644 matches found
CVE-2022-1736
CVE-2022-1736 affects Ubuntu systems where the gnome-control-center configuration allowed Remote Desktop Sharing to be enabled by default. The root cause is the gnome-control-center setup permitting RDP sharing to be active upon login, resulting in potential unauthorized remote access with high i...
CVE-2024-27256
CVE-2024-27256 affects IBM MQ Container images: CD v3.0.0, v3.0.1, v3.1.0–3.1.3; LTS v2.0.0–2.0.22; and 2.4.0–2.4.8, 2.3.0–2.3.3, 2.2.0–2.2.2. Description: use of weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Connected sources corro...
CVE-2024-31906
IBM Automation Decision Services 23.0.2 contains an information-disclosure vulnerability where web pages can be stored locally and read by another user on the same system. Affected product/version: IBM Automation Decision Services 23.0.2. Root cause: storage of web content locally enabling access...
CVE-2018-9406
CVE-2018-9406 concerns a vulnerability in NlpService where a missing permission check could allow access to location information, enabling local privilege escalation without additional execution privileges. The exploit requires only local access and does not require user interaction. Affected com...
CVE-2018-9447
CVE-2018-9447 affects Android devices (Pixel/Nexus context) via a vulnerability in EmergencyCallbackModeExitDialog.java where a missing null check in onCreate can crash emergency callback mode, enabling local denial of service without extra privileges. Descriptions across multiple sources confirm...
CVE-2018-9375
CVE-2018-9375 affects Google Android’s UserDictionaryProvider.java, enabling a confused deputy to add/delete words in the user dictionary and cause local privilege escalation without extra execution privileges. Public sources (Android Pixel/Nexus bulletin) list this as a local, low-ex Complexity ...
CVE-2023-27531
CVE-2023-27531 affects the Kredis JSON deserialization path. Vulnerable: Kredis versions prior to 1.3.0.1 where untrusted JSON data can be deserialized, potentially leading to deserialization of unexpected objects. Impact: any applications using Kredis with JSON are affected. Mitigation: upgrade ...
CVE-2023-23913
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method,...
CVE-2024-27980
CVE-2024-27980 affects Node.js where improper handling of batch files in child_process.spawn/spawnSync allows a malicious command line argument to inject arbitrary commands and achieve code execution even when shell is not enabled. The issue is documented across multiple feeds (Node.js CVE entry,...
CVE-2023-28120
CVE-2023-28120 affects ActiveSupport: invoking the new bytesplice method on a SafeBuffer with untrusted input can lead to cross-site scripting (CWE-79). Connected sources confirm the vulnerability exists, but the provided documents do not specify affected versions or a fixed patch version. There ...
CVE-2023-35685
CVE-2023-35685 describes a logic error in DevmemIntMapPages within the file devicemem_server.c that can cause a physical page use-after-free. This USE-After-FREE condition could enable local privilege escalation in the kernel without requiring additional execution privileges or user interaction. ...
CVE-2024-5594
OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs...
CVE-2023-23672
CVE-2023-23672 concerns WordPress plugin GiveWP (Liquid Web/StellarWP) up to version 2.25.1, with a Missing Authorization vulnerability in a function affecting content deletion. The issue allows an authenticated user with Contributor privileges to delete arbitrary content due to insufficient auth...
CVE-2023-45633
CVE-2023-45633 describes a Missing Authorization vulnerability (Broken Access Control) in WordPress IMPress Listings plugin (versions n/a–2.6.2). The root cause is incorrectly configured access control security levels, enabling unauthenticated users to access restricted functionality. Reported CV...
CVE-2023-47807
CVE-2023-47807 — Missing Authorization in WordPress plugin 10WebAnalytics (
CVE-2023-48739
CVE-2023-48739 affects the Porto Theme - Functionality WordPress plugin (pre-2.12.1). The issue is a Missing/Broken Access Control vulnerability allowing unauthenticated access due to incorrectly configured authorization. The CVSSv3.1 base score is 5.3 (Medium) with Low availability impact per Pa...
CVE-2023-47689
CVE-2023-47689 corresponds to a Missing Authorization (Broken Access Control) issue in the WordPress Animator plugin (versions <= 3.0.10) where unauthenticated users can change plugin settings. The vulnerability is documented with CVSS 3.1/6.5 (Medium) and is explicitly mitigated by a fix in v...
CVE-2023-47241
CVE-2023-47241 relates to a Missing Authorization / Broken Access Control vulnerability in the CoCart – Headless ecommerce plugin (WordPress) up to version 3.11.2. Public sources (Patchstack, RH, NVD) confirm unauthenticated access level with an attacker able to exploit improper access control. T...
CVE-2023-47225
CVE-2023-47225 affects the WordPress Short URL plugin (shorten-url) version 1.6.8 and earlier. The issue is a Missing Authorization/broken access control allowing exploitation via multiple AJAX functions, as documented in Patchstack and CVE records. Public details consistently state affected vers...