CVE-2024-1438

The CVE-2024-1438 entry concerns the WordPress plugin Rolo Slider (PressFore Ro lo Slider). Technical details in connected docs show a Missing Authorization vulnerability that allows unauthorized changes to settings in Rolo Slider versions up to and including 1.0.9. Public sources consistently de...

CVE-2022-40218

The CVE-2022-40218 entry concerns the WordPress plugin ThemeHunk Advance Product Search (WordPress TH Advance Product Search Plugin), affecting versions 1.1.4 and earlier. The root cause is a missing authorization check that allows an unauthenticated user to change plugin settings, enabling impac...

CVE-2023-41651

CVE-2023-41651 corresponds to a WordPress plugin vulnerability in the Multi-column Tag Map plugin (versions

CVE-2024-23710

CVE-2024-23710 affects Google Android: a logic error in InstallPackageHelper.java (assertPackageWithSharedUserIdIsPrivileged) could allow local elevation of privilege by executing arbitrary code as a privileged app, without extra privileges or user interaction. Impact is described as high (CVE-20...

CVE-2024-23704

CVE-2024-23704 is an elevation-of-privilege vulnerability in Android’s WifiDialogActivity.onCreate that bypasses DISALLOW_ADD_WIFI_CONFIG due to a missing permission check. Exploitation requires local access with no user interaction; no remote vector is described. Multiple connected sources (NVD,...

CVE-2024-0026

CVE-2024-0026 corresponds to a DoS in Android’s SnoozeHelper.java, causing a persistent denial of service through resource exhaustion. Affected component: Android framework/system code on Google Android. Impact: local DoS with no extra execution privileges and no user interaction required. Source...

CVE-2024-23694

CVE-2024-23694 is an Android Bluetooth elevation-of-privilege issue reported in Pixel/Android bulletins. The connected OSV entry details a use-after-free in a paired Bluetooth LE audio device that can enable code execution with no user interaction, on affected Pixel and non-Pixel Android devices....

CVE-2023-31234

CVE-2023-31234: Tilda Publishing WordPress plugin

CVE-2023-27280

IBM Aspera Orchestrator 4.0.1 is affected by CVE-2023-27280, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt sensitive information. The IBM security bulletin for CVEs 2023-27280/27283/27281 states impact on 4.0.1 and recommends upgrading to 4.0.1 PL2 (Linux)...

CVE-2023-27281

CVE-2023-27281 is impactfully documented in IBM’s bulletin for IBM Aspera Orchestrator 4.0.1, where the vulnerability manifests as observable response discrepancies that could allow a remote attacker to enumerate usernames. The connected IBM doc confirms affected product/version and describes the...

Healthcare Needs To Be Laser-Focused on API Security and Its Blind Spots

API-powered tools can enhance patient access to healthcare services, but these tools also introduce risk. Learn how to protect your organization...

CVE-2024-26322

Technical details for CVE-2024-26322 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

CVE-2024-26325

CVE-2024-26325 is associated with ownCloud

CVE-2024-26321

CVE-2024-26321 pertains to vulnerabilities in ownCloud as documented by a pending CVE placeholder linked to real fixes. The connected advisory indicates an Authentication Bypass Using Pre-signed URLs in ownCloud, where improper validation may allow an attacker to bypass authentication and access ...

CVE-2024-26326

OwnCloud

CVE-2024-24710

CVE-2024-24710 affects WordPress plugin Feed Them Social (SlickRemix) up to version 4.2.0. The issue is a missing authorization vulnerability (broken access control) that could enable unauthorized actions on affected sites. The CVE entry notes updated versions and references Patch Stack indicatin...

CVE-2023-44472

CVE-2023-44472: Unyson WordPress plugin (<= 2.7.28) contains a Missing Authorization/Broken Access Control vulnerability. Root cause is missing authorization checks; impact is limited by documented scope (Unyson

CVE-2023-44446

CVE-2023-44446 affects GStreamer’s MXF demuxer (gstreamer1-plugins-bad-free, among others). The vulnerability is a use-after-free during MXF file parsing caused by not validating an object’s existence before operating on it. This can allow an attacker to execute code in the context of the affecte...

CVE-2023-44444

CVE-2023-44444 affects GIMP (PSP parsing). Craft data in PSP files can trigger an off-by-one when writing into a heap-based buffer, enabling remote code execution in the process context. Exploitation requires user interaction (visiting/opening a malicious file). The issue is confirmed by ZDI-Can-...

CVE-2023-44443

CVE-2023-44443 describes a Remote Code Execution in GIMP via PSP file parsing. The root cause is lack of validation of PSP data, causing an integer overflow during memory write. Impact is high: attacker-controlled code executed with the current process, with UI interaction required (user must ope...