1384 matches found
CVE-2024-24873
CVE-2024-24873 : Improper Control of Interaction Frequency in CodePeople CP Polls allows a polling limit bypass (flooding) in versions up to 1.0.71 . A fix is available in version 1.0.72 . The CVSS v3.1 base score is 5.3 (Medium) , with unauthenticated access required. Public exploitation status ...
CVE-2024-24874
CVE-2024-24874 affects WordPress plugin CP Polls up to version 1.0.71, where unauthenticated content injection is possible due to insufficient validation of poll answers. The vulnerability is categorized as Content Injection with a low CVSS (5.3) and is mitigated by upgrading to version 1.0.72, w...
CVE-2024-25595
CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...
CVE-2023-41955
CVE-2023-41955 is an Improper Privilege Management vulnerability in the WordPress plugin Essential Addons for Elementor (WPDeveloper). The flaw enables Privilege Escalation for authenticated users (Contributor/above) across versions up to 5.8.8 . The NVD entry lists a CVSS v3.1 base score of 8.8 ...
CVE-2023-38399
CVE-2023-38399 concerns a Local File Inclusion (path traversal) in WordPress plugin Phlox Portfolio by Averta. The vulnerability affects Phlox Portfolio versions up to 2.3.1 and is exploitable without authentication due to improper limitation of a pathname to a restricted directory. Patchstack an...
CVE-2023-37888
CVE-2023-37888 affects the WordPress plugin Shortcodes and extra features for Phlox theme . It is a Path Traversal (PHP Local File Inclusion) vulnerability that allows unauthenticated attackers to include local files. Affected versions are up to and including 2.14.0; the vendor/maintainer fixed i...
CVE-2023-25050
The Shortcodes Ultimate WordPress plugin (versions through 5.12.6 ) is vulnerable to an Absolute Path Traversal vulnerability. This flaw allows an attacker with Contributor privileges to perform an Arbitrary File Download , potentially exposing sensitive data. The root cause is an improper limita...
CVE-2023-23645
CVE-2023-23645 affects the WordPress plugin MainWP Code Snippets Extension (versions
GHSA-76W8-MQX4-WJRF Doctrine DBAL SQL injection possibility
The identifier quoting in Doctrine DBAL has a potential security problem when user-input is passed into this function, making the security aspect of this functionality obsolete. If you make use of AbstractPlatform::quoteIdentifier or Doctrine::quoteIdentifier please upgrade immediately. The ORM...
Doctrine DBAL SQL injection possibility
The identifier quoting in Doctrine DBAL has a potential security problem when user-input is passed into this function, making the security aspect of this functionality obsolete. If you make use of AbstractPlatform::quoteIdentifier or Doctrine::quoteIdentifier please upgrade immediately. The ORM...
CVE-2021-32026
CVE-2021-32026 affects the NATS server (nats-server) prior to version 2.2.3. The issue arises when TLS parameters are supplied via CLI flags, which overrides the default restricted ciphersuite settings and allows negotiation of all ciphersuites supported by Go. The documented impact is potential ...
CVE-2023-33327
CVE-2023-33327 refers to a high-severity Privilege Escalation in the WordPress Leyka plugin (versions
CVE-2024-27281
A vulnerability exists in RDoc versions 6.3.3 through 6.6.2 , distributed in Ruby 3.x through 3.3.0 . The root cause is a lack of restrictions on classes that can be restored when parsing .rdoc_options as a YAML file , which can lead to object injection and remote code execution (RCE) . This impa...
CVE-2024-27280
A buffer-overread vulnerability exists in the StringIO component of the Ruby programming language. The issue is caused by the ungetbyte and ungetc methods, which can read past the end of a string; a subsequent call to StringIO.gets may then return the resulting memory value. This affects Ruby 3.0...
CVE-2023-41651
CVE-2023-41651 corresponds to a WordPress plugin vulnerability in the Multi-column Tag Map plugin (versions
CVE-2024-0042
Technical details are not publicly available in the provided documents. No affected products/versions or remediation specifics are listed. Monitor for updates.
CVE-2024-0022
CVE-2024-0022 affects Android’s CompanionDeviceManagerService.java. The issue is improper input validation that can cause a NotificationAccessConfirmationActivity to be launched for another user profile, enabling local information disclosure without extra privileges and without user interaction. ...
CVE-2024-0027
The CVE-2024-0027 issue affects Google Android’s SnoozeHelper.java, where multiple methods can exhaust resources and cause a local boot loop/denial of service. Vulnerability details across connected sources consistently describe a DoS resulting from resource exhaustion with no extra privileges an...
CVE-2024-23694
CVE-2024-23694 is an Android Bluetooth elevation-of-privilege issue reported in Pixel/Android bulletins. The connected OSV entry details a use-after-free in a paired Bluetooth LE audio device that can enable code execution with no user interaction, on affected Pixel and non-Pixel Android devices....