CVE-2024-56220 WordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through = 3.6.0...

WordPress plugin SSL Wireless SMS Notification 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.

...

WordPress Skt NURCaptcha Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Skt NURCaptcha Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11342 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID f1e7b8255838 Credits SOPROBRO Required...

freerdp: out-of-bounds read in ncrush_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available...

WordPress plugin Seriously Simple Podcasting 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Seriously Simple...

WordPress Seriously Simple Podcasting plugin <= 3.5.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Seriously Simple Podcasting versions = 3.5.0...

Mbed TLS 安全漏洞

Mbed TLS is an open source, portable, easy to use, readable and flexible SSL library from Mbed TLS Open Source. A security vulnerability exists in Mbed TLS versions 3.5.0 through 3.6.1 that stems from a buffer underrun in pkwrite when writing opaque key pairs...

AZL-50073 CVE-2024-47764 affecting package js-jquery 3.5.0-4

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

WordPress Depicter Slider Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Depicter Slider Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.5.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47381 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c88e18af2d73 Credits savphill Required privilege Editor...

CVE-2023-52946

Buffer copy without checking size of input 'Classic Buffer Overflow' vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allows remote attackers to overwrite trivial buffers and crash the client via unspecified vectors...

Synology Drive 安全漏洞

Synology Drive is a collaborative office suite from China-based Synology Inc. The product includes document management, collaborative office and file synchronization and backup features. A security vulnerability exists in Synology Drive prior to version 3.5.0-16084, which stems from the presence ...

AZL-49158 CVE-2024-45296 affecting package js-jquery 3.5.0-4

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

DataFlowX DataDiodeX 路径遍历漏洞

DataFlowX DataDiodeX is an application from DataFlowX, Inc. A path traversal vulnerability exists in DataFlowX DataDiodeX versions prior to 3.5.0, which stems from a vulnerability that exists in the improper restriction of pathnames to restricted directories, which allows path traversal...

PT-2024-29712 · Splashtop · Splashtop Streamer

Name of the Vulnerable Software and Affected Versions: Splashtop Streamer for Windows versions prior to 3.5.8.0 Description: The issue concerns the MSI installer for Splashtop Streamer for Windows, which uses a temporary folder with weak permissions during installation. A local user can exploit...

PT-2024-24826 · Jquery · Jquery

Name of the Vulnerable Software and Affected Versions: JQuery versions prior to 3.5.0 Description: The camera may be susceptible to known vulnerabilities associated with JQuery versions prior to 3.5.0, a third-party component. Recommendations: For JQuery versions prior to 3.5.0, update to version...

AZL-43942 CVE-2024-34702 affecting package botan2 2.14.0-2

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints...

ALPINE-CVE-2024-34702

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints...

AZL-44286 CVE-2024-39312 affecting package botan2 2.14.0-2

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtree...

CVE-2024-39312

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtree...