9438 matches found
GSD-2023-1000199 usb: gadget: uvc: Prevent buffer overflow in setup handler
usb: gadget: uvc: Prevent buffer overflow in setup handler This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.161 by commit...
GSD-2023-1000111 usb: gadget: uvc: Prevent buffer overflow in setup handler
usb: gadget: uvc: Prevent buffer overflow in setup handler This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.85 by commit...
PT-2023-33113 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.13 Description: A memory leak issue was discovered in the gpiochip setup dev function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...
PT-2023-33275 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.161 Description: The issue is related to the initialization of mailbox messages for VF reset. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...
OOPSpam Anti-Spam < 1.1.36 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2023-1180 · Oracle · Oracle Learning Management +1
Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Setup component of the Oracle Learning Management product. This can be exploited by a remote attacker to...
CVE-2023-21852: Improper Access Control
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Setup. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Learning Management...
CVE-2022-4199
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Cross site scripting
The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-4330 WP Attachments < 5.0.6 - Admin+ Stored XSS
The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WP Better Emails <= 0.4 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
MAL-2023-772 Malicious code in setup-maven (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 634144f43edb36e91854ad024939d4efd04c6f966d6b138514b404ef25c16538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in setup-maven (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 634144f43edb36e91854ad024939d4efd04c6f966d6b138514b404ef25c16538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-2065
Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description The issue is related to a use-after-free flaw in the NFS filesystem in the Linux Kernel, specifically in the nfsd4 ssc setup dul function in fs/nfsd/nfs4proc.c. This flaw could allow a...
SUSE-SU-2023:0058-1 Security update for systemd
This update for systemd fixes the following issues: Fixing the following issues: - units: restore RemainAfterExit=yes in systemd-vconsole-setup.service - vconsole-setup: don't concat strv if we don't need to i.e. not in debug log mode - vconsole-setup: add more log messages - units: restore Befor...
PT-2023-15144 · WordPress · Royal Elementor Addons
Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.3.59 Description: The issue is related to insufficient access control in the 'wpr final settings setup' AJAX action. This allows any authenticated user to finali...
PT-2025-13354
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential memory leak issue has been identified in the Linux kernel related to the cifs session setup. The problem occurs when the cifs ses::auth key.response is not properly freed...
CVE-2022-3855
The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls
In yet another campaign targeting the Python Package Index PyPI repository, six malicious packages have been found deploying information stealers on developer systems. The now-removed packages, which were discovered by Phylum between December 22 and December 31, 2022, include pyrologin,...
