6006 matches found
CVE-2023-31234
CVE-2023-31234: Tilda Publishing WordPress plugin
CVE-2023-27281
CVE-2023-27281 is impactfully documented in IBM’s bulletin for IBM Aspera Orchestrator 4.0.1, where the vulnerability manifests as observable response discrepancies that could allow a remote attacker to enumerate usernames. The connected IBM doc confirms affected product/version and describes the...
CVE-2023-27280
IBM Aspera Orchestrator 4.0.1 is affected by CVE-2023-27280, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt sensitive information. The IBM security bulletin for CVEs 2023-27280/27283/27281 states impact on 4.0.1 and recommends upgrading to 4.0.1 PL2 (Linux)...
Healthcare Needs To Be Laser-Focused on API Security and Its Blind Spots
API-powered tools can enhance patient access to healthcare services, but these tools also introduce risk. Learn how to protect your organization...
CVE-2024-26322
Technical details for CVE-2024-26322 are not publicly provided in the supplied documents. Monitor for updates from official advisories.
CVE-2024-26325
CVE-2024-26325 is associated with ownCloud
CVE-2024-26321
CVE-2024-26321 pertains to vulnerabilities in ownCloud as documented by a pending CVE placeholder linked to real fixes. The connected advisory indicates an Authentication Bypass Using Pre-signed URLs in ownCloud, where improper validation may allow an attacker to bypass authentication and access ...
CVE-2024-24710
CVE-2024-24710 affects WordPress plugin Feed Them Social (SlickRemix) up to version 4.2.0. The issue is a missing authorization vulnerability (broken access control) that could enable unauthorized actions on affected sites. The CVE entry notes updated versions and references Patch Stack indicatin...
CVE-2023-44472
CVE-2023-44472: Unyson WordPress plugin (<= 2.7.28) contains a Missing Authorization/Broken Access Control vulnerability. Root cause is missing authorization checks; impact is limited by documented scope (Unyson
CVE-2023-44446
CVE-2023-44446 affects GStreamer’s MXF demuxer (gstreamer1-plugins-bad-free, among others). The vulnerability is a use-after-free during MXF file parsing caused by not validating an object’s existence before operating on it. This can allow an attacker to execute code in the context of the affecte...
CVE-2023-44444
CVE-2023-44444 affects GIMP (PSP parsing). Craft data in PSP files can trigger an off-by-one when writing into a heap-based buffer, enabling remote code execution in the process context. Exploitation requires user interaction (visiting/opening a malicious file). The issue is confirmed by ZDI-Can-...
CVE-2023-44443
CVE-2023-44443 describes a Remote Code Execution in GIMP via PSP file parsing. The root cause is lack of validation of PSP data, causing an integer overflow during memory write. Impact is high: attacker-controlled code executed with the current process, with UI interaction required (user must ope...
CVE-2023-42118
CVE-2023-42118 affects Exim libspf2. The vulnerability arises in the SPF macro parser, where unvalidated user-supplied data can trigger an integer underflow before memory write, enabling remote code execution with the service account context. Exploitation appears feasible by network-adjacent atta...
CVE-2023-42117
CVE-2023-42117 affects Exim (smtp service). Root cause: Improper neutralization/validation of user-supplied data leading to a memory corruption and remote code execution, with no authentication required. Impact: remote code execution in Exim processes, on affected installations. Affected componen...
CVE-2023-42115
Exim’s SMTP service (port 25) is affected by CVE-2023-42115: an AUTH-less out-of-bounds write that enables remote code execution via improper validation of user-supplied data, allowing code execution under the service account. The vulnerability details and impact are stated in multiple sources (E...
CVE-2023-40481
7-Zip (SQFS parsing) is affected by CVE-2023-40481: an out-of-bounds write in theSquashFS file parsing path can lead to remote code execution when a user opens a malicious file or visits a malicious page. The issue stems from insufficient validation of user-supplied data, allowing a write past th...
CVE-2023-38104
CVE-2023-38104 affects GStreamer realmedia parsing: the MDPR chunk parsing path allows an integer overflow when allocating buffers, enabling remote code execution in the context of the affected process. The vulnerability is network-remote with no user authentication required and requires user int...
CVE-2023-38103
CVE-2023-38103 — GStreamer RealMedia parsing overflow : The issue lies in MDPR chunk parsing within GStreamer, where insufficient validation of user-supplied data can cause an integer overflow during buffer allocation, enabling remote code execution in the process context. The vulnerability is de...
CVE-2023-38089
CVE-2023-38089 concerns Kofax Power PDF with an Out-of-Bounds Write in the handling of app objects. The flaw arises from insufficient validation of user-supplied data, causing a write past the end of an allocated buffer and enabling Remote Code Execution in the context of the current process. Exp...