Archive
16 February 2024
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
High 7.6
Insufficient Session Expiration in alf.io
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade.…
-
High 7.4CVE-2024-0023 Public exploit
In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds c…
-
High 8.4
In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer over…
-
High 7.0
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to e…
-
High 8.3
GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`
# GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219` The [GitHub Security Lab](https://securitylab.github.com) team has identified potential security vulnerabilities in [scrypted](https://github.com/koush/scrypted). We…
-
High 8.4
In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This …
-
High 7.8CVE-2024-0015 Public exploit
In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to…
-
High 8.3
SQL Injection
Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.
-
High 7.2
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticate…
-
High 8.6
Publicly Known Cryptographic Machine Key In Procura Portal Application
Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.
-
High 8.4
In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic erro…
-
High 7.5CVE-2024-0040 Public exploit
In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead…
-
High 8.4
In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injecti…
-
High 7.4
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on …
-
High 7.4
In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to…
-
High 8.4
In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lea…
-
High 7.8
In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to B…
-
High 7.1
In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic…
-
High 8.4
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic erro…
-
High 7.5
An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to th…
-
High 8.1
An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information…
-
High 7.2CVE-2024-25415 EPSS 27%
A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to e…
-
High 7.3CVE-2024-25466 Public exploit
React Native Document Picker Directory Traversal vulnerability
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.