2024

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id

The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc

The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via d

The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via

The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 v

Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabli

The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This all

Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journ

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver

A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is

A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formAp

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permission

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco

A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the fun

A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function for

In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when pollin

In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spi_async() Calli

In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memor

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in us

In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free(

In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio mi

In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_m

An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted termina

An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal enviro

A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasic

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, a

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filter

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to

Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins contr

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected i

Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP al

The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl

An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a lo

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users

Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authen

An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote atta

Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers

Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti

Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privilege

Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code

Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.

Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak s

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamic

Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corru

Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap