CVE-2023-23730

The CVE-2023-23730 issue affects the WordPress Spectra block (Ultimate Addons for Gutenberg) with Spectra versions

CVE-2024-36782

CVE-2024-36782 involves TOTOLINK CP300 (version 2.0.4-B20201102) with a hardcoded password in /etc/shadow.sample that allows an attacker to log in as root. The linked CVE details state a high-severity impact (CVSS v3.1: 9.8, network access, no user interaction) and parent advisories note root acc...

CVE-2024-36783

The TOTOLINK LR350 router (firmware V9.3.5u.6369_B20220309) contains a command injection vulnerability in NTPSyncWithHost caused by missing input validation on the host_time parameter. This allows a remote attacker to execute arbitrary commands via network access with high impact. Remediation gui...

CVE-2023-52162

Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is affected by a stack-based buffer overflow that could allow an attacker to execute arbitrary code. Exploitation requires authentication and the vulnerability is exploitable over the network; no user interaction is required. Impa...

CVE-2024-31682

CVE-2024-31682 concerns Phone Cleaner: Boost & Clean, version 2.2.0, where an incorrect access control in the fingerprint authentication mechanism allows bypass due to a deprecated API. The CVSSv3.1 base score is 9.8 (CRITICAL), with network attack vector, no privileges required, and user interac...

CVE-2024-31684

CVE-2024-31684 concerns Bitdefender Mobile Security (v4.11.3-gms), where the fingerprint authentication mechanism has incorrect access control due to the use of a deprecated API, enabling bypass of biometric checks. The CVSS implies low impact with limited scope (physical attack, no user interact...

CVE-2022-1242

CVE-2022-1242 affects the Ubuntu Apport component. The issue allows a local attacker to trick Apport into connecting to arbitrary sockets as root due to improper handling of Apport sockets (in containers too). Affected advisories include USN-6894-1 and related Red Hat/Nessus/OpenVAS entries; patc...

CVE-2021-3899

CVE-2021-3899 involves a race condition in Apport's replaced-executable detection that, with specific local configuration, could allow a local attacker to run arbitrary code as root. This vulnerability is referenced in multiple advisories (Ubuntu USN-6894-1, RH Red Hat CVE notes, and Nessus/OSV e...

CVE-2022-0555

CVE-2022-0555 concerns Subiquity, the Ubuntu Server installer. Affected: Subiquity's guided storage handling allows a passphrase to be shown in plaintext with read-all permissions. Root cause details are not explicitly provided in the supplied documents, but the consequence is exposure of the sto...

CVE-2024-37019

CVE-2024-37019 affects Northern.tech Mender Enterprise with weak authentication. Documented impact includes total impact on confidentiality, integrity, and availability (CVSS v3.1: 9.8). Affected versions are Mender Enterprise prior to 3.6.4 and 3.7.x prior to 3.7.4. Remediation exists: upgrade t...

CVE-2024-4332

Summary of CVE-2024-4332 (Tripwire Enterprise 9.1.0) : Affects the REST and SOAP API components when TE is configured to use LDAP/Active Directory SAML authentication and the optional “Auto-synchronize LDAP Users, Roles, and Groups” feature is enabled. The vulnerability enables unauthenticated at...

CVE-2024-31330

CVE-2024-31330 is listed in the 2024-11-01 Wear OS security bulletin under the System component with a local escalation-of-privilege (EoP) vulnerability (High severity). Affected software is Wear OS (System), with the issue mapped to AOSP version 13. The bulletin indicates exploitation could occu...

CVE-2024-31329

CVE-2024-31329 is documented in the Wear OS June 2024 security bulletin as a System-component elevation of privilege (EoP) with High severity. The bulletin notes it could lead to local EoP with no additional execution privileges. Affected devices should apply the 2024-06-01 patch level (or later)...

CVE-2024-36674

CVE-2024-36674 affects LyLme_spage v1.9.5, with a Cross Site Scripting (XSS) vulnerability exploitable via the admin/link.php endpoint. The NVD entry lists CVSS v3.1 base score 6.1 (Medium), with a network attack vector, low complexity, no privileges required, user interaction needed, and a chang...

CVE-2024-4540

CVE-2024-4540 affects Keycloak deployments using OAuth 2.0 Pushed Authorization Requests (PAR). The vulnerability is that client-provided parameters can be exposed in plain text in the KC_RESTART cookie returned in the HTTP response to a request_uri-based authorization request, enabling informati...

CVE-2024-32983

Misskey (open source decentralized microblogging platform) is affected by a vulnerability in the handling of incoming signed ActivityPub activity objects: improper normalization of JSON structures allowed spoofing of signed content and impersonation of original authors. Root cause: lack of proper...

CVE-2024-36128

Directus (Real-time API/dashboard for SQL databases) is affected by CVE-2024-36128 prior to version 10.11.2. Providing a non-numeric length to the random string generation utility triggers a memory issue that disrupts random session IDs, causing a denial of service where logged-in sessions can no...

CVE-2024-36127

The CVE pertains to the apko tool (apk-based OCI image builder) where HTTP basic auth credentials from repository and keyring URLs were exposed in log output. The issue is fixed in v0.14.5. Impact is High (log exposure of credentials) with CVSS 3.1 base score 7.5. Connected sources corroborate th...

CVE-2024-36124

Summary: CVE-2024-36124 affects the iq80 Snappy compression/decompression library. During uncompression, data may read outside the bounds of input byte arrays because Snappy uses sun.misc.Unsafe for memory access, skipping bounds checks and enabling out-of-bounds behavior that can cause non-deter...

CVE-2024-36123

Citizen is a MediaWiki skin. The page MediaWiki:Tagline can render unescaped content, enabling stored cross-site scripting via editing the MediaWiki namespace (e.g., users with editinterface or sysop privileges). Root cause: unescaped output in MediaWiki:Tagline. Impact: potential HTML/JavaScript...