Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Service (DoS).
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attack...
AFFECTED_PRODUCTS:
Lollms Lollms Web Ui
Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS).
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS).
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS).
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code.
AFFECTED_PRODUCTS:
Jungo Windriver,
Mitsubishielectric Cpu Module Logging Configuration Tool,
Mitsubishielectric Cw Configurator
... (+32)
A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML inside which acts as a stored XSS payload.
AFFECTED_PRODUCTS:
Coderberg Residencecms
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and...
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 c...
Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current...
Under certain circumstances unnecessary user details are provided within system logs
Under certain circumstances the Linux users credentials may be recovered by an authenticated user.
Under certain circumstances the web interface will accept characters unrelated to the expected input.
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close.
AFFECTED_PRODUCTS:
Idccms Idccms
A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation leads to deserialization. The attack can be launched remotely. Upgrading...
A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. It is possible to launch the at...
AFFECTED_PRODUCTS:
Home Owners Collection Management System Project Home Owners Collection Management System
A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remote...
AFFECTED_PRODUCTS:
Home Owners Collection Management System Project Home Owners Collection Management System
A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the publ...
AFFECTED_PRODUCTS:
Hitout Carsale
The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...
AFFECTED_PRODUCTS:
Wpexpertplugins Post Meta Data Manager
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This makes it possible for unauthenticated attac...
AFFECTED_PRODUCTS:
Thimpress Learnpress
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user regist...
AFFECTED_PRODUCTS:
Thimpress Learnpress
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authe...
AFFECTED_PRODUCTS:
Dotcamp Ultimate Blocks
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with S...
AFFECTED_PRODUCTS:
Stylemixthemes Cost Calculator Builder
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Adm...
AFFECTED_PRODUCTS:
Stylemixthemes Cost Calculator Builder
Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore.
AFFECTED_PRODUCTS:
Samsung Galaxy Store
Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy image files to external storage.
AFFECTED_PRODUCTS:
Samsung Flow
Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips' privilege.
AFFECTED_PRODUCTS:
Samsung Tips
Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Health. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Health
Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.
AFFECTED_PRODUCTS:
Samsung Smartthings
Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Reason: An additional patch is required.
Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android