267 matches found
CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer
Wasmer is a web assembly wasm Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime ...
CVE-2024-38462
iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cppL94-L106 reference...
CVE-2024-38461
Summary: CVE-2024-38461 affects iRODS before 4.3.2, specifically the irodsServerMonPerf component. The issue arises when the code attempts to proceed with a path that is not a directory, potentially causing unintended behavior. Affected software/versions: iRODS prior to 4.3.2. Root cause (as stat...
CVE-2024-38461
irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory...
CVE-2024-38462
iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cppL94-L106 reference...
PT-2024-28017 · Irods · Irods
Name of the Vulnerable Software and Affected Versions: iRODS versions prior to 4.3.2 Description: The issue arises when irodsServerMonPerf attempts to use a path even if it is not a directory. This can lead to unintended behavior. Recommendations: For versions prior to 4.3.2, update to version...
CVE-2024-38462
iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cppL94-L106 reference...
CVE-2024-38462
iRODS before 4.3.2 contains a vulnerability in msiSendMail with a problematic dependency on the mail binary (mailMS.cpp#L94-L106). Affected: versions prior to 4.3.2. Remediation: upgrade to 4.3.2 or later. No exploitation details are provided in the documents.
WordPress Popup Builder Plugin <= 4.3.1 is vulnerable to Broken Access Control
Software Popup Builder Type Plugin Vulnerable versions = 4.3.1 Fixed in 4.3.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6696 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 7eeb41bcfcb3 Credits Lucio Sá Required privilege...
PT-2024-31911 · WordPress · Apppresser
Name of the Vulnerable Software and Affected Versions: AppPresser plugin for WordPress versions up to, and including, 4.3.2 Description: The issue arises from improper missing encryption exception handling on the decrypt value and doCookieAuth functions. This allows unauthenticated attackers to l...
WordPress plugin AppPresser 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
BIT-RUBY-2020-5247 HTTP Response Splitting in Puma
In Puma RubyGem before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...
CVE-2023-32618
Uncontrolled search path in some IntelR oneAPI Toolkit and component software installers before version 4.3.2 may allow an authenticated user to potentially enable escalation of privilege via local access...
PT-2024-2728 · Intel · Intel Oneapi Toolkit
Name of the Vulnerable Software and Affected Versions: Intel oneAPI Toolkit versions prior to 4.3.2 Description: The issue is related to improper access control in some Intel oneAPI Toolkit and component software installers. This could potentially allow an authenticated user to enable denial of...
CVE-2022-45083 WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...
WordPress RSS Aggregator by Feedzy Plugin <= 4.3.2 is vulnerable to Cross Site Scripting (XSS)
Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.3.2 Fixed in 4.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6801 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7b021f6dbd31 Credits Colin Xu Requir...
WordPress RSS Aggregator by Feedzy Plugin <= 4.3.2 is vulnerable to Broken Access Control
Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.3.2 Fixed in 4.3.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6798 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID e743d5ddd389 Credits Colin Xu Required...
CVE-2023-6801
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes ...
PT-2024-15086 · WordPress · The Rss Aggregator By Feedzy – Feed To Post
Name of the Vulnerable Software and Affected Versions: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to, and including, 4.3.2 Description: The issue is related to a missing capability check when updating settings,...