Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
920 results · Clear filters · Feed
-
High 7.8
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error …
-
High 7.8
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into en…
-
High 7.8
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on start…
-
High 7.8
In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without us…
-
High 7.8CVE-2023-20904 Public exploit
In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mism…
-
High 7.8
In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local e…
-
High 7.3CVE-2023-20921 Public exploit
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility se…
-
High 7.8
In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. T…
-
High 7.8
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due…
-
High 7.8
In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. Th…
-
High 7.8
In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to loca…
-
High 7.8
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivilege…
-
High 7.8
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which c…
-
High 7.5
Unauthenticated denial of service
Unauthenticated denial of service
-
High 8.8
SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privilege…
-
High 7.8CVE-2022-45639 Public exploit
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cr…
-
High 7.8
An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running…
-
High 8.8
Arbitrary file write in net.mingsoft:ms-mcms
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
-
High 7.5
A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device v…
-
High 7.8
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource…
-
High 7.8CVE-2022-20493 Public exploit
In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. …
-
High 7.8
In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to …
-
High 7.8
In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to reso…
-
High 7.8
In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resour…
-
High 7.8
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource…
-
High 8.8
Booster for WooCommerce - Multiple CSRF
The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places…
-
High 7.5
WP Limit Login Attempts <= 2.6.4 - IP Spoofing
The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
-
High 7.2
Google Analyticator < 6.5.6 - Admin+ PHP Object Injection
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
-
High 7.2
Google Analyticator < 6.5.6 - Admin+ PHP Object Injection
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
-
High 8.8CVE-2022-4230 EPSS 36%
WP Statistics < 13.2.9 - Authenticated SQLi
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however t…
-
High 7.5
FluentAuth < 1.0.2 - Bypass blocks by IP Spoofing
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
-
High 7.5
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) con…
-
High 8.8
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
High 7.8
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within t…
-
High 8.8
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
High 8.8
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
High 8.8
An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrar…
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability