Archive
1 July 2024
Vulnerabilities first published on this day (UTC), newest first.
121 results · Feed
-
Critical 9.8
In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esc…
-
Critical 9.8
In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privileg…
-
High 7.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
High 7.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
High 7.2
CHANGING Mobile One Time Password - Arbitrary File Upload
CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.
-
Medium 4.9
CHANGING Mobile One Time Password - Arbitrary File Reading
CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.
-
Medium 4.0
"Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may…
-
High 7.3
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerabilit…
-
Critical 9.8
ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability a…
-
Medium 6.3
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerab…
-
Medium 6.3
@cat5th/key-serializer Prototype Pollution vulnerability
harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Medium 6.5
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerabil…
-
Critical 9.8
2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows …
-
Critical 10.0
robinweser fast-loops vulnerable to prototype pollution
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
High 8.1
che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerabilit…
-
Critical 9.8
cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability all…
-
Critical 9.8
agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vu…
-
Medium 6.3
ag-grid packages vulnerable to Prototype Pollution
ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
High 7.5
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in au…
-
Critical 10.0
An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attacker…
-
Medium 6.5
adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerabili…
-
Critical 9.8
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. Th…
-
High 8.8
frappejs was discovered to contain a prototype pollution via the function registerView
airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
High 7.3
@amoy/common v was discovered to contain a prototype pollution via the function extend
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Critical 10.0
jrburke requirejs vulnerable to prototype pollution
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Critical 9.8
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability…
-
High 8.8
akbr patch-into was discovered to contain a prototype pollution via the function patchInto
akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Medium 6.3
Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability…
-
Critical 9.8
Prototype pollution in ag-grid-community via the _.mergeDeep function
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary pr…
-
Medium 6.3
@aofl/cli-lib Prototype Pollution vulnerability
aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Medium 6.1
phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_c…
-
Medium 6.5
adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Medium 6.6
FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.
-
High 8.4
FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column.
-
High 7.8
FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 i…
-
Medium 5.4
Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows …
-
High 8.8
Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to m…
-
High 8.8CVE-2024-37765 Public exploit
Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
-
Critical 9.9CVE-2024-37762 Public exploit
MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code executi…
-
Medium 5.4CVE-2024-37763 Public exploit
MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid …