2024

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secr

Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.

Use of implicit intent for sensitive communication in translation혻in Samsung Internet prior to version 26.0.3.1 allows l

Use of implicit intent for sensitive communication in Sound Assistant prior to version 6.1.0.9 allows local attackers to

Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers

Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers

Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers

Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allow

Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers

Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypas

Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory

Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Rel

The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions

In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to i

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specif

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user in

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configu

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configu

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data

SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scrip

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write.

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified b

SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vul

The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input.

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak.

in OpenHarmony v4.1.0 allow a local attacker with high privileges arbitrary code execution in pre-installed apps through

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.

SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to t

Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial

Improper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potenti

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (vi

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a

CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped

A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence

A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persisten

Race condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial

In some Solidigm DC Products, a defect in device overprovisioning may provide information disclosure to an attacker.

Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' br

InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a register

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By ma

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the l

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to constru

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to constru

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsh