Archive
5 February 2024
Vulnerabilities first published on this day (UTC), newest first.
157 results · Feed
-
High 7.1
WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reg…
-
High 7.5
In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of…
-
Medium 6.7
In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.7
In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 4.4
In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service …
-
High 7.4
In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalat…
-
Medium 6.7
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation o…
-
High 7.5
In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of…
-
Critical 9.8
In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote…
-
Medium 6.7
In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation o…
-
High 8.8
In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote …
-
High 7.5
In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation o…
-
Medium 6.6
In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 6.5
WordPress Advanced iFrame Plugin <= 2023.10 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.
-
Medium 6.5CVE-2023-51504 Public exploit
WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Stored XSS.This issue affects Dan's Embedder for Google Calendar: from n/a through 1.2.
-
Medium 5.4
Insufficient input validation in VAPIX API create_overlay.cgi
Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator-…
-
Medium 6.3
Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not hav…
-
Critical 9.8
SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the i…
-
High 7.5CVE-2023-47355 Public exploit
The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed bro…
-
Medium 5.4CVE-2024-24397 Public exploit
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.
-
High 7.5
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_subscribe_remove functio…
-
Critical 9.8
Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi all…
-
High 7.5
Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response_append_status_li…
-
High 7.5
freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry funct…
-
Medium 6.1CVE-2024-24396 Public exploit
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the search bar component.
-
High 7.5
gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_…
-
High 7.5
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_uac_stop_timer function …
-
High 8.8
Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via t…
-
High 8.8
Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via t…
-
High 7.5
gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_in…
-
High 7.5
gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /sr…
-
High 7.5
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.
-
Critical 9.8
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
-
Critical 9.8
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution d…
-
High 7.8
Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the er…
-
High 8.8CVE-2024-22567 EPSS 18%
mingSoft MCMS File Upload vulnerability
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.