CVE-2023-34401

CVE-2023-34401 affects Mercedes-Benz head-unit NTG6. USB-based profile import/export can process UD2-encoded files; missing size checks in enapsulate file enable an out-of-bounds read on the heap. Connected sources describe the vulnerability across multiple feeds (nvd/nvd-derived entries, Red Hat...

CVE-2023-34401

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory...

PT-2025-23640

Name of the Vulnerable Software and Affected Versions Jupyter Core versions prior to 5.8.0 Description The issue affects Jupyter Core on Windows, where the shared %PROGRAMDATA% directory is searched for configuration files, potentially allowing users to create files that impact other users. This ...

The vulnerability of the System Settings component in MacOS operating systems allows a hacker to overwrite arbitrary files.

The vulnerability of the System Settings component in MacOS operating systems is related to reading beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to overwrite arbitrary files...

JetBrains TeamCity < 2024.12.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2024.12.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab CVE-2025-26493 - In JetBrains TeamCity befor...

CVE-2025-25744

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module...

CVE-2025-25743

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module...

CVE-2024-13437

The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

CVE-2024-13437

The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

CVE-2024-13437 Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update

The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

CVE-2024-13528

CVE-2024-13528 : The Customer Email Verification for WooCommerce plugin (WordPress) is vulnerable to an authentication bypass. An attacker with Contributor+ privileges can generate a verification link for any unverified user via a shortcode that creates a confirmation link with a placeholder emai...

CVE-2024-13769

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...

CVE-2024-12164

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...

CVE-2024-12164 WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...

CVE-2024-12164 WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...

CVE-2024-13769

CVE-2024-13769 – Puzzles theme (WP Magazine / Review with Store WordPress Theme + RTL) Vulnerability: Stored Cross-Site Scripting due to a missing capability check on the theme_options_ajax_post_action AJAX action. Affected versions: all versions up to and including 4.2.4. Impact: Authenticated a...

CVE-2024-13749

The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

D-Link DIR-853 安全漏洞

The D-Link DIR-853 is a router from China-based AUO D-Link. The D-Link DIR-853 suffers from a buffer overflow vulnerability that stems from the Password parameter in the SetDynamicDNSSettings module not properly handling user input. No details of the vulnerability are provided at this time...

Easy!Appointments 安全漏洞

Easy!Appointments is a web-based appointment and schedule management system by Alex Tselegidis, a personal developer. A security vulnerability exists in Easy!Appointments v1.5.0, which stems from the unfiltered legalsettings parameter, making it susceptible to cross-site scripting attacks...

PT-2025-6460 · WordPress · Book A Room

Name of the Vulnerable Software and Affected Versions: Book a Room plugin for WordPress versions up to, and including, 2.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'bookaroom Settings' page. This allows unauthenticated...