Archive
July 2024
Vulnerabilities first published in this month (UTC), newest first.
131 results · Clear filters · Feed
-
Low 3.3
Improper permission control in com.android.server.telecom
Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.
-
Low 2.7
An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted req…
-
Low 3.7
Linkerd potential access to the shutdown endpoint
Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests…
-
Low 3.1
Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user i…
-
Low —
RISC Zero zkVM notes on zero-knowledge
RISC Zero zkVM was designed from its inception to provide three main guarantees: 1. *Computational integrity*: that a given software program executed correctly. 2. *Succinctness*: that the proof of execution does not grow in relation to the program being exec…
-
Low 2.6
LaTeX post content manipulation via renderer state leak across contexts
Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions.
-
Low 3.1
Loss of confidentiality due to potential race condition in Bluetooth controller Connection_Handle reuse
Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK:…
-
Low 2.7
Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group mem…
-
Low 3.8
Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens.
-
Low 3.3
Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacke…
-
Low 2.4
SourceCodester Employee and Visitor Gate Pass Logging System Master.php save_designation cross site scripting
A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the function save_designation of the file /classes/Master.php. The manipulation leads to cross site scriptin…
-
Low 3.1
Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerabi…
-
Low 3.7
TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App commu…
-
Low 2.9
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…
-
Low 3.5
PingFederate REST API Data Store Injection
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
-
Low 1.8
PingFederate OIDC Policy Management Editor Cross-Site Scripting
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
-
Low 3.1
Networkmanager: denial of service
A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of serv…
-
Low 3.9
An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7…
-
Low 3.1
An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, …
-
Low 3.3
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (…
-
Low 3.8
WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerability
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.
-
Low 2.7
WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
-
Low 3.5
WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.
-
Low 3.3
[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now
Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables which might be downloaded and executed by the user which could host malware. On successful exploita…
-
Low 2.0
Undici vulnerable to data leak when using response.arrayBuffer()
Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
-
Low 2.3
/n software IPWorks SSH insufficient file access verification
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user acc…
-
Low —
yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
### Impact yt-dlp's DouyuTV and DouyuShow extractors used a `cdn.bootcdn.net` URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it ext…
-
Low 3.3
Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local att…
-
Low 3.5
heyewei SpringBootCMS Guestbook guestbook cross site scripting
A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of the component Guestbook Handler. The manipulation of the argument Content leads to cross site scripti…
-
Low 3.5
WordPress Academy LMS plugin <= 2.0.4 - Open Redirection vulnerability
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
-
Low 2.3
The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a …
-
Low —
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
### Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. ### Patches The issue first appe…
-
Low 3.5
CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting
A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie lead…
-
Low 2.7
D-Link DAR-7000 decodmail.php deserialization
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to …
-
Low 3.5
ZKTeco BioTime system-group-add cross site scripting
A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input <script>alert('XSS')</script> leads…
-
Low 3.8
Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file.…
-
Low 3.5
y_project RuoYi Content-Type isJsonRequest cross site scripting
A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross si…
-
Low 3.1
Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information
Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information.
-
Low 3.1
Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible fo…
-
Low 2.4
Discourse doesn't limit reviewable user serializer payload
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the All…