Archive
3 May 2024
Vulnerabilities first published on this day (UTC), newest first.
847 results · Feed
-
Medium 5.5
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cg…
-
High 7.8
peci: cpu: Fix use-after-free in adev_release()
In the Linux kernel, the following vulnerability has been resolved: peci: cpu: Fix use-after-free in adev_release() When auxiliary_device_add() returns an error, auxiliary_device_uninit() is called, which causes refcount for device to be decremented and .rele…
-
Low 2.8
An Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-…
-
Low 2.8
An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterpr…
-
Medium 6.3
A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitatio…
-
Medium 5.5
An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local a…
-
Medium 6.5
An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local applicati…
-
Medium 4.4
An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized a…
-
Medium 5.1
A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to…
-
Low 2.8
A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to …
-
Low 2.8
An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker…
-
Medium 4.4
An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local att…
-
Medium 4.8
An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malici…
-
Medium 5.0
A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to …
-
Medium 5.0
An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker t…
-
Medium 6.1
A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local a…
-
Medium 5.0
An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application th…
-
Low 2.8
An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker…
-
Medium 5.0
An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attack…
-
Medium 5.1
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the use…
-
High 7.4
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 cores, th…
-
Medium 6.7
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give the…
-
High 7.6
Use after free in C++ protobuf
The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already …
-
Critical 9.8
SQL injection vulnerability in Gescen
SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the pass parameter and retrieve all the data stored in the database.
-
High 7.8
Unquoted path or search item vulnerability in SugarSync
Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation.
-
High 7.8
Deserialization of Untrusted Data in sagemaker-python-sdk
sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pick…
-
High 7.8
Command Injection in sagemaker-python-sdk
sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Op…
-
Critical 9.7
Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox
PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entri…
-
Medium 4.8
tqdm CLI arguments injection attack
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had be…
-
Low 2.5
Degraded secret zeroization capabilities in vodozemac
vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization cap…
-
Medium 4.3
WordPress Exclusive Addons for Elementor plugin <= 2.6.9.1 - Broken Access Control on Post Duplication vulnerability
Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1.
-
Medium 4.3
WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
-
Medium 6.5
WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1.
-
Medium 5.3
WordPress Democracy Poll plugin <= 6.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3.
-
Medium 4.3
WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability
Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21.
-
Medium 6.3
WordPress SP Project & Document Manager plugin <= 4.69 - Broken Access Control vulnerability
Missing Authorization vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.69.
-
Medium 4.3
WordPress Embed Google Fonts plugin <= 3.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0.
-
Medium 5.3
WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6.
-
Medium 6.5
WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3.
-
Medium 4.3
WordPress Progressive WordPress (PWA) plugin <= 2.1.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13.