Archive
13 November 2024
Vulnerabilities first published on this day (UTC), newest first.
115 results · Clear filters · Feed
-
Medium 6.7
Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may…
-
Medium 6.6
Improper buffer restrictions in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable de…
-
Medium 5.3
Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable e…
-
Medium 5.0
An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintex…
-
Medium 4.2
Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to pot…
-
Medium 4.8
Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially en…
-
Medium 4.7
Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors …
-
Medium 4.3
Missing permission check in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to ch…
-
Medium 5.7
Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless…
-
Medium 6.5
Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow a…
-
Medium 6.6
Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products…
-
Medium 6.0
Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version …
-
Medium 5.5
Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potential…
-
Medium 6.2
In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to…
-
Medium 5.5
In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a thi…
-
Medium 5.0
In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to …
-
Medium 5.5
In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy…
-
Medium 6.2
In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion…
-
Medium 5.3CVE-2024-49379 Public exploit
Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel
Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vuln…
-
Medium 5.1
Privilege escalation vulnerability for Organizations in Grafana
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only af…
-
Medium 6.5
Telerik Document Processing Improper Handling of Memory Resources
In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessive processing, leading to excessive use of computing resources leaving the application process unavai…
-
Medium 6.5
UnoPim Stored XSS : Cookie hijacking through Create User function
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can uplo…
-
Medium 4.6
XSS in AirTies' Air4443 Firmware
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting (XSS). This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and …
-
Medium 4.3
Moodle: idor when accessing list of badge recipients
A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.
-
Medium 5.3
XSS vulnerability found in OpenSuse MirrorCache
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the REGEX and P parameters. This issue affects MirrorCache befor…
-
Medium 5.7
An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in…
-
Medium 5.3
Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects …
-
Medium 5.3
VIWIS LMS Print authorization
A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the rol…
-
Medium 6.4
Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user s…
-
Medium 6.4
Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supp…
-
Medium 6.4
Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it poss…
-
Medium 6.1
AFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scripting
The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.92.0. This makes i…
-
Medium 4.8
Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerab…
-
Medium 6.5
CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory …
-
Medium 6.5
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause …
-
Medium 4.3
Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.6 via the 'bhf' shortcode due to insufficient restrictions on which posts can be included. This makes it poss…
-
Medium 5.3
Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure
The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated…
-
Medium 5.3
Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authentica…
-
Medium 4.3
Kognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assis…
-
Medium 5.3
Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authentica…