Archive
21 January 2025
Vulnerabilities first published on this day (UTC), newest first.
94 results · Clear filters · Feed
-
High 8.8
In DGifSlurp of dgif_lib.c, there is a possible out of bounds write due to an integer overflow. This could lead to remo…
-
High 7.8
In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification a…
-
High 7.8
In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to…
-
High 7.8
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mit…
-
High 8.8
In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This c…
-
High 8.8
In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
High 7.8
In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. This cou…
-
High 7.8
In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user …
-
High 7.8
In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities…
-
High 7.0
In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected…
-
High 7.8
In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privileg…
-
High 7.5
In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a devi…
-
High 7.8
In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permis…
-
High 7.8
In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error i…
-
High 8.8
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This coul…
-
High 7.8
In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This co…
-
High 7.8
In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This c…
-
High 8.6
A Server-Side Request Forgery (SSRF) vulnerability exists in newer Lexmark devices.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.
-
High 8.8
Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts
A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The vulnerability occurs when processing alert definitions, where malicious input can be injected int…
-
High 8.8
Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using …
-
High 7.5
Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling ext…
-
High 7.3
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.5
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported vers…
-
High 8.1
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services).…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported versio…
-
High 7.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported …
-
High 7.8
Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install). Supported versions that…
-
High 7.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …
-
High 8.1
Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). Supported v…
-
High 8.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…
-
High 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…
-
High 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…
-
High 8.1
Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). S…
-
High 7.6CVE-2025-23369 Public exploit
Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an e…
-
High 7.1
YesWiki vulnerable to authenticated arbitrary file deletion
YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without an…
-
High 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
-
High 7.1
WordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a th…
-
High 7.1
WordPress WP-Announcements plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.
-
High 8.2
WordPress Realty Workstation plugin <= 1.0.45 - Broken Access Control vulnerability
Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.
-
High 7.1
WordPress SexBundle plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This issue affects SexBundle: from n/a through <= 1.4.