Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure And Networking Security Vulnerabilities

PT-2021-02: Encryption bypass when downloading a firmware update in Diebold-Nixdorf RM3/CRS

PT-2021-02: Encryption bypass when downloading a firmware update in Diebold-Nixdorf RM3/CRS RM3/CRS dispenser firmware (all versions up to and including 41128 1002 RM3_CRS.BTR + 170329 2332 RM3_CRS.FRM) Severity: Severity level: High Encryption bypass when downloading a firmware update in...

PT-2021-01: Encryption bypass when downloading a firmware update in Diebold-Nixdorf CMDv5

PT-2021-01: Encryption bypass when downloading a firmware update in Diebold-Nixdorf CMDv5 CMDv5 dispenser firmware (all versions up to and including 141128 1002 CD5_ATM.BTR + 170329 2332 CD5_ATM.FRM) Severity: Severity level: High Encryption bypass when downloading a firmware update in...

CVE-2024-1427 The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag

The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user...

CVE-2024-1427 The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag

The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user...

CVE-2024-5349

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

CVE-2024-5349

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

Meta's 'Pay or Consent' Approach Faces E.U. Competition Rules Scrutiny

Meta's decision to offer an ad-free subscription in the European Union (E.U.) has faced a new setback after regulators accused the social media behemoth of breaching the bloc's competition rules by forcing users to choose between seeing ads or paying to avoid them. The European Commission said the....

Chinese Hackers Exploiting Cisco Switches Zero-Day to Deliver Malware

A China-nexus cyber espionage group named Velvet Ant has been observed exploiting a zero-day flaw in Cisco NX-OS Software used in its switches to deliver malware. The vulnerability, tracked as CVE-2024-20399 (CVSS score: 6.0), concerns a case of command injection that allows an authenticated,...

CVE-2024-5349 LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

Australian Man Charged for Fake Wi-Fi Scam on Domestic Flights

An Australian man has been charged with running a fake Wi-Fi access point during a domestic flight with an aim to steal user credentials and data. The unnamed 42-year-old "allegedly established fake free Wi-Fi access points, which mimicked legitimate networks, to capture personal data from...

CVE-2024-5419

The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and...

CVE-2024-5419

The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and...

CVE-2024-5419 Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute

The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: bank-vaults, kaf, kubernetes-csi-external-snapshotter, vault-k8s, boring-registry, fuse-overlayfs-snapshotter, gitness, istio-pilot-agent, k9s, tekton-chains, thanos-operator, istio-pilot-discovery, trillian, karpenter, prometheus-node-exporter,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: trivy, k9s, kots, k3d, cadvisor, telegraf, datadog-agent, kubernetes, ingress-nginx-controller, kubescape, kaniko, runc, grype, skopeo, zot, nerdctl, nvidia-device-plugin, syft, skaffold, wolfictl, newrelic-infrastructure-agent, ctop, k3s, buildkitd, docker,...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: trivy, fuse-overlayfs-snapshotter, helm-push, gitness, kots, k3d, up, kubevela, melange, telegraf, kubescape, kaniko, helm, grype, neuvector-agent, zot, eksctl, cilium-cli, skaffold, flux-helm-controller, flux-source-controller, newrelic-infrastructure-agent, ctop,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: kaf, fuse-overlayfs-snapshotter, gitness, kubevela, tomcat, nri-prometheus, kubescape, kubernetes-csi-livenessprobe, kubewatch, helm, flux-notification-controller, aactl, hey, spark-operator, frp, node-problem-detector, envoy-ratelimit, grpcurl, dotnet, skaffold,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: bank-vaults, boring-registry, helm-docs, buf, kubevela, configmap-reload, nri-prometheus, tkn, libnvidia-container, flux-notification-controller, gops, litefs, shfmt, php-fpm_exporter, nerdctl, lazygit, tempo, vexctl, nri-couchbase, kpt, docker, gobuster,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: bank-vaults, kaf, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, thanos-operator, trillian, karpenter, prometheus-node-exporter, kubevela, kubernetes-csi-external-resizer, nri-prometheus, tkn, kubernetes-csi-livenessprobe,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: gitsign, goreleaser, trivy, scorecard, kubeflow-katib, argo-workflows, istio-pilot-agent, bom, k9s, kots, tekton-chains, kargo, istio-pilot-discovery, gitlab-runner, flux-image-reflector-controller, up, kubevela, dagger, filebeat, prometheus, cadvisor, telegraf, guac,....

