CVE Vulnerability Catalog

An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in a double free, leading to a denial of service.

An invalid kernel address dereference in the issimian device driver in Samsung Exynos processors (models 1330, 1380, 1480, 2400, 1580, 2500) leads to a denial of service.

An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. A race condition in the issimian device driver results in an out-of-bounds access, leading to a denial of service.

PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to phishing attacks via UI redressing. The supplier disputes this, noting that SameSite=Strict cookies prevent authentication in cross-origin contexts.

Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints. An authenticated team member can read a highly sensitive `email_change_code` belonging to other users on the same team. This code is intended for single-use email change verification and should remain secret.

An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. The supplier is currently disputing this finding and the record is under review.

The Thim Core plugin by ThimPress contains a Cross-Site Request Forgery vulnerability in versions from n/a through 2.3.3. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

The LoginWP - Pro plugin contains a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. The issue affects versions up to and including 4.0.8.5.

The Dokan Pro WordPress plugin has a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects all versions up to 3.14.5.

Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first X-Forwarded-For (XFF) value as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value to spoof the client IP, which is propagated to security-relevant state (e.g., the WG_CLIENT_IP cookie).

In Campcodes Supplier Management System 1.0, manipulation of the txtRetailerAddress argument in /retailer/edit_profile.php leads to SQL injection. The vulnerability can be exploited remotely and a public exploit has been released.

A SQL injection vulnerability was identified in code-projects Online Product Reservation System 1.0 in the file /app/checkout/update.php. Manipulation of the id/qty arguments allows remote exploitation, and a public exploit may be used.

Apache SIS has an XML External Entity (XXE) vulnerability that allows an attacker to disclose local file contents on the server when parsing certain formats (GeoTIFF, ISO 19115, GML, GPX). Affects versions 0.4 through 1.5.

A SQL injection vulnerability was determined in code-projects Online Product Reservation System 1.0 in the file /app/checkout/delete.php. Manipulation of the ID argument allows remote exploitation, and a public exploit may be used.

A cross-site scripting (XSS) vulnerability was detected in code-projects Online Product Reservation System 1.0 in the file handgunner-administrator/prod.php. Manipulation of the cat argument allows remote exploitation, and a public exploit may be used.

Wallet System for WooCommerce (wallet-system-for-woocommerce) has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions through 2.7.3.

Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a through <= 3.2.26.

The AnyWhere Elementor Pro plugin (versions up to and including 2.29) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.