Archive
2 January 2024
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
Critical 10.0
User Build misconfiguration resulting in local escalation of privilege
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges neede…
-
Medium 6.3
Magic-Api code injection
A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched rem…
-
High 8.6
omniauth-microsoft_graph vulnerable to account takeover (nOAuth)
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it suscept…
-
Critical 10.0
Google Nest WiFi Pro root code-execution & user-data compromise
Google Nest WiFi Pro root code-execution & user-data compromise
-
Medium 5.9
Erroneous handling of `record_external_operation` error return
Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particu…
-
High 8.4
There is a possible information disclosure due to a missing permission check in Pixel Watch
There is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of health data with no additional execution privileges needed.
-
Medium 5.4
XSS can be stored in DB from "add a message form" in order detail page (FO)
PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpre…
-
High 8.1
Some attribute not escaped in Validate::isCleanHTML method
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3…
-
Medium 6.3
spider-flow FunctionController.java FunctionService.saveFunction code injection
A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It …
-
Medium 6.3
CodeAstro Internet Banking System Profile Picture pages_account.php unrestricted upload
A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0. This issue affects some unknown processing of the file pages_account.php of the component Profile Picture Handler. The manipulation leads to unre…
-
Critical 9.8
Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets
OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remo…
-
Medium 6.1
OWASP.AntiSamy mXSS when preserving comments
OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanit…
-
Medium 5.7
`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access
vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the crate for `…
-
Medium 6.3
RRJ Nueva Ecija Engineer Online Portal Add Downloadable downloadable.php unrestricted upload
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file downloadable.php of the component Add Downloadable. The manipulation leads to unr…
-
Medium 6.7
The logic of get apk path in KernelSU module can be bypassed
KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module…
-
Medium 5.3
RRJ Nueva Ecija Engineer Online Portal file information disclosure
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/uploads/. The manipulation leads to file and directory information exposure. It is possible to l…
-
Medium 5.5
Kernel: refcount leak in ctnetlink_create_conntrack()
A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.
-
Critical 10.0
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoP
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
-
High 7.5
Predictable SSH credentials in Priva TopControl Suite
The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.
-
Low 3.5
RRJ Nueva Ecija Engineer Online Portal Quiz add_quiz.php cross site scripting
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file add_quiz.php of the component Quiz Handler. The manipulation of the argument Quiz Title/Quiz Descript…
-
High 7.8
Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation
A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or …
-
Low 3.5
RRJ Nueva Ecija Engineer Online Portal Create Message teacher_message.php cross site scripting
A vulnerability has been found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file teacher_message.php of the component Create Message Handler. The manipulation of the argument Conte…
-
Critical 9.3
Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
-
Low 3.5
Acumos Design Studio cross site scripting
A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is a…
-
Low 3.1
RRJ Nueva Ecija Engineer Online Portal change_password_teacher.php weak password
A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initia…
-
Low 2.6
Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting
A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument messa…
-
Low 3.5
rt-prettyphoto Plugin rt-prettyphoto.php royal_prettyphoto_plugin_links cross site scripting
A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The …
-
Critical 9.8
SQLi in Ekol Bilisim Website Template
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.
-
Medium 4.3
Details of archived public channels are leaked to members of another team
Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.
-
Low 3.7
Lack of restriction to manage group names for freshly demoted guests
Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.
-
Medium 4.3
Keywords that trigger mentions are leaked to other users
Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.
-
Medium 4.9
Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()
A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could …
-
Medium 4.0
multimedia audio has a UAF vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer.
-
Medium 4.0
multimedia player has a UAF vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer.
-
Medium 4.0
multimedia player has a UAF vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer.
-
Medium 4.0
multimedia camera has a UAF vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer.
-
Low 2.9
Liteos-A has a missing release of resource vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources
-
High 8.4
Use After Free in DSP Services
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
-
High 7.5
Buffer Over-read in Qualcomm ESL
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
-
High 7.5
Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.