (Red Hat, PT Security, CVE databases) confirm the issue affects CustomFrequencyManagerService prior to the Samsung SMR Mar-2024 Release 1, enabling local attackers to ex...
CVE-2024-20832
The CVE-2024-20832 entry concerns the Little Kernel bootloader heap overflow in Samsung devices. Affected component: Little Kernel in the bootloader; root cause: heap overflow prior to SMR Mar-2024 Release 1. Impact: local privileged attackers can execute arbitrary code. Public exploitation detai...
CVE-2024-20831
CVE-2024-20831 describes a stack overflow in the Little Kernel bootloader. The vulnerability is exploitable locally to gain privileged code execution via the bootloader on versions prior to SMR Mar-2024 Release 1. Remediation per provided documents is to update to SMR Mar-2024 Release 1 or later;...
CVE-2024-20829
The CVE-2024-20829 issue affects Samsung Internet (pre-24.0.0.0) where missing proper interaction for opening deeplinks can allow a remote attacker to open an application without user interaction. Connected sources (PT-2024-18736) specify Samsung Internet versions prior to 24.0.0.0 as affected an...
CVE-2023-52432
The CVE involves Samsung libsec-ril, specifically the IpcTxSndSetLoopbackCtrl function. Affected: libsec-ril versions prior to SMR Sep-2023 Release 1. Root cause: improper input validation in IpcTxSndSetLoopbackCtrl. Impact: local attackers can write out-of-bounds memory, with potential confident...
Command injection
Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...
Code injection
Improper neutralization of special elements in output CWE-74 used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to...
Design/Logic Flaw
Missing release of resource after effective lifetime CWE-772 in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service. This issue affects: All variants of the...
CVE-2024-22383
CVE-2024-22383 concerns the Gallagher Controller 7000. A missing resource release after its effective lifetime (CWE-772) causes HBUS-connected T-Series readers to fail to recover after an RS-485 attack, yielding a persistent denial of service. Affected are all Controller 7000 variants with versio...
Design/Logic Flaw
The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the adminlogic function hooked via admininit in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update the memory...
Design/Logic Flaw
The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'gambitbuildersavecontent' function in all versions up to, and including, 5.1.0. This makes it possible for...
CVE-2024-1769
The CVE-2024-1769 entry concerns the JM Twitter Cards WordPress plugin. Public data confirms information exposure via the meta description that can let unauthenticated users view password-protected post content from the page source in versions up to 12. The vulnerability is documented across mult...
CVE-2024-1381
CVE-2024-1381 affects the Page Builder Sandwich – Front End WordPress Page Builder Plugin. The vulnerability is a Sensitive Information Exposure in all versions up to 5.1.0, enabling authenticated users with subscriber+ privileges to extract sensitive user or configuration data. Connected sources...
CVE-2024-0825
CVE-2024-0825 concerns the WordPress plugin “Vimeography: Vimeo Video Gallery” (
CVE-2024-1285
CVE-2024-1285 affects the Page Builder Sandwich – Front End WordPress Page Builder Plugin for WordPress. It permits unauthorized modification of data via a missing capability check in gambit_builder_save_content, affecting all versions up to 5.1.0. Attackers with subscriber+ privileges can insert...
CVE-2024-1478
CVE-2024-1478 affects the WordPress plugin “Maintenance Mode.” Multiple sources confirm a REST API–driven Sensitive Information Exposure that lets unauthenticated attackers fetch post/page content in versions up to 2.5.0. The vulnerability arises from REST API access bypassing the plugin’s conten...
CVE-2024-1782
CVE-2024-1782 concerns the Blue Triad EZAnalytics WordPress plugin. Affected versions are all up to and including 1.0, with a Reflected Cross-Site Scripting vulnerability via the bt_webid parameter caused by insufficient input sanitization and output escaping. This enables unauthenticated attacke...
CVE-2024-1178
CVE-2024-1178 affects the WordPress plugin SportsPress – Sports Club & League Manager . The issue is a missing capability check in the settings_save() function, enabling unauthenticated modification of data (permalink structure) in all versions up to and including 2.7.17. The CVSS base score is 5...