Input validation

The com.eypcnnapps.quickreboot aka Eyuep Can Yilmaz ROOT Quick Reboot application 1.0.8 for Android has exposed broadcast receivers for PowerOff, Reboot, and Recovery e.g., com.eypcnnapps.quickreboot.widget.PowerOff that are susceptible to unauthorized broadcasts because of missing input validati...

Cross site request forgery (csrf)

Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the addcustomblock.php...

Design/Logic Flaw

Use of a Broken or Risky Cryptographic Algorithm vulnerability in B&R Industrial Automation Automation Runtime SDM modules. The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws...

Remote code execution

An issue in Plone Docker Official Image 5.2.13 5221 open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index npm...

Code injection

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...

CVE-2023-7216

CVE-2023-7216 describes a path-traversal vulnerability in the CPIO utility where, during extraction of a crafted archive, a remote, unauthenticated attacker could cause the archiver to follow symlinks outside the target directory, enabling files to be written in arbitrary locations. Multiple sour...

CVE-2023-52138

Summary: CVE-2023-52138 affects Engrampa (MATE archive manager). The vulnerability arises in handling of CPIO archives where symlinks are followed and the archiver does not validate symlink targets, enabling a path traversal that can lead to arbitrary file writes and full Remote Command Execution...

CVE-2024-1225

CVE-2024-1225 affects QiboSoft QiboCMS X1 up to 1.0.6. The vulnerability resides in the Pay.php function rmb_pay, where manipulating the callback_class argument leads to deserialization. The issue can be exploited remotely and has been publicly disclosed. Connected sources consistently describe a...

Race condition

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn...

CVE-2023-5643

Summary (CVE-2023-5643) : An out-of-bounds write vulnerability exists in Arm Mali GPU kernel drivers (Bifrost, Valhall) and Arm 5th Gen GPU Architecture Kernel Driver. The issue allows a local, non-privileged user to trigger improper GPU memory processing, potentially writing outside buffer bound...

CVE-2021-4436

The CVE-2021-4436 entry corresponds to the WordPress plugin 3DPrint Lite, affected versions prior to 1.9.1.5. The vulnerability is an unauthenticated arbitrary file upload via the p3dlite_handle_upload AJAX action, caused by missing authorization and file validation. The presence of a .htaccess d...

Race condition

A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000getfrequency function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue...

Race condition

A race condition was found in the Linux kernel's sound/hda device driver in sndhdacregmapsync function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue...

CVE-2024-24859

CVE-2024-24859: A race condition in Linux kernel Bluetooth code (net/bluetooth sniff_min_interval_set and sniff_max_interval_set) can trigger a bluetooth sniffing exception and potential DoS. The connected Nessus/Azure Unity Unity Linux entries confirm this CVE across multiple distributions, but ...

CVE-2024-23196

CVE-2024-23196 : Astra Linux security bulletin reports a race condition in the Linux kernel sound/hda driver, in snd_hdac_regmap_sync(), which can trigger a NULL pointer dereference and may lead to a kernel panic or denial of service. This mirrors the initial description. The connected documents ...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This issue affects Scroll Triggered Box: from n/a through 2.3...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jgadbois CalculatorPro Calculators allows Reflected XSS.This issue affects CalculatorPro Calculators: from n/a through 1.1.7...

Cross site request forgery (csrf)

Sharp NEC Displays P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8 allows an attacker execute remote code by sending unintended parameters in...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Five Star Plugins Five Star Restaurant Reviews allows Stored XSS.This issue affects Five Star Restaurant Reviews: from n/a through 2.3.5...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Gordon Böhme, Antonio Leutsch Structured Content JSON-LD wpsc allows Stored XSS.This issue affects Structured Content JSON-LD wpsc: from n/a through 1.6.1...