CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38716 – WordPress Events Calendar for Google plugin <= 2.1.0 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-38716
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File Inclusion.This issue affects Events Calendar for Google: from n/a through 2.1.0. The Events Calendar for Google plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. • https://patchstack.com/database/vulnerability/events-calendar-for-google/wordpress-events-calendar-for-google-plugin-2-1-0-local-file-inclusion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34726
https://notcve.org/view.php?id=CVE-2024-34726
In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. En PVRSRV_MMap de pvr_bridge_k.c, existe una posible ejecución de código arbitrario debido a un error lógico en el código. Esto podría conducir a una escalada local de privilegios en el kernel sin necesidad de permisos de ejecución adicionales. • https://source.android.com/security/bulletin/2024-07-01 • CWE-783: Operator Precedence Logic Error •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34725
https://notcve.org/view.php?id=CVE-2024-34725
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. En DevmemIntUnexportCtx de devicemem_server.c, existe una posible ejecución de código arbitrario debido a una condición de ejecución. Esto podría conducir a una escalada local de privilegios en el kernel sin necesidad de permisos de ejecución adicionales. • https://source.android.com/security/bulletin/2024-07-01 • CWE-269: Improper Privilege Management CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34723
https://notcve.org/view.php?id=CVE-2024-34723
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En onTransact de ParcelableListBinder.java, existe una forma posible de robar mAllowlistToken para iniciar una aplicación en segundo plano debido a un error lógico en el código. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. • https://android.googlesource.com/platform/frameworks/base/+/c702bb71811993960debe0c18fcf8834cfa2454f https://source.android.com/security/bulletin/2024-07-01 • CWE-783: Operator Precedence Logic Error •
CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34722
https://notcve.org/view.php?id=CVE-2024-34722
In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En smp_proc_rand de smp_act.cc, existe una posible omisión de autenticación durante el emparejamiento BLE heredado debido a una implementación incorrecta de un protocolo. Esto podría conducir a una escalada remota de privilegios sin necesidad de permisos de ejecución adicionales. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/456f705b9acc78d8184536baff3d21b0bc11c957 https://source.android.com/security/bulletin/2024-07-01 • CWE-303: Incorrect Implementation of Authentication Algorithm •