WordPress WordPress Picture / Portfolio / Media Gallery Plugin <= 3.0.1 is vulnerable to Server Side Request Forgery (SSRF)

Software WordPress Picture / Portfolio / Media Gallery Type Plugin Vulnerable versions = 3.0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-5021 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 4f6e62e03ba9 Credits...

CVE-2024-6045

creationtimestamp| type| source ---|---|--- 2024-06-17 09:54:04+00:00| published-proof-of-concept| https://t.me/HackingInsights/2665 2024-06-18 06:41:08+00:00| seen| https://t.me/habrcomnews/28606 2024-06-18 10:43:48+00:00| published-proof-of-concept| https://t.me/hydral0gs/2925 2024-06-18...

OPENSUSE-SU-2024:12203-1 java-18-openjdk-18.0.2.0-1.1 on GA media

These are all security issues fixed in the java-18-openjdk-18.0.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10572-1 libjavascriptcoregtk-4_0-18-2.14.2-2.1 on GA media

These are all security issues fixed in the libjavascriptcoregtk-40-18-2.14.2-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12862-1 sccache-0.4.1~18-2.1 on GA media

These are all security issues fixed in the sccache-0.4.118-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11506-1 libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media

These are all security issues fixed in the libjavascriptcoregtk-40-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im appearing on a panel on Society and Democracy at ACM Collective Intelligence in Boston, Massachusetts. The conference runs from June 26 through 29, 2024, and my panel is at 9:00 AM on Friday, June 28. Im speaking on "Reimagining...

Security Bulletin: Multiple vulnerabilities in Node.js affects IBM Rational® Application Developer for WebSphere® Software (CVE-2024-27982, CVE-2024-27983)

Summary Node.js is used as runtime and SDK for Apache Cordova applications within IBM Rational® Application Developer for WebSphere® Software. Information about security vulnerabilities affecting Node.js has been published in a security bulletin. Vulnerability Details CVEID:CVE-2024-27982...

CVE-2024-37051

creationtimestamp| type| source ---|---|--- 2024-06-11 16:07:22+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7606 2024-06-13 09:24:16+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7639 2024-06-14 18:42:14+00:00| published-proof-of-concept|...

CVE-2024-37393

creationtimestamp| type| source ---|---|--- 2024-06-10 12:48:44+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7588 2026-02-18 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-02-18 2026-02-23 00:00:00+00:00| exploited| The Shadowserver...

CVE-2024-36405 Control-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other options

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for -Os, -O1, and other...

CVE-2024-36405

Removed by vendor...

CVE-2024-36405 Control-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other options

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for -Os, -O1, and other...

RHEL 4 : gnome-vfs2 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - neon: billion laughs DoS attack CVE-2009-2473 Note that Nessus has not tested for this issue but has instead relied...

[SECURITY] Fedora 39 Update: rust-diskonaut-0.11.0-18.fc39

Terminal disk space visual navigator...

python27:2.7 security update

babel 2.5.1-10 - Fix CVE-2021-20095 Resolves: rhbz1955615 2.5.1-9 - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz1695587 2.5.1-8 - Fix unversioned requires/buildrequires - Resolves: rhbz1628242 2.5.1-7 - Remove unversioned binaries - Resolves: rhbz1613343 2.5.1-6 - Make...

SUSE SLES15: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (SUSE-SU-2024:1768-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1768-1 advisory. PostgreSQL upgrade to version 14.12 bsc1224051: - CVE-2024-4317: Fixed visibility restriction of pgstatsext and pgstatsextexpr...

krihm.org Cross Site Scripting vulnerability OBB-3928547

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

rallies.info Cross Site Scripting vulnerability OBB-3928539

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Debian: Security Advisory (DSA-5684-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...