Archive
September 2024
Vulnerabilities first published in this month (UTC), newest first.
1,072 results · Clear filters · Feed
-
Medium 6.2
Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release…
-
Medium 6.4
Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several pa…
-
Medium 6.2
Memory request vulnerability in the memory management module Impact: Successful exploitation of this vulnerability may …
-
Medium 5.1
Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vul…
-
Medium 4.1
Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of thi…
-
Medium 4.4
Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may a…
-
Medium 5.5
Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulner…
-
Medium 4.0
Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this …
-
Medium 5.5
Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability ma…
-
Medium 6.1
Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect …
-
Medium 5.1
Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of…
-
Medium 6.2
Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability wil…
-
Medium 4.3
Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 4.0
Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability m…
-
Medium 4.6
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a spec…
-
Medium 5.4
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, …
-
Medium 6.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanis…
-
Medium 5.3
ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does…
-
Medium 6.1
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information …
-
Medium 5.4
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information …
-
Medium 6.7CVE-2024-42642 Public exploit
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by send…
-
Medium —
pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/…
-
Medium 4.3
Libopensc: incorrect handling length of buffers or files in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with…
-
Medium 4.7
Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects F…
-
Medium 4.7
CometBFT's state syncing validator from malicious node may lead to a chain split
**Name**: ASA-2024-009: State syncing validator from malicious node may lead to a chain split **Component**: CometBFT **Criticality**: Medium ([ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Moderate; L: Pos…
-
Medium 6.5
Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts…
-
Medium 6.4
Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)
Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads. This information is gathered by looking up the value of `document.currentScript.src`. Prior to Pagef…
-
Medium 4.9
BMO can expose particularly named secrets from other namespaces via BMH CRD
The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaData`, and `networkData` for the provisioned host to be specified as links to Kubernetes Secrets. Ther…
-
Medium 4.6
Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users c…
-
Medium 6.9
Sensetive Data Exposure in SAMPAS's AKOS
Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by Users. This issue affects AKOS (AkosCepVatandasService): before V2.0; AKOS (TahsilatService): before …
-
Medium 4.3
Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing t…
-
Medium 6.1
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of ano…
-
Medium 6.8
Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized A…
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmwa…
-
Medium 4.9
A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG …
-
Medium 6.3
SourceCodester Contact Manager with Export to VCF Delete Contact delete-account.php sql injection
A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This issue affects some unknown processing of the file /endpoint/delete-account.php of the component Delete Contact Handler. The manipulation of…
-
Medium 5.1CVE-2024-34463 Public exploit
BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The …
-
Medium 4.2
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an EC…
-
Medium 5.4
SquaredUp DS for SCOM 6.2.1.11104 allows XSS.
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to …