CLSA-2024-1726651745 kernel: Fix of 4 CVEs

drm/vmwgfx: Validate the box size for the snooped cursor CVE-2022-36280 - USB: eneusb6250: Allocate enough memory for full object CVE-2023-45862 - Bluetooth: L2CAP: Fix attempting to access uninitialized memory CVE-2022-42895 - stm class: Fix a double free in stmregisterdevice CVE-2024-38627...

PT-2024-31973 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.115 Description: The issue is related to Cross Site Scripting XSS via the advertisement code box in the advertisement management module. This allows for potential malicious script execution. Recommendations: For DedeCMS...

CVE-2024-8091

The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8091

The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8091 Enhanced Search Box <= 0.6.1 - Settings Update via CSRF

The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin Enhanced Search Box 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-38798 · WordPress · Enhanced Search Box

Name of the Vulnerable Software and Affected Versions: Enhanced Search Box WordPress plugin versions 0.6.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

WordPress Enhanced Search Box plugin <= 0.6.1 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Enhanced Search Box versions = 0.6.1...

WordPress Enhanced Search Box Plugin <= 0.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Enhanced Search Box Type Plugin Vulnerable versions = 0.6.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8091 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID befef35233e6 Credits Daniel Ruf Require...

Gitea 1.22.0 - Stored XSS

Exploit Title: Stored XSS in Gitea Date: 27/08/2024 Exploit Authors: Catalin Iovita & Alexandru Postolache Vendor Homepage: https://github.com/go-gitea/gitea Version: 1.22.0 Tested on: Linux 5.15.0-107, Go 1.23.0 CVE: CVE-2024-6886 Vulnerability Description Gitea 1.22.0 is vulnerable to a Stored...

CVE-2024-43330

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack for Beaver Builder allows Reflected XSS.This issue affects PowerPack for Beaver Builder: from n/a before 2.37.4...

CVE-2024-7867

In Xpdf 4.05 and earlier, very large coordinates in a page box can cause an integer overflow and divide-by-zero...

UBUNTU-CVE-2024-7867

In Xpdf 4.05 and earlier, very large coordinates in a page box can cause an integer overflow and divide-by-zero...

CVE-2024-7867

In Xpdf 4.05 and earlier, very large coordinates in a page box can cause an integer overflow and divide-by-zero...

CVE-2024-7867 Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinates

In Xpdf 4.05 and earlier, very large coordinates in a page box can cause an integer overflow and divide-by-zero...

PT-2024-38644

Name of the Vulnerable Software and Affected Versions Xpdf versions 4.05 and earlier Description The issue arises when very large coordinates in a page box cause an integer overflow and divide-by-zero. Recommendations For Xpdf versions 4.05 and earlier, at the moment, there is no information abou...

CVE-2024-40892

A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy BTLE interface. Once an attacker gains access to the...

CVE-2024-40892 Firewalla BTLE Weak Credentials

A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy BTLE interface. Once an attacker gains access to the...

CVE-2024-40892

CVE-2024-40892 affects Firewalla Box software versions prior to 1.979. A physically proximate attacker can leverage the license UUID to authenticate and provision SSH credentials over BTLE, then log in via SSH once the attacker gains LAN access. License UUID can be obtained by plain-text Bluetoot...

WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions = 5.9.10...