Archive
3 January 2025
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
High 7.3
WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution
The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before run…
-
High 8.8CVE-2024-13129 EPSS 18%
Roxy-WI roxy.py action_service os command injection
A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injec…
-
High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/…
-
High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadshee…
-
High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffi…
-
High 8.7
SiYuan has an arbitrary file deletion vulnerability
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payl…
-
High 8.7
Karmada PULL Mode Cluster Privilege Escalation
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the `karmadactl register` command have excessive privi…
-
High 8.3
PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibi…
-
High 7.2
Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-leve…
-
High 7.8
In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead…
-
High 7.8
In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to …
-
High 7.8
there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege wit…
-
High 7.8
In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This cou…
-
High 7.8
there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege wit…
-
High 7.8
In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validat…
-
High 7.5
In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bou…
-
High 7.8
there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of pri…
-
High 7.8
In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflo…
-
High 8.8
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specificall…
-
High 7.5
SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewTy…