| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
| Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally. |
| PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server. |
| A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE |
| Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier |
| Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. |
| Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. |
| Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
| Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. |
| Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
| Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions. |
| Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions. |
| Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. |
| Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3.1.6 versions. |
| Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions. |
| Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions. |
| Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible. |
