CVE-2024-35640

CVE-2024-35640 is a stored XSS in the WordPress Safety Exit plugin affecting versions up to 1.7.0. Exploitation requires Administrator privileges. The issue has been fixed in 1.7.1; upgrading to 1.7.1 or later mitigates the vulnerability (low severity per Patchstack).

CVE-2024-35641

CVE-2024-35641 affects WordPress plugin Just Writing Statistics (versions

CVE-2024-35642

CVE-2024-35642: WordPress Site Favicon plugin <= 0.2 suffers stored XSS due to improper input handling in admin settings; fixed in 0.3. Affected: Site Favicon versions

CVE-2024-35643

CVE-2024-35643 affects the WP Back Button WordPress plugin (versions up to 1.1.3). The issue is a Stored XSS caused by insufficient input sanitization/output escaping in admin settings, exploitable by an attacker with Administrator privileges to inject scripts that run for other users. Public pat...

CVE-2024-5311

CVE-2024-5311 affects DigiWin EasyFlow .NET. The vulnerability arises from insufficient validation of certain input parameters, allowing an unauthenticated remote attacker to inject arbitrary SQL commands that can read, modify, and delete database records. The issue is rated CVSS v3.1 base score ...

CVE-2024-37031

The CVE-2024-37031 entry describes a stored XSS vulnerability in Active Admin (Ruby on Rails) before 3.2.2, triggered when users create entities with arbitrary names used as dynamic form legends. The root cause is the dynamic name value being reflected in admin forms, enabling an attacker to inje...

CVE-2024-36042

CVE-2024-36042 affects Silverpeas prior to 6.3.5. The issue allows authentication bypass by omitting the Password field to AuthenticationServlet, often granting an unauthenticated user superadmin access. Root cause: missing Password field handling leads to bypass of authentication checks (as desc...

CVE-2023-51436

CVE-2023-51436 affects UNIVERSAL PASSPORT RX (Japan System Techniques) up to version 1.0.8. The issue is a cross-site scripting (XSS) vulnerability that can be exploited by a remote authenticated attacker with administrative privileges to execute arbitrary scripts in users’ browsers. The root cau...

CVE-2023-42427

CVE-2023-42427 affects UNIVERSAL PASSPORT RX versions 1.0.0–1.0.7. Description: cross-site scripting may allow a remote authenticated attacker to execute arbitrary scripts in a user’s browser. Root cause hinted across sources includes a known vulnerability in the Primefaces library and associated...

CVE-2024-20075

CVE-2024-20075 affects the eemgpu component, where a missing bounds check allows a possible out-of-bounds write. This could enable local privilege escalation with System execution privileges required; exploitation does not require user interaction. Patch ALPS08713302 is referenced (MSV-1393). No ...

CVE-2024-20074

CVE-2024-20074 concerns the component “dmc,” with a possible out-of-bounds write caused by a missing bounds check. This could enable local escalation of privilege to System privileges, with no user interaction required. Reported patches include Patch ID ALPS08668110 and Issue ID MSV-1333. Multipl...

CVE-2024-20073

CVE-2024-20073 affects the wlan service due to an out-of-bounds write from improper input validation, potentially enabling local privilege escalation to SYSTEM; no user interaction required. Patch: WCNCR00367704 (MSV-1411). CVSSv3.1: 6.6 (AV:N, AC:H, PR:H, UI:N, S:U, C:H, I:H, A:H). Exploitation ...

CVE-2024-20072

The vulnerability CVE-2024-20072 affects the WLAN driver and involves an out-of-bounds write caused by improper input validation in the driver code. This flaw could allow local escalation of privileges to System level without user interaction, as described in multiple sources. A patch is identifi...

CVE-2024-20071

CVE-2024-20071 affects the WLAN driver with an out-of-bounds read caused by improper input validation. Impact per sources is local information disclosure requiring System execution privileges, with no user interaction. Exploitation details are not provided in the documents; remediation mentioned ...

CVE-2024-20070

CVE-2024-20070 affects the modem component. The root cause is the use of a risky cryptographic algorithm during the connection establishment negotiation, which may cause information disclosure to an attacker who can observe weak encryption. The issue does not require additional privileges and doe...

CVE-2024-20069

CVE-2024-20069 affects the modem component in VoWiFi IKE where a missing DH downgrade check can lead to selection of a less-secure algorithm. This information disclosure vulnerability does not require user interaction and can be exploited remotely. The issue is documented with a patch reference M...

CVE-2024-20068

CVE-2024-20068 affects the Modem component described in multiple sources as an input validation issue that can crash the system and cause remote denial of service without extra privileges or user interaction. Public documents consistently identify Modem as the affected area and note the vulnerabi...

CVE-2024-20067

CVE-2024-20067 affects the modem component (MediaTek/MOLY stack). The advisory describes an possible out-of-bounds write caused by improper input invalidation in the modem, which could enable a remote denial of service with no required privileges and without user interaction. The issue is documen...

CVE-2024-20066

The CVE-2024-20066 issue affects MediaTek Modem, caused by an incorrect bounds check leading to a possible out-of-bounds write. This enables remote denial of service with no privileges required and no user interaction needed. Remediation is available via patch MOLY01267281 (MSV-1477).

CVE-2024-20065

CVE-2024-20065 concerns a local information-disclosure flaw in the telephony stack caused by a missing permission check. The issue allows disclosure without extra execution privileges and requires no user interaction. Connected sources tie this to Mediatek telephony components (ALPS08698617; MSV-...