643 matches found
CVE-2018-9447
CVE-2018-9447 affects Android devices (Pixel/Nexus context) via a vulnerability in EmergencyCallbackModeExitDialog.java where a missing null check in onCreate can crash emergency callback mode, enabling local denial of service without extra privileges. Descriptions across multiple sources confirm...
CVE-2018-9375
CVE-2018-9375 affects Google Android’s UserDictionaryProvider.java, enabling a confused deputy to add/delete words in the user dictionary and cause local privilege escalation without extra execution privileges. Public sources (Android Pixel/Nexus bulletin) list this as a local, low-ex Complexity ...
CVE-2023-27531
CVE-2023-27531 affects the Kredis JSON deserialization path. Vulnerable: Kredis versions prior to 1.3.0.1 where untrusted JSON data can be deserialized, potentially leading to deserialization of unexpected objects. Impact: any applications using Kredis with JSON are affected. Mitigation: upgrade ...
CVE-2023-23913
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method,...
CVE-2024-27980
CVE-2024-27980 affects Node.js where improper handling of batch files in child_process.spawn/spawnSync allows a malicious command line argument to inject arbitrary commands and achieve code execution even when shell is not enabled. The issue is documented across multiple feeds (Node.js CVE entry,...
CVE-2023-28120
CVE-2023-28120 affects ActiveSupport: invoking the new bytesplice method on a SafeBuffer with untrusted input can lead to cross-site scripting (CWE-79). Connected sources confirm the vulnerability exists, but the provided documents do not specify affected versions or a fixed patch version. There ...
CVE-2023-35685
CVE-2023-35685 describes a logic error in DevmemIntMapPages within the file devicemem_server.c that can cause a physical page use-after-free. This USE-After-FREE condition could enable local privilege escalation in the kernel without requiring additional execution privileges or user interaction. ...
CVE-2024-5594
OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs...
CVE-2023-23672
CVE-2023-23672 concerns WordPress plugin GiveWP (Liquid Web/StellarWP) up to version 2.25.1, with a Missing Authorization vulnerability in a function affecting content deletion. The issue allows an authenticated user with Contributor privileges to delete arbitrary content due to insufficient auth...
CVE-2023-45633
CVE-2023-45633 describes a Missing Authorization vulnerability (Broken Access Control) in WordPress IMPress Listings plugin (versions n/a–2.6.2). The root cause is incorrectly configured access control security levels, enabling unauthenticated users to access restricted functionality. Reported CV...
CVE-2023-47807
CVE-2023-47807 — Missing Authorization in WordPress plugin 10WebAnalytics (
CVE-2023-48739
CVE-2023-48739 affects the Porto Theme - Functionality WordPress plugin (pre-2.12.1). The issue is a Missing/Broken Access Control vulnerability allowing unauthenticated access due to incorrectly configured authorization. The CVSSv3.1 base score is 5.3 (Medium) with Low availability impact per Pa...
CVE-2023-47689
CVE-2023-47689 corresponds to a Missing Authorization (Broken Access Control) issue in the WordPress Animator plugin (versions <= 3.0.10) where unauthenticated users can change plugin settings. The vulnerability is documented with CVSS 3.1/6.5 (Medium) and is explicitly mitigated by a fix in v...
CVE-2023-47241
CVE-2023-47241 relates to a Missing Authorization / Broken Access Control vulnerability in the CoCart – Headless ecommerce plugin (WordPress) up to version 3.11.2. Public sources (Patchstack, RH, NVD) confirm unauthenticated access level with an attacker able to exploit improper access control. T...
CVE-2023-47225
CVE-2023-47225 affects the WordPress Short URL plugin (shorten-url) version 1.6.8 and earlier. The issue is a Missing Authorization/broken access control allowing exploitation via multiple AJAX functions, as documented in Patchstack and CVE records. Public details consistently state affected vers...
CVE-2023-47188
CVE-2023-47188 affects the WordPress plugin Simple Job Board (versions
CVE-2023-47187
CVE-2023-47187 affects the WordPress plugin Animated Rotating Words (css3-rotating-words). Root cause: Missing authorization/broken access control allowing exploitation under the plugin’s access levels. Affected versions:
CVE-2023-47183
CVE-2023-47183 refers to a Missing Authorization (Broken Access Control) vulnerability in GiveWP for WordPress. The issue affects GiveWP versions