AZL-47759 CVE-2024-7006 affecting package libtiff for versions less than 4.6.0-3

A null pointer dereference flaw was found in Libtiff via tifdirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash,...

AZL-47774 CVE-2024-43168 affecting package unbound for versions less than 1.19.1-2

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...

CVE-2024-36518

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard...

CVE-2024-36035 SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording...

CVE-2024-7512 Concrete CMS Stored XSS in Board instances

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.6 with vector:...

AZL-48706 CVE-2024-42252 affecting package kernel for versions less than 6.6.64.2-9

In the Linux kernel, the following vulnerability has been resolved: closures: Change BUGON to WARNON If a BUGON can be hit in the wild, it shouldn't be a BUGON For reference, this has popped up once in the CI, and we'll need more info to debug it: 03240 ------------ cut here ------------ 03240...

PT-2024-38321 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9 through 9.3.2 Concrete CMS versions below 8.5.18 Description: The issue concerns a Stored XSS vulnerability in the getAttributeSetName function. A rogue administrator could inject malicious code. Recommendations: For...

AZL-47498 CVE-2024-42237 affecting package kernel for versions less than 6.6.43.1-7

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

WordPress Selection Lite plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Selection Lite versions = 1.11...

WordPress WordPress File Upload plugin < 4.24.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Majdeddine Ben Hadj Brahim in WordPress Plugin WordPress File Upload versions 4.24.8...

SUSE CVE-2024-7520

A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

SUSE CVE-2024-7528

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

Drupal Opigno Learning path module < 3.1.2 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Marcin Grabias in WordPress Module Opigno Learning path versions 3.1.2...

Drupal Opigno module module < 3.1.2 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Marcin Grabias in WordPress Module Opigno module versions 3.1.2...

CVE-2024-23483

An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS 4.2...

CVE-2024-23460

The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS 4.2...

DEBIAN-CVE-2024-7522

Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

DEBIAN-CVE-2024-7521

Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

CVE-2024-7518

Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

WordPress WordPress File Upload plugin < 4.24.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Đức Tài in WordPress Plugin WordPress File Upload versions 4.24.8...