CVE Vulnerability Catalog

SQL injection vulnerability in /social/ajax.php?action=login in Photo Share Website 1.0. Manipulation of the 'email' argument results in SQL injection, which can be exploited remotely. The exploit has been made public.

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

The Content Views WordPress plugin before version 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitize attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 does not verify the user's capability before installing and activating a plugin from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack plugin-management capabilities) to install and activate arbitrary plugins, resulting in remote code execution.

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before version 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.

A vulnerability in V-Secure Jingyun Antivirus 2.4.2.39 involves an unknown function in the library ZyArk.sys (kernel driver). Manipulation leads to improper access controls. The attack requires local access. The exploit has been publicly disclosed.

A flaw in Jiangmin Antivirus 21 affects the function MessageNotifyCallback in the library kvcore.sys (Minifilter Port component). Manipulation leads to improper access controls. The attack requires local access. The exploit has been published.

A vulnerability in DeepCool DisplayService 1.2.12 affects unknown processing in the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Manipulation results in improper access controls. The attack must be initiated locally. The exploit is public.

A security vulnerability in StableBit DrivePool 2.3.13.1687 affects unknown code in the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe (DrivePoolService component). Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been publicly disclosed.

A weakness has been identified in StableBit Scanner 2.6.13.4088, affecting an unknown part of the Scanner.Service.exe file of the ScannerService component. This manipulation causes permission issues. The attack requires local access, and the exploit has been made public.

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

A security flaw has been discovered in PowerISO 9.3.0.0, affecting some unknown functionality in the scdemu.sys library of the Kernel Driver component. The manipulation results in improper privilege management. The attack requires local access, and the exploit has been released. The vendor did not respond.

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.