PT-2024-34038

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A heap buffer overflow issue has been resolved in the Linux kernel. The problem occurs when BPF TRAMP F CALL ORIG is enabled, and the address of a bpf tramp image struct on the stack i...

CVE-2022-48974: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using thiscpuadd in preemptible Currently in nfconntrackhashcheckinsert, when it fails in nfctextvalidpre/post, NFCTSTATINC will be called in the preemptible context, a call trace can be triggered: BUG:...

PT-2024-33841

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue arises from the static call del module function, which fails to handle module initialization failures correctly. When a module is inserted, static call add module is invoked to...

Call and Register — Relay Attack on WinReg RPC Client

...

OSV-2024-1232 Segv on unknown address in cranelift_filetests::function_runner::Trampoline::call::hb2e77cf3a13ebaf4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=373522467 Crash type: Segv on unknown address Crash state: craneliftfiletests::functionrunner::Trampoline::call::hb2e77cf3a13ebaf4 craneliftfuzzgen::::run::hdb2f75e19950661f...

CVE-2024-49236

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box allows Stored XSS.This issue affects Crazy Call To Action Box: from n/a through 1.0.5...

CVE-2024-49236

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through = 1.0.5...

CVE-2024-49236 WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box allows Stored XSS.This issue affects Crazy Call To Action Box: from n/a through 1.0.5...

CVE-2024-49236 WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through = 1.0.5...

CVE-2024-49236

CVE-2024-49236 is a stored XSS in the WordPress plugin Crazy Call To Action Box, affecting versions up to 1.0.5. The issue arises from improper input neutralization during web page generation. Public disclosures confirm affected versions 1.0.0–1.0.5; Patchstack notes no fix available (Fixed in: N...

CVE-2024-49236: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through = 1.0.5...

WordPress plugin Crazy Call To Action Box has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the WordPress plugin Crazy Call ...

USN-7028-2 linux-azure vulnerabilities

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service system crash. Several security issues were discovered in the Linux kernel. An attacker could possibly use...

PT-2024-35554

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc2-build3+ Description The issue is related to lock recursion in the Linux kernel, specifically in the afs wake up async call function. This function can incur lock recursion when called from AF RXRPC whi...

CVE-2020-36840

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxrouteurl function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers t...

CVE-2021-4445

The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the padismissadminnotice AJAX action. This makes it possible for authenticated subscriber+ attackers to...

firmware: qcom: scm: Mark get_wq_ctx() as atomic call

...

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server which also serves protocols other than dnsserver will be restarted after a short delay but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate but many RPC services will not.

...

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request and chose to fragment it an attacker could replace later fragments with their own data bypassing the signature requirements.

...

WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Crazy Call To Action Box versions = 1.0.5...