Archive
13 June 2024
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
Critical 9.8
In wl_notify_rx_mgmt_frame of wl_cfg80211.c, there is a possible out of bounds write due to an integer overflow. This c…
-
Critical 9.8
In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check. …
-
Critical 9.8
In lwis_fence_signal of lwis_debug.c, there is a possible Use after Free due to improper locking. This could lead to lo…
-
Critical 9.8
In BCMFASTPATH of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead …
-
Critical 9.8
HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass.
-
Critical 9.8
Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker
Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privilege escalation. An attacker could exploit this vulnerability to gain access to sensitive informatio…
-
Critical 10.0
Tenable Vulnerability Disclosure | API Auth Bypass
Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated pri…
-
Critical 9.8
XXE can expose crypt key and other secrets granting full admin access
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability …
KEV Jul 17, 2024 -
Critical 9.1
Large attack surface through legit webhook usage in Adobe Commerce
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require us…
-
Critical 9.0
CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection
The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently…
-
Critical 9.8
Web Directory Free < 1.7.0 - Unauthenticated SQL Injection
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based…
-
Critical 10.0
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. T…
-
Critical 9.6
ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.
-
Critical 9.8CVE-2024-31777 Public exploit
File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted fi…
-
Critical 9.8
A SQL Injection vulnerability in itsourcecode Billing System 1.0 allows a local attacker to execute arbitrary code in p…
-
Critical 9.8
TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiBasicC…
-
Critical 9.8
TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiEasyCf…