libsoup 安全漏洞

libsoup is a GNOME HTTP client/server library from the GNOME Project. A security vulnerability exists in libsoup versions prior to 3.6.0, which stems from allowing HTTP request smuggling in certain configurations...

SUSE CVE-2024-47827

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...

CVE-2024-47827

A flaw was found in Argo Workflows. Due to a race condition in a global variable, the Argo Workflows controller can crash on command by any user with access to execute a workflow, which can lead to a denial of service...

CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...

SUSE CVE-2024-50382

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V...

DEBIAN-CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

CVE-2024-50382

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V...

Botan 安全漏洞

Botan is a C++ cryptographic library by the individual developer Jack Lloyd. A security vulnerability exists in versions of Botan prior to 3.6.0, which stems from a compiler-caused secret dependency operation when compiling with some versions of GCC. An addition operation could be skipped if the...

Botan 安全漏洞

Botan is a C++ cryptographic library by the individual developer Jack Lloyd. A security vulnerability exists in Botan versions prior to 3.6.0, which stems from a compiler-caused secret dependency control flow when compiling with certain versions of LLVM...

CVE-2024-9863

CVE-2024-9863 affects the WordPress UserPro plugin (versions up to 3.6.0). Root cause: insecure default_user_role setting (administrator) enables unauthenticated users to register an administrator. Impact: privilege escalation; can occur even if registration is disabled. Public details confirm af...

CVE-2024-9861 Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated...

CVE-2024-9861

CVE-2024-9861 affects the Miniorange OTP Verification with Firebase WordPress plugin. Versions up to and including 3.6.0 fail to validate the OTP login token, enabling unauthenticated attackers to log in as any existing user (e.g., admin) if they know that user’s phone number. Multiple sources co...

WordPress plugin UserPro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Miniorange OTP Verification with Firebase plugin <= 3.6.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Miniorange OTP Verification with Firebase versions = 3.6.0...

WordPress Miniorange OTP Verification with Firebase plugin <= 3.6.0 - Unauthenticated Arbitrary User Password Change vulnerability

Unauthenticated Arbitrary User Password Change vulnerability discovered by István Márton in WordPress Plugin Miniorange OTP Verification with Firebase versions = 3.6.0...

PT-2024-39895 · WordPress · Userpro

Name of the Vulnerable Software and Affected Versions: UserPro plugin for WordPress versions up to, and including, 3.6.0 Description: The issue is related to privilege escalation due to the insecure 'administrator' default value for the default user role option. This allows unauthenticated...

WordPress Miniorange OTP Verification with Firebase Plugin <= 3.6.0 is vulnerable to Broken Authentication

Software Miniorange OTP Verification with Firebase Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9861 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID...

PT-2024-39894 · WordPress · Miniorange Otp Verification With Firebase

Name of the Vulnerable Software and Affected Versions: Miniorange OTP Verification with Firebase plugin for WordPress versions up to, and including, 3.6.0 Description: The issue allows unauthenticated attackers to change user passwords and potentially take over administrator accounts due to the...

WordPress Miniorange OTP Verification with Firebase Plugin <= 3.6.0 is vulnerable to Broken Authentication

Software Miniorange OTP Verification with Firebase Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-9862 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 712edfb96dcd Credits...

PT-2024-32684 · WordPress · Wp Travel Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: WP Travel Gutenberg Blocks versions 3.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in WP Travel Gutenberg...