Filtered by vendor Subscriptions
Total 322438 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-47128 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 4.3 Medium
The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations.
CVE-2024-47127 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 6.5 Medium
In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to share encryption keys via QR scanning for higher security operations and update your app to the current release for enhanced encryption protocols.
CVE-2024-47126 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 6.5 Medium
The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
CVE-2024-47125 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 8.1 High
The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to the current release for enhanced encryption protocols.
CVE-2024-47124 1 Gotenna 1 Gotenna Pro 2024-10-17 4.3 Medium
The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous versions of the app and update your app to the current app version which uses AES-256 encryption for callsigns in encrypted operation.
CVE-2024-47122 1 Gotenna 1 Gotenna Pro 2024-10-17 4.3 Medium
In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys stored on the EUD. This requires access to and control of the EUD, so it is recommended to use strong access control measures and layered encryption on the EUD for more secure operation.
CVE-2024-43814 1 Gotenna 1 Gotenna 2024-10-17 4.3 Medium
The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. Users that are unaware of their settings and have not activated encryption before a mission may accidentally broadcast their location unencrypted. It is advised to verify PLI settings are the desired rate and activate encryption prior to mission. Update to the latest Plugin to disable this default setting.
CVE-2024-9818 2 Oretnom23, Sourcecodester 2 Online Veterinary Appointment System, Online Veterinary Appointment System 2024-10-17 7.3 High
A vulnerability classified as critical has been found in SourceCodester Online Veterinary Appointment System 1.0. Affected is an unknown function of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9817 2 Blood Bank System Project, Code-projects 2 Blood Bank System, Blood Bank System 2024-10-17 6.3 Medium
A vulnerability was found in code-projects Blood Bank System 1.0. It has been classified as critical. This affects an unknown part of the file /update.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9925 2 Tai Smart Factory, Taismartfactory 2 Qplant Sf, Qplant Sf 2024-10-17 9.8 Critical
SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint.
CVE-2024-9981 1 Formosasoft 2 Ee-class, Ee Class 2024-10-17 8.8 High
The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server.
CVE-2024-9980 1 Formosasoft 2 Ee-class, Ee Class 2024-10-17 8.8 High
The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify and delete database contents.
CVE-2024-48909 1 Authzed 1 Spicedb 2024-10-17 2 Low
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.
CVE-2024-48779 1 Wanxingtechnology 1 Yitu Project Management Software 2024-10-17 9.8 Critical
An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformpluginpath parameter to specify that the qt plugin loads the directory.
CVE-2023-7294 1 Paytium 1 Paytium 2024-10-17 7.1 High
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the create_mollie_profile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile.
CVE-2024-39440 2 Google, Unisoc 10 Android, S8000, T606 and 7 more 2024-10-17 6.2 Medium
In DRM service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with System execution privileges needed.
CVE-2023-7293 1 Paytium 1 Paytium 2024-10-17 4.3 Medium
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_mollie_account_details function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to verify the existence of a mollie account.
CVE-2023-7292 1 Paytium 1 Paytium 2024-10-17 4.3 Medium
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing capability check on the paytium_notice_dismiss function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to dismiss admin notices.
CVE-2024-39439 2 Google, Unisoc 10 Android, S8000, T606 and 7 more 2024-10-17 6.2 Medium
In DRM service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2023-7291 1 Paytium 1 Paytium 2024-10-17 7.1 High
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_mollie_account function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to set up a mollie account.