Total 277662 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-56443 1 Huawei 1 Harmonyos 2025-01-13 6.2 Medium
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-56442 1 Huawei 2 Emui, Harmonyos 2025-01-13 5.5 Medium
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVE-2024-56441 1 Huawei 2 Emui, Harmonyos 2025-01-13 4.1 Medium
Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-56440 1 Huawei 2 Emui, Harmonyos 2025-01-13 6.2 Medium
Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVE-2024-56439 1 Huawei 1 Harmonyos 2025-01-13 7.5 High
Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-56438 1 Huawei 2 Emui, Harmonyos 2025-01-13 6 Medium
Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2024-56436 1 Huawei 1 Harmonyos 2025-01-13 5.5 Medium
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-56435 1 Huawei 1 Harmonyos 2025-01-13 6.2 Medium
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-56434 1 Huawei 2 Emui, Harmonyos 2025-01-13 4.4 Medium
UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.
CVE-2024-45559 1 Qualcomm 46 Qam8255p, Qam8255p Firmware, Qam8295p and 43 more 2025-01-13 5.5 Medium
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
CVE-2024-45558 1 Qualcomm 366 Ar8035, Ar8035 Firmware, Csr8811 and 363 more 2025-01-13 7.5 High
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
CVE-2025-23026 2025-01-13 6.1 Medium
jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with `script` tags or script attributes that include a Javascript template string (backticks) are subject to XSS. The `javaScriptBlock` and `javaScriptAttribute` methods in the `Escape` class do not escape backticks, which are used for Javascript template strings. Dollar signs in template strings should also be escaped as well to prevent undesired interpolation. HTML templates rendered by Jte's `OwaspHtmlTemplateOutput` in versions less than or equal to `3.1.15` with `script` tags or script attributes that contain Javascript template strings (backticks) are vulnerable. Users are advised to upgrade to version 3.1.16 or later to resolve this issue. There are no known workarounds for this vulnerability.
CVE-2025-23022 2025-01-13 4 Medium
FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.
CVE-2025-22144 2025-01-13 N/A
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-22142 2025-01-13 N/A
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-7658 1 Projectsend 1 Projectsend 2025-01-13 5.3 Medium
A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.
CVE-2024-57225 2025-01-13 9.8 Critical
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
CVE-2024-57224 2025-01-13 9.8 Critical
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVE-2024-57223 2025-01-13 9.8 Critical
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
CVE-2024-54999 2025-01-13 6.5 Medium
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.