Archive
6 May 2024
Vulnerabilities first published on this day (UTC), newest first.
151 results · Feed
-
Medium 6.1
html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization
html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted …
-
High 7.5CVE-2024-34069 Public exploit
Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…
-
Medium 5.4CVE-2024-34064 Public exploit
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…
-
High 8.2
Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows at…
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when the IOCTL call is interrupted by a signal.
-
High 8.4
Improper Access Control in Graphics Linux
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
-
High 7.3
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while playing audio file having large-sized input buffer.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
-
High 7.8
Improper Input Validation in Secure Processor
Memory corruption when the channel ID passed by user is not validated and further used.
-
High 7.8
Use of Out-of-range Pointer Offset in Video
Memory corruption when the payload received from firmware is not as per the expected protocol size.
-
High 8.4
Stack-based Buffer Overflow in PMIC
Memory corruption when size of buffer from previous call is used without validation or re-initialization.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
-
High 8.4
Access of Uninitialized Pointer in SPS Applications
Memory corruption while verifying the serialized header when the key pairs are generated.
-
Medium 5.9
Integer Overflow or Wraparound in HLOS
Memory corruption in HLOS while checking for the storage type.
-
High 7.5
Reachable Assertion in Data Modem
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
-
Medium 6.8
Buffer Over-read in Video
Information disclosure while parsing dts header atom in Video.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
-
Medium 6.7
Use After Free in HLOS
Memory corruption when multiple listeners are being registered with the same file descriptor.
-
High 8.4
Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
-
High 7.5
go-ethereum denial of service via malicious p2p message
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix ha…
-
High 7.5
Delta Electronics DIAEnergie SQL Injection
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQ…
-
Critical 9.8
Delta Electronics DIAEnergie Unauthenticated SQL Injection
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform …
-
High 8.3
NPort 5100A Series Store XSS Vulnerability
The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the vulnerabil…
-
Medium 5.5
CODESYS: Use after free vulnerability through corrupted project files
An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.
-
High 7.8
CODESYS: Out-of-bounds write through corrupted project files
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
-
Medium 6.4
Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom postmeta output in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping on user supplied post meta fields. …
-
Medium 5.3
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user …
-
Medium 6.5
Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the user…
-
Medium 6.5
Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "s…
-
Medium 6.5
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mob…
-
Low 2.4
SourceCodester Prison Management System user-record.php cross site scripting
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Admin/user-record.php. The manipulation of the argument txtfullname leads to…
-
Low 3.5
Campcodes Complete Web-Based School Management System student_payment_details2.php cross site scripting
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /view/student_payment_details2.php. The manipulation of the argument index leads to cros…
-
Low 3.5
Campcodes Complete Web-Based School Management System student_payment_details3.php cross site scripting
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /view/student_payment_details3.php. The manipulation of the argument month leads to cr…
-
High 7.5
MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF
The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack
-
Medium 5.9
Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disall…
-
Medium 5.4
MF Gig Calendar <= 1.2.1 - Editor+ Stored XSS
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…