AZL-42175 CVE-2024-26952 affecting package kernel for versions less than 6.6.35.1-4

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial out-of-bounds when buffer offset is invalid I found potencial out-of-bounds when buffer offset fields of a few requests is invalid. This patch set the minimum value of buffer offset field to -Buffer offset to...

AZL-42207 CVE-2024-26952 affecting package kernel for versions less than 5.15.158.2-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial out-of-bounds when buffer offset is invalid I found potencial out-of-bounds when buffer offset fields of a few requests is invalid. This patch set the minimum value of buffer offset field to -Buffer offset to...

PT-2024-20661 · Check Point · Harmony Endpoint Security Client For Windows

Name of the Vulnerable Software and Affected Versions: Harmony Endpoint Security Client for Windows versions E88.10 and below Description: A local privilege escalation issue has been identified. To exploit this issue, an attacker must first obtain the ability to execute local privileged code on t...

SUSE CVE-2024-3865

Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 125...

CVE-2024-33522 Privilege escalation in Calico CNI install binary

In vulnerable versions of Calico v3.27.2 and below, Calico Enterprise v3.19.0-1, v3.18.1, v3.17.3 and below, and Calico Cloud v19.2.0 and below, an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. T...

AZL-40070 CVE-2024-2756 affecting package php for versions less than 8.1.28-1

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

WordPress WP Chat App plugin < 3.6.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP Chat App versions 3.6.4...

AZL-67458 CVE-2024-31755 affecting package apparmor for versions less than 3.1.7-1

cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c...

AZL-40184 CVE-2024-31755 affecting package apparmor for versions less than 3.0.4-4

cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c...

WordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Nexter Blocks versions = 3.2.5...

PT-2024-6663 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions 10.18.0.0 and below Description: The issue is related to an authentication bypass weakness in the message broker service, allowing a local authenticated attacker to escalate their privileges. This is due to t...

WordPress Strong Testimonials plugin < 3.1.12 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Strong Testimonials versions 3.1.12...

WordPress Better Comments plugin < 1.5.6 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Nicolo in WordPress Plugin Better Comments versions 1.5.6...

WordPress Better Comments plugin < 1.5.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Nicolo in WordPress Plugin Better Comments versions 1.5.6...

WordPress WooCommerce Customers Manager plugin < 29.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin WooCommerce Customers Manager versions 29.8...

AZL-40016 CVE-2024-3177 affecting package kubernetes for versions less than 1.30.1-1

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures...

WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin The Pack Elementor addons versions = 2.0.8.2...

WordPress Tickera plugin < 3.5.2.5 - Ticket leakage through IDOR vulnerability

Ticket leakage through IDOR vulnerability discovered by Martin Thirup Christensen in WordPress Plugin Tickera versions 3.5.2.5...

WordPress Automatic plugin < 3.93.0 - Multiple Cross Site Request Forgery (CSRF) vulnerability

Multiple Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Automatic versions 3.93.0...

WordPress WP Staging Pro plugin < 5.4.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Wp Staging Pro versions 5.4.0...