Archive
6 February 2025
Vulnerabilities first published on this day (UTC), newest first.
99 results · Feed
-
Medium 6.1
Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this …
-
Medium 6.8
Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause f…
-
High 7.7
Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerab…
-
Medium 6.1
Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may caus…
-
Medium 5.7
Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cau…
-
Medium 6.2
Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability ma…
-
Medium 6.6
Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vu…
-
Low 2.8
Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability…
-
Medium 6.1
Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 6.2
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability…
-
Critical 9.4
Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no l…
-
High 8.6
Apache James: denial of service through the use of IMAP literals
Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.…
-
Medium 6.5
Apache James: denial of service through JMAP HTML to text conversion
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
-
Medium 6.5
Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with…
-
Medium 6.3
Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Hom…
-
Medium 6.5
NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker…
-
High 8.8
Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs…
-
High 8.8
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlie…
-
Medium 6.5
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlie…
-
Medium 6.5
Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an att…
-
High 7.3
CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and incl…
-
Medium 4.7
LikeBot – Decentralized like-system <= 0.85 - Admin+ Stored XSS via CSRF
The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
-
Critical 9.8
Credentials Disclosure - keys
Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
-
Medium 6.5
IBM App Connect Enterprise Arbitrary File Write
IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directori…
-
Critical 9.1
IBM Security Verify Directory Command Execution
IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
-
High 7.8
IBM Security Verify Access Appliance Privilege Escalation
IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecessary privileges.
-
Medium 6.3
Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 all…
-
Medium 4.8CVE-2022-40490 Public exploit
Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerabi…
-
Critical 9.8CVE-2022-40916 Public exploit
Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
-
High 8.8
An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the …
-
High 7.5
In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows …
-
Medium 5.3CVE-2024-53586 Public exploit
An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a cr…
-
High 7.5
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of…
-
Critical 9.1
Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R…
-
Medium 6.6
The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and F…
-
Critical 9.8
Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h a…
-
Critical 9.8
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R3…
-
High 8.1
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.
-
Medium 6.3CVE-2024-48589 Public exploit
Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code v…
-
High 7.3
NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a mal…