Archive
11 May 2024
Vulnerabilities first published on this day (UTC), newest first.
28 results · Feed
-
Medium 4.3
DedeCMS path traversal
A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?action=view. The manipulation of the argument filename with the input ../../../../../etc/passwd leads to path traversal: '.…
-
Low 2.7
IBM Security Guardium denial of service
IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service. IBM X-Force ID: 271526.
-
High 7.8
IBM Security Guardium privilege escalation
IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X-Force ID: 271527.
-
Critical 9.1
IBM Security Guardium command injection
IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 271524.
-
Medium 4.3
IBM App Connect Enterprise denial of service
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restrictions of resource allocation. IBM X-Force ID: 285244.
-
Medium 5.4
IBM App Connect Enterprise HTML injection
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security cont…
-
Medium 6.2
The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerabili…
-
Medium 6.4
Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect avai…
-
Medium 6.8
Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect avai…
-
Medium 5.9
NULL pointer access vulnerability in the clock module Impact: Successful exploitation of this vulnerability will affect…
-
Medium 4.1
Race condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affe…
-
High 8.4
Race condition vulnerability in the binder driver module Impact: Successful exploitation of this vulnerability will aff…
-
Medium 6.2
Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will aff…
-
Medium 6.2
Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affe…
-
High 7.1
Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect s…
-
Medium 5.6
Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affe…
-
Medium 4.7
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availabi…
-
Medium 4.7
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availabi…
-
High 7.5
Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability wi…
-
High 7.5
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.1
Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulne…
-
Low 3.3
Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vul…
-
Medium 6.4
Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi…
-
Medium 6.4
Thim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
The Thim Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at…
-
Critical 9.8
Kognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upload_file_to_assistant function in all versions up to, and including, 1.9.9. This makes it possible f…
-
Medium 6.4
Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and…
-
Medium 5.5
Use-After-Free in Service for Hardware Support App for Fingerprint Driver
Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for the Synaptics Hardware Support App.
-
Medium 6.4
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown timer in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escapin…