Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of-bounds memory.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability.
AFFECTED_PRODUCTS:
Samsung Android,
Samsung Android,
Samsung Android
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘read_more_text’ parameter in all versions up to, and including, 3.5.5 due to insufficien...
AFFECTED_PRODUCTS:
Sinaextra Sina Extension For Elementor
Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user.
The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher version...
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds read and write.
AFFECTED_PRODUCTS:
Openatom Openharmony
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion.
AFFECTED_PRODUCTS:
Openatom Openharmony
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpub...
AFFECTED_PRODUCTS:
Stylemixthemes Motors Car Dealer\, Classifieds \& Listing
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
AFFECTED_PRODUCTS:
Davidlingren Media Library Assistant
The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user suppli...
AFFECTED_PRODUCTS:
Apollo13Themes Rife Elementor Extensions \& Templates
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag parameter in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
AFFECTED_PRODUCTS:
Dotcamp Ultimate Blocks
Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks.
AFFECTED_PRODUCTS:
Checkmk Checkmk,
Checkmk Checkmk,
Checkmk Checkmk
... (+1)
Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.
AFFECTED_PRODUCTS:
La-Studioweb Element Kit For Elementor
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability to gain root-level access.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to unauthorized gain of root-level access.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service and Elevation of privileges.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to unauthorized gain of root-level access.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs
The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.
The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation,...
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving t...
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
AFFECTED_PRODUCTS:
Kiloview P2 Firmware,
Kiloview P1 Firmware
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter...
AFFECTED_PRODUCTS:
Icegram Email Subscribers \& Newsletters
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...
AFFECTED_PRODUCTS:
Supsystic Easy Google Maps
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to privilege escalation.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability to modify a UEFI variable, leading to denial of service and escalation of privileges
AFFECTED_PRODUCTS:
Dell Embedded Box Pc 5000 Firmware,
Dell Inspiron 3480 Firmware,
Dell Inspiron 3580 Firmware
... (+384)
The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
AFFECTED_PRODUCTS:
Sitetweet Project Sitetweet