Export limit exceeded: 11392 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11392 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-40530 | 1 Skylark | 1 Skylark | 2024-10-02 | 4.7 Medium |
| Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. | ||||
| CVE-2023-38460 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 7.8 High |
| In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges | ||||
| CVE-2023-40027 | 1 Keystonejs | 1 Keystone | 2024-10-02 | 3.7 Low |
| Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible (no session required) if a `session` strategy is not defined. This vulnerability does not affect developers using the `@keystone-6/auth` package, or any users that have written their own `ui.isAccessAllowed` (that is to say, `isAccessAllowed` is not `undefined`). This vulnerability does affect users who believed that their `session` strategy will, by default, enforce that `adminMeta` is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware. This vulnerability has been patched in `@keystone-6/core` version `5.5.1`. Users are advised to upgrade. Users unable to upgrade may opt to write their own `isAccessAllowed` functionality to work-around this vulnerability. | ||||
| CVE-2024-47330 | 1 Supsystic | 2 Slider, Social Share Buttons | 2024-10-02 | 4.3 Medium |
| Missing Authorization vulnerability in Supsystic Slider by Supsystic, Supsystic Social Share Buttons by Supsystic.This issue affects Slider by Supsystic: from n/a through 1.8.6; Social Share Buttons by Supsystic: from n/a through 2.2.9. | ||||
| CVE-2024-8434 | 1 Themehunk | 1 Easy Mega Menu Plugin | 2024-10-02 | 4.3 Medium |
| The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform actions like updating plugin settings. | ||||
| CVE-2024-8350 | 1 Uncannyowl | 1 Uncanny Groups For Learndash | 2024-10-02 | 2.7 Low |
| The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site. | ||||
| CVE-2024-8552 | 1 Wpchill | 1 Download Monitor | 2024-10-02 | 4.3 Medium |
| The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality. | ||||
| CVE-2024-8349 | 1 Uncannyowl | 1 Uncanny Groups For Learndash | 2024-10-02 | 7.2 High |
| The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access. | ||||
| CVE-2023-33916 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-33918 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38436 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38437 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38442 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38438 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38439 | 2 Google, Unisoc | 8 Android, Sc9832e, Sc9863a and 5 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38440 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38441 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38448 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges | ||||
| CVE-2023-38454 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 5.5 Medium |
| In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges | ||||
| CVE-2023-38456 | 2 Google, Unisoc | 9 Android, Sc7731e, Sc9832e and 6 more | 2024-10-02 | 7.8 High |
| In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges | ||||