Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
Memory corruption when user provides data for FM HCI command control operations.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption when the captureRead QDCM command is invoked from user-space.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
memory corruption when an invalid firehose patch command is invoked.
Memory corruption while releasing shared resources in MinkSocket listener thread.
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
Cryptographic issue while parsing RSA keys in COBR format.
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
AFFECTED_PRODUCTS:
Projectcaruso Flaming Forms
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.
AFFECTED_PRODUCTS:
Projectcaruso Flaming Forms
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
AFFECTED_PRODUCTS:
Digireturn Dn Popup
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
Ninjaforms Ninja Forms
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored...
AFFECTED_PRODUCTS:
Hashicorp Vault,
Hashicorp Vault,
Hashicorp Vault
SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.
AFFECTED_PRODUCTS:
Easytest Online Test Platform Project Easytest Online Test Platform
CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS.
AFFECTED_PRODUCTS:
Codeastro Membership Management System
REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website.
AFFECTED_PRODUCTS:
Vanderbilt Redcap
SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter.
AFFECTED_PRODUCTS:
Easytest Easytest Online Test Platform
SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter.
AFFECTED_PRODUCTS:
Easytest Easytest Online Test Platform
SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter.
AFFECTED_PRODUCTS:
Easytest Easytest Online Test Platform
SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter.
AFFECTED_PRODUCTS:
Easytest Easytest Online Test Platform
SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.
AFFECTED_PRODUCTS:
Easytest Easytest Online Test Platform
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
AFFECTED_PRODUCTS:
Openatom Openharmony,
Openatom Openharmony
in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
AFFECTED_PRODUCTS:
Openatom Openharmony,
Openatom Openharmony
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow.
AFFECTED_PRODUCTS:
Openatom Openharmony
In wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08861558; Issue ID: MSV-1526.
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Linuxfoundation Yocto
... (+3)
In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932099; Issue ID: MSV-1543.
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Google Android
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1550.
AFFECTED_PRODUCTS:
Google Android
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1551.
AFFECTED_PRODUCTS:
Google Android
In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08944204; Issue ID: MSV-1560.
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Openwrt Openwrt
... (+6)
In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08944210; Issue ID: MSV-1561.
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Openwrt Openwrt
... (+6)
Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts.
AFFECTED_PRODUCTS:
Linen Linen
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress...
AFFECTED_PRODUCTS:
Majeedraza Carousel Slider
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordP...
AFFECTED_PRODUCTS:
Majeedraza Carousel Slider
A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input picture' leads to cross site scripting. Th...
AFFECTED_PRODUCTS:
Grocy Project Grocy
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.
AFFECTED_PRODUCTS:
Misp Misp
HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only node.
AFFECTED_PRODUCTS:
Htmldoc Project Htmldoc