CVE-2023-27460

CVE-2023-27460 affects WordPress CP Contact Form with Paypal plugin, <=1.3.34, due to Missing Authorization that could enable feedback submission abuse. A fix is available: upgrade to version 1.3.35. Public advisories show differing CVSS assessments (NVD: 8.8 HIGH; Patchstack: 4.3 MEDIUM), but...

CVE-2023-27437

CVE-2023-27437 applies to the WordPress Event Espresso 4 Decaf plugin. It describes a Missing Authorization vulnerability in Decaf, allowing functionality misuse for unauthenticated users on versions up to and including 4.10.44; mitigation is to upgrade to 4.10.45.decaf (patched). The issue is lo...

CVE-2023-26523

CVE-2023-26523 affects the WordPress plugin Calculated Fields Form (versions up to 1.1.120). The root cause is Missing Authorization, enabling functionality misuse through feedback submission. Public reports describe the vulnerability as a Missing Authorization issue in Calculated Fields Form tha...

CVE-2023-26521

CVE-2023-26521 affects the WordPress plugin Search in Place (

CVE-2023-24373

The CVE-2023-24373 entry concerns the WordPress Booking calendar, Appointment Booking System plugin. Affected versions are ≤ 3.2.3, and the root cause is an External Control of Assumed-Immutable Web Parameter that allows bypass by manipulating hidden fields. The vulnerability is categorized as a ...

CVE-2023-23738

CVE-2023-23738 affects the WordPress Spectra integration in the Ultimate Addons for Gutenberg plugin (Spectra blocks) up to version 2.3.0. The issue is an Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) that enables unauthenticated email spoofing/C...

CVE-2023-23735

CVE-2023-23735 affects the WordPress Spectra (WordPress Gutenberg Blocks) plugin. Vulnerable if using Spectra ≤ 2.3.0, where improper neutralization of script-related HTML tags enables unauthenticated email HTML injection (content injection). Root cause: inadequate input/output sanitization in th...

CVE-2023-23730

The CVE-2023-23730 issue affects the WordPress Spectra block (Ultimate Addons for Gutenberg) with Spectra versions

CVE-2024-36782

CVE-2024-36782 involves TOTOLINK CP300 (version 2.0.4-B20201102) with a hardcoded password in /etc/shadow.sample that allows an attacker to log in as root. The linked CVE details state a high-severity impact (CVSS v3.1: 9.8, network access, no user interaction) and parent advisories note root acc...

CVE-2024-36783

The TOTOLINK LR350 router (firmware V9.3.5u.6369_B20220309) contains a command injection vulnerability in NTPSyncWithHost caused by missing input validation on the host_time parameter. This allows a remote attacker to execute arbitrary commands via network access with high impact. Remediation gui...

CVE-2023-52162

Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is affected by a stack-based buffer overflow that could allow an attacker to execute arbitrary code. Exploitation requires authentication and the vulnerability is exploitable over the network; no user interaction is required. Impa...

CVE-2024-31682

CVE-2024-31682 concerns Phone Cleaner: Boost & Clean, version 2.2.0, where an incorrect access control in the fingerprint authentication mechanism allows bypass due to a deprecated API. The CVSSv3.1 base score is 9.8 (CRITICAL), with network attack vector, no privileges required, and user interac...

CVE-2024-31684

CVE-2024-31684 concerns Bitdefender Mobile Security (v4.11.3-gms), where the fingerprint authentication mechanism has incorrect access control due to the use of a deprecated API, enabling bypass of biometric checks. The CVSS implies low impact with limited scope (physical attack, no user interact...

CVE-2022-1242

CVE-2022-1242 affects the Ubuntu Apport component. The issue allows a local attacker to trick Apport into connecting to arbitrary sockets as root due to improper handling of Apport sockets (in containers too). Affected advisories include USN-6894-1 and related Red Hat/Nessus/OpenVAS entries; patc...

CVE-2021-3899

CVE-2021-3899 involves a race condition in Apport's replaced-executable detection that, with specific local configuration, could allow a local attacker to run arbitrary code as root. This vulnerability is referenced in multiple advisories (Ubuntu USN-6894-1, RH Red Hat CVE notes, and Nessus/OSV e...

CVE-2022-0555

CVE-2022-0555 concerns Subiquity, the Ubuntu Server installer. Affected: Subiquity's guided storage handling allows a passphrase to be shown in plaintext with read-all permissions. Root cause details are not explicitly provided in the supplied documents, but the consequence is exposure of the sto...

CVE-2024-37019

CVE-2024-37019 affects Northern.tech Mender Enterprise with weak authentication. Documented impact includes total impact on confidentiality, integrity, and availability (CVSS v3.1: 9.8). Affected versions are Mender Enterprise prior to 3.6.4 and 3.7.x prior to 3.7.4. Remediation exists: upgrade t...

CVE-2024-4332

Summary of CVE-2024-4332 (Tripwire Enterprise 9.1.0) : Affects the REST and SOAP API components when TE is configured to use LDAP/Active Directory SAML authentication and the optional “Auto-synchronize LDAP Users, Roles, and Groups” feature is enabled. The vulnerability enables unauthenticated at...

CVE-2024-31330

CVE-2024-31330 is listed in the 2024-11-01 Wear OS security bulletin under the System component with a local escalation-of-privilege (EoP) vulnerability (High severity). Affected software is Wear OS (System), with the issue mapped to AOSP version 13. The bulletin indicates exploitation could occu...

CVE-2024-31329

CVE-2024-31329 is documented in the Wear OS June 2024 security bulletin as a System-component elevation of privilege (EoP) with High severity. The bulletin notes it could lead to local EoP with no additional execution privileges. Affected devices should apply the 2024-06-01 patch level (or later)...