3587 matches found
CVE-2019-10497
Use after free issue occurs If another instance of open for voicesvc node has been called from application without closing the previous one. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in...
CVE-2013-2123
The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author's user account is deleted, which allows remote attacke...
CVE-2025-47942
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the pythonlib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course...
CVE-2025-37928 dm-bufio: don't schedule in atomic context
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIGDEBUGATOMICSLEEP and tryverifyintasklet are enabled. 129.444685 T934 BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:24...
Agency Problems and Adversarial Bilevel Optimization under Uncertainty and Cyber Threats
We study an agency problem between a holding company and its subsidiary, exposed to cyber threats that affect the overall value of the subsidiary. The holding company seeks to design an optimal incentive scheme to mitigate these losses. In response, the subsidiary selects an optimal cybersecurity...
CVE-2024-33939
The Masteriyo - LMS WordPress plugin (versions
CVE-2025-4838 kanwangzjm Funiture Login LoginServlet.java doPost redirect
A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b. Affected is the function doPost of the file /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java of the component Login. The manipulation of t...
CVE-2025-31063 WordPress Wishlist <= 2.1.0 - Broken Access Control Vulnerability
Missing Authorization vulnerability in redqteam Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Wishlist: from n/a through 2.1.0...
Optimal Allocation of Privacy Budget on Hierarchical Data Release
Releasing useful information from datasets with hierarchical structures while preserving individual privacy presents a significant challenge. Standard privacy-preserving mechanisms, and in particular Differential Privacy, often require careful allocation of a finite privacy budget across differen...
CVE-2024-2643
The My Sticky Bar (also known as Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any) WordPress plugin versions before 2.6.8 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plug...
CVE-2024-3062
The Save as Image Plugin by Pdfcrowd for WordPress (versions prior to 3.2.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS a...
CVE-2024-1663
The Ultimate Noindex Nofollow Tool II WordPress plugin versions prior to 1.3.6 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform X...
CVE-2024-0852
The coreActivity: Activity Logging plugin for WordPress (versions prior to 1.8.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly escape certain request data when it is outputted back in the admin dashboard. This flaw allows unauthenticated ...
CVE-2023-7228
The illi Link Party! WordPress plugin, specifically version 1.0 and earlier, is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly sanitise and escape certain parameters. This flaw allows unauthenticated visitors to perform XSS att...
CVE-2023-7230
The illi Link Party! WordPress plugin versions 1.0 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain parameters. This vulnerability allows users with a role as low as admin to execute XSS attacks. To remediate th...
CVE-2023-7229
The illi Link Party! WordPress plugin, affecting version 1.0 and earlier, contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw exists because the plugin lacks proper CSRF checks when updating its settings, which could allow an attacker to modify these settings via a logged-in admi...
CVE-2023-7195
The WP-Reply Notify WordPress plugin (versions 1.1 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating settings. An attacker could leverage this to perform unauthorized configuration changes on behalf of a logged-in administrator. T...
CVE-2023-7197
The Marketing Twitter Bot WordPress plugin, in versions 1.11 and earlier , is susceptible to a vulnerability where a lack of CSRF checks , combined with missing sanitization and escaping, allows attackers to force logged-in administrators to add Stored XSS payloads via a CSRF attack . To mitigate...
CVE-2023-7196
The Ultimate Noindex Nofollow Tool WordPress plugin, in versions 1.1.2 and earlier , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker to force a logged-in administrator to modify these...
CVE-2023-7088
The Add SVG Support for Media Uploader | inventivo WordPress plugin, affecting versions 1.0.0 through 1.0.5 , contains a vulnerability where uploaded SVG files are not properly sanitized. This allows users with privileges as low as Author to upload malicious SVG files containing XSS payloads , po...