Vulnerabilidades

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435347; Issue ID: MSV-4049.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435349; Issue ID: MSV-4051.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441507; Issue ID: MSV-4112.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00441509; Issue ID: MSV-4138.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID:…

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID:…

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441512; Issue ID: MSV-4153.

In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00447115; Issue ID: MSV-4276.

In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…

In ims service, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…

The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the smWpCfSwOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings…

El plugin Beaver Builder (versión Starter) para WordPress es vulnerable a cross-site scripting almacenado a través del parámetro 'auto_play' en todas las versiones hasta la 2.9.2.1, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de…

Vulnerabilidad de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (XSS o 'cross-site scripting') en la extensión The Wikimedia Foundation MediaWiki CookieConsent permite cross-site scripting (XSS). Este problema afecta a la extensión MediaWiki CookieConsent: desde la v0.1.0 anterior a la…

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en John James Jacoby WP Media Categories wp-media-categories permite la falsificación de petición en sitios cruzados. Este problema afecta a WP Media Categories: desde n/a hasta menor o igual que 2.1.0.

Vulnerabilidad de Asignación Incorrecta de Privilegios en N-Media Simple User Registration wp-registration permite la escalada de privilegios. Este problema afecta a Simple User Registration: desde n/a hasta menor o igual a 6.4.

Vulnerabilidad de autorización faltante en Wikimedia Foundation Wikipedia Preview wikipedia-preview permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Wikipedia Preview: desde n/a hasta menor o igual que 1.15.0.

El plugin Oboxmedia Ads para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de los parámetros 'before_widget' y 'after_widget' del shortcode oboxads-ad-widget en todas las versiones hasta la 1.9.8, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida deficiente.…

Vulnerabilidad de Permisos Predeterminados Incorrectos en las extensiones Mediawiki - Thanks y Mediawiki - Growth Experiments de la Fundación Wikimedia permite el acceso a funcionalidades no restringidas adecuadamente por ACLs. Este problema afecta a las extensiones Mediawiki - Thanks y Mediawiki - Growth Experiments:…

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

Vulnerabilidad de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (XSS o 'Cross-site Scripting') en la extensión Mediawiki - PageTriage de The Wikimedia Foundation permite XSS Almacenado. Este problema afecta a la extensión Mediawiki - PageTriage: desde master anterior a 1.44.

Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (XSS o 'cross-site scripting') vulnerabilidad en The Wikimedia Foundation Mediawiki - Wikistories permite XSS Almacenado. Este problema afecta a Mediawiki - Wikistories: desde master antes de 1.44.

Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web (XSS o 'cross-site scripting') en The Wikimedia Foundation Mediawiki - extensión WikiLove permite XSS almacenado. Este problema afecta a Mediawiki - extensión WikiLove: 1.39.

Vulnerabilidad de Exposición de Información Sensible a un Actor No Autorizado en la Extensión Translate de Mediawiki de la Fundación Wikimedia permite Footprinting. La extensión Translate parece usar trabajos para realizar ediciones en páginas de traducción. Esto provoca que la herramienta CheckUser registre la IP y…

Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales utilizados en un Comando ('Inyección de Comandos') en la extensión Springboard de la Fundación Wikimedia Mediawiki Foundation permite la inyección de comandos. Este problema afecta a la extensión Springboard de la Fundación Mediawiki: master.