Archive
7 August 2024
Vulnerabilities first published on this day (UTC), newest first.
118 results · Feed
-
Medium 6.3
Jenkins does not perform a permission check in an HTTP endpoint
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
-
High 8.8
Jenkins Remoting library arbitrary file read vulnerability
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
-
High 7.3
Alien Technology ALR-F800 cmd.php improper authorization
A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. It is possible to…
-
Medium 4.9
Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters
The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes …
-
Medium 5.4
Accept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode
The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's accept_stripe_payment_ng shortcode in all versions up to, and including, 2.0.86 due to insufficient input sanitization and output escaping on user su…
-
High 8.5
Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access an…
-
High 7.1
Internal infrastructure data leak in EZD RP
Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before …
-
High 7.1
Users listing in EZD RP
Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15…
-
High 8.7
Privilege Escalation in EZD RP
Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects E…
-
High 7.3
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted…
-
High 8.8
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a l…
-
High 7.2
Apache CloudStack: User Key Exposure to Domain Admins
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an a…
-
Medium 4.3
Apache CloudStack: Unauthorised Network List Access
In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to…
-
Medium 6.1
WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
-
Medium 4.8
House Manager <= 1.0.8.4 - Reflected XSS
The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Critical 9.8
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker …
-
Medium 5.3
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to a…
-
High 8.8
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote att…
-
High 8.2
Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authe…
-
Medium 5.0
Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to p…
-
Medium 4.0
Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to…
-
Medium 4.0
Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to acces…
-
Medium 4.0
Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker t…
-
Medium 4.0
Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access…
-
Medium 4.0
Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthor…
-
Medium 5.5
Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti…
-
Medium 5.5
Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attacke…
-
Medium 5.5
Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local …
-
Medium 5.5
Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to p…
-
Medium 5.5
Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potent…
-
Medium 5.5
Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti…
-
Medium 5.5
Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to p…
-
Medium 5.5
Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti…
-
High 7.8
Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attacker…
-
High 7.8
Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potent…
-
Medium 5.5
Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to p…
-
High 8.4
Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileg…
-
High 7.5
Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary cod…
-
Medium 4.0
Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell relate…
-
Medium 4.0
Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to con…