Archive
7 August 2024
Vulnerabilities first published on this day (UTC), newest first.
53 results · Clear filters · Feed
-
Medium 6.1CVE-2024-6892 Scanner template
Journyx Reflected Cross Site Scripting
Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.
-
Medium 6.3
Open WebUI Stored Cross-Site Scripting
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.
-
Medium 6.7
Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object cre…
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…
-
Medium 5.4
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…
-
Medium 5.5
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta…
-
Medium 6.3
Alien Technology ALR-F800 system.html os command injection
A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami …
-
Medium 6.3
Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection
A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of t…
-
Medium 6.3
Jenkins does not perform a permission check in an HTTP endpoint
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
-
Medium 4.9
Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters
The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes …
-
Medium 5.4
Accept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode
The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's accept_stripe_payment_ng shortcode in all versions up to, and including, 2.0.86 due to insufficient input sanitization and output escaping on user su…
-
Medium 4.3
Apache CloudStack: Unauthorised Network List Access
In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to…
-
Medium 6.1
WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
-
Medium 4.8
House Manager <= 1.0.8.4 - Reflected XSS
The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Medium 5.3
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to a…
-
Medium 5.0
Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to p…
-
Medium 4.0
Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to…
-
Medium 4.0
Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to acces…
-
Medium 4.0
Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker t…
-
Medium 4.0
Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access…
-
Medium 4.0
Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthor…
-
Medium 5.5
Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti…
-
Medium 5.5
Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attacke…
-
Medium 5.5
Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local …
-
Medium 5.5
Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to p…
-
Medium 5.5
Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potent…
-
Medium 5.5
Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti…
-
Medium 5.5
Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to p…
-
Medium 5.5
Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti…
-
Medium 5.5
Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to p…
-
Medium 4.0
Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell relate…
-
Medium 4.0
Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to con…
-
Medium 5.1
Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attacker…
-
Medium 5.1
Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption.
-
Medium 4.0
Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive info…
-
Medium 5.1
Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive informat…
-
Medium 5.1
Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access pro…
-
Medium 6.2
Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictio…
-
Medium 6.2
Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restr…
-
Medium 6.2
Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restric…