MAL-2024-8841 Malicious code in @sky-team/create-project-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c63ed97fa2890cd36683d943cad94b27fa57e5a87b9b16fa38a55970163af5a1 The OpenSSF Package Analysis project identified '@sky-team/create-project-modal' @ 99.50.55 npm as malicious. It is considered malicious because...

PT-2024-39120 · Learning Digital · Orca Hcm

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITAL affected versions not specified Description: The issue is related to a missing authentication vulnerability, allowing an unauthenticated remote attacker to exploit the functionality and create an account with...

CVE-2024-6010

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'createccorder' function, called from the Cost Calculator Builder...

DEBIAN-CVE-2024-45008

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

UBUNTU-CVE-2024-45008

In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...

kernel: mm/slub: fix to return errno if kmalloc() fails

In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc fails In createuniqueid, kmalloc, GFPKERNEL can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic via BUGON; kernel BUG at mm/slub.c:5893! Internal...

kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPFPROGTYPECGROUPSKB attach type enforcement in BPFLINKCREATE bpfprogattach uses attachtypetoprogtype to enforce proper attach type for BPFPROGTYPECGROUPSKB. linkcreate uses bpfprogget and relies on...

WordPress plugin MultiVendorX has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-8236

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to a use-after-free vulnerability in the ext4 ext insert extent function. This vulnerability can be exploited to impact the confidentiality, integrity, and availability o...

Free Hospital Management System For Small Practices 1.0 CSRF

============================================================================================================================================= | Title : Vaidya-Mitra v 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | |...

AD CS Certificate Template Management

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AD CS Certificate Template Management', 'Description' = %q This module can create, read, update, and delete AD CS certificate templates from a...

GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server

Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server...

PT-2024-34075

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A general protection fault in the run is mapped full function has been fixed. The issue was related to the deletion of a non-resident attribute in ntfs create inode. Recommendations: For...

FeehiCMS code-related vulnerabilities

FeehiCMS is a content management system CMS based on the Yii2 framework, aiming to provide Yii2 enthusiasts with a full-featured CMS system so that developers can focus more on the development of business functions. A security vulnerability exists in FeehiCMS. The vulnerability is related to the...

FeehiCMS code-related vulnerabilities

FeehiCMS is a Php based CMS website builder by Liufee personal developer. A code issue vulnerability exists in FeehiCMS version 2.1.1 and prior versions, which originates from an unverified file upload vulnerability in the Useravatar parameter of the /admin/index.php?r=user%2Fcreate file...

PT-2024-38922 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: FeehiCMS versions up to 2.1.1 Description: A critical issue has been found in FeehiCMS, affecting the createBanner function of the file /admin/index.php?r=banner%2Fbanner-create. The manipulation of the argument BannerFormimg leads to...

postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks

A flaw was found in PostgreSQL. Missing authorization in the built-in views pgstatsext and pgstatsextexprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the...

CVE-2024-42900: Improper Neutralization of Input During Web Page Generation

Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting XSS vulnerability via the sql parameter of the createTable function at /tool/gen/create...

CVE-2024-42900

Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting XSS vulnerability via the sql parameter of the createTable function at /tool/gen/create...

RuoYi security vulnerabilities

RuoYi is a back-end management system by the individual developer of RuoYi in China. A security vulnerability exists in RuoYi v4.7.9, which is caused by a cross-site scripting XSS vulnerability in the sql parameter of the createTable function at /tool/gen/create...