1380 matches found
CVE-2018-9379
The MiniThumbFile.java component in Google Pixel and Google Nexus smartphones contains a confused deputy vulnerability in multiple functions. This flaw allows an attacker to view thumbnails of deleted photos, leading to local information disclosure without requiring additional execution privilege...
CVE-2018-9383
A buffer overflow vulnerability exists in the asn1_ber_decoder function of asn1_decoder.c , caused by a lack of bounds checking. This flaw can lead to out-of-bounds reads of memory, potentially resulting in local information disclosure . Exploitation requires System execution privileges and does ...
CVE-2024-27980
Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...
CVE-2024-27980
CVE-2024-27980 affects Node.js where improper handling of batch files in child_process.spawn/spawnSync allows a malicious command line argument to inject arbitrary commands and achieve code execution even when shell is not enabled. The issue is documented across multiple feeds (Node.js CVE entry,...
CVE-2023-27539
CVE-2023-27539 concerns a denial-of-service vulnerability in the header parsing component of Rack (Ruby Rack). The issue is described as a vulnerability in Rack's header parsing that can affect applications parsing HTTP headers with Rack, leading to potential DoS. The NVD metrics show a MEDIUM-se...
CVE-2023-28120
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input...
CVE-2023-38037
CVE-2023-38037 affects Rails’ ActiveSupport::EncryptedFile, which writes data to a temporary file with permissions derived from the user’s umask. The temporary file could be readable by other users on the same system while a user edits it, enabling local information disclosure. Public documents f...
CVE-2023-35685
CVE-2023-35685 describes a logic error in DevmemIntMapPages within the file devicemem_server.c that can cause a physical page use-after-free. This USE-After-FREE condition could enable local privilege escalation in the kernel without requiring additional execution privileges or user interaction. ...
CVE-2024-5594
OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs...
CVE-2024-5594
OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs...
CVE-2023-47778
CVE-2023-47778 concerns LuckyWP Scripts Control for WordPress. The vulnerability is a Missing Authorization/Broken Access Control issue in LuckyWP Scripts Control versions
CVE-2023-47807
CVE-2023-47807 — Missing Authorization in WordPress plugin 10WebAnalytics (
CVE-2023-48739
CVE-2023-48739 affects the Porto Theme - Functionality WordPress plugin (pre-2.12.1). The issue is a Missing/Broken Access Control vulnerability allowing unauthenticated access due to incorrectly configured authorization. The CVSSv3.1 base score is 5.3 (Medium) with Low availability impact per Pa...
CVE-2023-48758
CVE-2023-48758 affects Crocoblock JetEngine WordPress plugin. Versions
CVE-2023-47693
CVE-2023-47693 affects Themefic Ultimate Addons for Contact Form 7 (plugin:Ultimate Addons for Contact Form 7) up to version 3.2.6. The issue is a Broken Access Control allowing unauthenticated access due to misconfigured authorization. CVSS v3.1 base score cited as 7.5 (HIGH). Patch guidance fro...
CVE-2023-47692
CVE-2023-47692 is a WordPress Flo Forms plugin vulnerability (affected versions
CVE-2023-47689
CVE-2023-47689 corresponds to a Missing Authorization (Broken Access Control) issue in the WordPress Animator plugin (versions <= 3.0.10) where unauthenticated users can change plugin settings. The vulnerability is documented with CVSS 3.1/6.5 (Medium) and is explicitly mitigated by a fix in v...
CVE-2023-47661
CVE-2023-47661 affects Dragfy Addons for Elementor (WordPress) and is a Missing Authorization/Broken Access Control issue. Affected versions are Dragfy Addons for Elementor