Archive
7 May 2024
Vulnerabilities first published on this day (UTC), newest first.
186 results · Feed
-
High 7.8
Foxit PDF Editor Underline Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Editor Underline Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerab…
-
High 7.8
Foxit PDF Editor Stamp Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Editor Stamp Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerabilit…
-
High 7.8
Foxit PDF Editor StrikeOut Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Editor StrikeOut Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerab…
-
High 7.8
Foxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution Vulnerability
Foxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vul…
-
High 7.8
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in t…
-
Low 3.3
Foxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure Vulnerability
Foxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit…
-
High 7.8
Foxit PDF Reader Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability
Foxit PDF Reader Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability …
-
Low 3.3
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulne…
-
High 7.8
Foxit PDF Reader Square Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader Square Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerabili…
-
High 8.8
NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability
NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 routers. Authentication is not required to exploit this vu…
-
Medium 6.5
HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized acc…
-
Medium 6.2
IBM Watson CP4D Data Stores information disclosure
IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 264838.
-
Critical 9.8CVE-2024-23708 Public exploit
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a cl…
-
Medium 6.5CVE-2024-23709 Public exploit
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote…
-
High 7.8
In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to loca…
-
High 7.8
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error…
-
High 7.8
In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due…
-
High 7.8
In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a l…
-
Critical 9.8
In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input valida…
-
High 7.4
In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This …
-
High 7.1
tempfile.mkdtemp() may be readable and writeable by all users on Windows
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate conf…
-
High 8.5
Deno contains a permission escalation via open of privileged files with missing `--deny` flag
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/pro…
-
Medium 5.6
In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead…
-
Medium 5.5
In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_acc…
-
High 7.8
In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary a…
-
High 7.8
In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications s…
-
High 7.0
In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due …
-
Medium 4.7
In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion…
-
Medium 5.9
In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. Th…
-
Medium 5.5
In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationA…
-
High 8.1
IBM AIX privilege escalation
IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead to privilege escalation. IBM X-Force ID: 284903.
-
High 7.5
Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap …
-
High 7.5
Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially expl…
-
Medium 6.0
A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, whic…
-
Low 2.8
A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifica…
-
Low 2.2
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password…
-
Low 2.2
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) …
-
High 7.5
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of …
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
Low 3.7
Kimai Session information disclosure
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may…