Archive
17 January 2025
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
High 8.8
A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.
A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
-
Medium 5.5
Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3
Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3
-
Medium 6.7
In BnDmAgent::onTransact of dm_agent.cpp, there is a possible out of bounds write due to a missing bounds check. This c…
-
High 7.8
In many locations, there is a possible way to access kernel memory in user space due to an incorrect bounds check. This…
-
Medium 5.5
In NlpService, there is a possible way to obtain location information due to a missing permission check. This could lea…
-
Medium 5.1
In ip6_append_data of ip6_output.c, there is a possible way to achieve code execution due to a heap buffer overflow. Th…
-
High 7.8
In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an integer overflow. This …
-
High 7.8
In multiple locations, there is a possible way to read protected files due to a missing permission check. This could le…
-
High 7.0
In onAttachFragment of ShareIntentActivity.java, there is a possible way for an app to read files in the messages app d…
-
Medium 5.5
In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due t…
-
High 7.8
In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could l…
-
High 7.8
In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profi…
-
Medium 5.5
In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a …
-
High 7.8CVE-2018-9375 Public exploit
In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dicti…
-
Critical 10.0
In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services …
-
Medium 4.4
In multiple locations, there is a possible way to bypass KASLR due to an unusual root cause. This could lead to local i…
-
Medium 4.4
In asn1_ber_decoder of asn1_decoder.c, there is a possible out of bounds read due to a missing bounds check. This could…
-
High 7.3
IdP group membership revocation ignored in zot
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the…
-
Medium 6.3
Codezips Gym Management System edit_member.php sql injection
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/edit_member.php. The manipulation of the argument name leads to sql injection. The attack may b…
-
Medium 6.3
\htmlData does not validate attribute names in KaTeX
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate in…
-
Medium 4.3
A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.
A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified.
-
Medium 6.3
itsourcecode Tailoring Management System expadd.php sql injection
A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /expadd.php. The manipulation of the argument expcat leads to sql injection. The attack can be initi…
-
Low 1.8
IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints a…
-
Low 3.5
code-projects Tourism Management System manage-pages.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /admin/manage-pages.php. The manipulation of the argument pgedetails leads to cross site scripting. It …
-
Medium 6.9
`frame-ancestors: self` grants all users access to formgrader in nbgrader
nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default Jupy…
-
Critical 10.0
Improper Input Validation in Bible Module for ROBLOX
Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the Bible Module are susceptible to injection attacks due to the absence of input validation. This vulner…
-
Medium 5.2
Cross Site Scripting on URL decode Tooltip in Caido
Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute a…
-
High 8.7
Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats
stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name `eu.exelban.Stats.SMC.Helpe…
-
Medium 6.1
Inadequate Encryption Strength Vulnerability in Roche Algo Edge
A vulnerability exists in Algo Edge up to 2.1.1 - a previously used (legacy) component of navify® Algorithm Suite. The vulnerability impacts the authentication mechanism of this component and could allow an attacker with adjacent access to the laboratory netw…
-
Low 2.4
code-projects Car Rental Management System manage-pages.php cross site scripting
A vulnerability, which was classified as problematic, has been found in code-projects Car Rental Management System 1.0. This issue affects some unknown processing of the file /admin/manage-pages.php. The manipulation of the argument pgdetails leads to cross s…
-
Medium 6.3
1000 Projects Attendance Tracking Management System edit_action.php sql injection
A vulnerability classified as critical was found in 1000 Projects Attendance Tracking Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_action.php. The manipulation of the argument attendance_id leads to sql injection. The…
-
Medium 6.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 7.4
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
-
Medium 6.3
Codezips Gym Management System edit_mem_submit.php sql injection
A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate…
-
High 7.3
1000 Projects Campaign Management System Platform for Women loginnew.php sql injection
A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Code/loginnew.php. The manipulation of the argument Username leads t…
-
High 7.3
1000 Projects Campaign Management System Platform for Women sc_login.php sql injection
A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Code/sc_login.php. The manipulation of the argument uname l…
-
High 8.6
Nedap Librix Ecoreader Missing Authentication for Critical Function
Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code.
-
High 7.5
Belledonne Communications Linphone-Desktop NULL Pointer Dereference
Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-service condition.
-
Medium 6.3
Codezips Gym Management System new_submit.php sql injection
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/new_submit.php. The manipulation of the argument m_id leads to sql injection. It is possible to l…
-
Medium 4.3
Ossur Mobile Logic Application Use of Hard-coded Credentials
Hard-coded credentials were included as part of the application binary. These credentials served as part of the application authentication flow and communication with the mobile application. An attacker could access unauthorized information.