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: bank-vaults, kaf, kubernetes-csi-external-snapshotter, vault-k8s, boring-registry, fuse-overlayfs-snapshotter, gitness, istio-pilot-agent, k9s, tekton-chains, thanos-operator, istio-pilot-discovery, trillian, karpenter, prometheus-node-exporter,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: bank-vaults, boring-registry, buf, kubevela, configmap-reload, nri-prometheus, tkn, flux-notification-controller, litefs, shfmt, nuclei, php-fpm_exporter, lazygit, tempo, vexctl, nri-couchbase, kpt, gobuster, kuberay-operator, argo-workflows, prometheus-nats-exporter,....

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: bank-vaults, boring-registry, buf, kubevela, configmap-reload, nri-prometheus, tkn, flux-notification-controller, litefs, shfmt, nuclei, php-fpm_exporter, lazygit, tempo, vexctl, nri-couchbase, kpt, gobuster, kuberay-operator, argo-workflows, prometheus-nats-exporter,....

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: bank-vaults, boring-registry, helm-docs, buf, kubevela, configmap-reload, nri-prometheus, tkn, libnvidia-container, flux-notification-controller, gops, litefs, shfmt, php-fpm_exporter, nerdctl, lazygit, tempo, vexctl, nri-couchbase, kpt, docker, gobuster,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: bank-vaults, kaf, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, istio-pilot-agent, tekton-chains, thanos-operator, istio-pilot-discovery, trillian, karpenter, go, prometheus-node-exporter, kubevela,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: bank-vaults, boring-registry, helm-docs, buf, kubevela, configmap-reload, nri-prometheus, tkn, libnvidia-container, flux-notification-controller, gops, litefs, shfmt, php-fpm_exporter, nerdctl, lazygit, tempo, vexctl, nri-couchbase, kpt, docker, gobuster,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: bank-vaults, kaf, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, istio-pilot-agent, tekton-chains, thanos-operator, istio-pilot-discovery, trillian, karpenter, go, prometheus-node-exporter, kubevela,...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: bank-vaults, kaf, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, thanos-operator, trillian, karpenter, prometheus-node-exporter, kubevela, kubernetes-csi-external-resizer, nri-prometheus, tkn, kubernetes-csi-livenessprobe,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kaf, fuse-overlayfs-snapshotter, gitness, kubevela, tomcat, nri-prometheus, kubescape, kubernetes-csi-livenessprobe, kubewatch, helm, flux-notification-controller, aactl, hey, spark-operator, frp, node-problem-detector, envoy-ratelimit, grpcurl, dotnet, skaffold,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-236W-P7WF-5PH8 vulnerabilities

Vulnerabilities for packages: bank-vaults, boring-registry, helm-docs, buf, kubevela, configmap-reload, nri-prometheus, tkn, libnvidia-container, flux-notification-controller, gops, litefs, shfmt, php-fpm_exporter, nerdctl, lazygit, tempo, vexctl, nri-couchbase, kpt, docker, gobuster,...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: gitsign, goreleaser, trivy, scorecard, kubeflow-katib, argo-workflows, istio-pilot-agent, bom, k9s, kots, tekton-chains, kargo, istio-pilot-discovery, gitlab-runner, flux-image-reflector-controller, up, kubevela, dagger, filebeat, prometheus, cadvisor, telegraf, guac,....

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: nri-apache, kaf, cni-plugins, kubernetes-csi-external-snapshotter, vault-k8s, fuse-overlayfs-snapshotter, gitness, nri-nginx, docker-credential-acr-env, fq, go-bindata, nri-memcached, thanos-operator, wait-for-port, trillian, prometheus-node-exporter,...

GHSA-XR7R-F8XQ-VFVV vulnerabilities

Vulnerabilities for packages: trivy, k9s, kots, k3d, cadvisor, telegraf, datadog-agent, kubernetes, ingress-nginx-controller, kubescape, kaniko, runc, grype, skopeo, zot, nerdctl, nvidia-device-plugin, syft, skaffold, wolfictl, newrelic-infrastructure-agent, ctop, k3s, buildkitd, docker,...

CISA Known Exploited Vulnerability Catalog June 2024

Summary The Known Exploited Vulnerability (KEV) catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog, prioritize remediation of listed vulnerabilities, and...

Exploit for CVE-2024-6387

Link to Qualys Write-Up:...

CVE-2024-5938

The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-5938

The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Attacks, Vulnerabilities and Actors 24 to 30 June 2024

...

CVE-2024-5938 Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

degerforsmusikkar.se Cross Site Scripting vulnerability OBB-3939928

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

toscanakarneval.dk Cross Site Scripting vulnerability OBB-3939927

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...