WordPress Decode theme <= 3.15.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Decode versions = 3.15.3...

WordPress Decode Theme <= 3.15.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Decode Type Theme Vulnerable versions = 3.15.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31386 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cf688734f247 Credits Dhabaleshwar Das Required...

CVE-2024-31386: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet...

The vulnerability of the decode_uncompressed_image() function, a decoder and file format encoder for the libheif library, allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the decodeuncompressedimage function, a decoder and file format encoder for the libheif library, is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

net/http, x/net/http2: close connections when receiving too many headers

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-45288

The golang-golang-x-net and golang-1.19 packages (specifically used in Astra Linux ) are vulnerable to a flaw where an attacker can force an HTTP/2 endpoint to read arbitrary amounts of header data. This occurs by sending an excessive number of CONTINUATION frames ; while the system does not allo...

PT-2024-40685 · Git +1 · Openh264

Name of the Vulnerable Software and Affected Versions: Open-source software affected versions not specified Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the WelsDec::CWelsDecoder class, specifically in the ReorderPicturesInDisplay,...

PT-2024-11215 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to an incorrect limit in the filelayout decode layout function, where the size of struct nfs fh is two bytes too large, potentially leading to memory corruption. T...

CLSA-2024-1710786990 Fix CVE(s): CVE-2024-0727

SECURITY UPDATE: Potential Denial of Service via processing maliciously formatted PKCS12 file - debian/patches/CVE-2024-0727.patch: Fix decode error causing NULL pointer in PKCS12unpackp7data, PKCS12unpackp7encdata, PKCS12unpackauthsafes, SMIMEwritePKCS7, pkcs12genmac and newpassp12 functions -...

SUSE CVE-2023-52491

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun In mtkjpegprobe, &jpeg-jobtimeoutwork is bound with mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it...

Google Pixel Security Breach

Google Pixel is a smartphone from Google Inc. in the United States. A security vulnerability exists in Google Pixel, which stems from a missing bounds check in the EUTRANLCSDecodeFacilityInformationElement method of the LPPLcsManagement.c file, which may result in out-of-bounds reads...

PT-2024-21756 · Google · Android

Name of the Vulnerable Software and Affected Versions: LPP LcsManagement.c affected versions not specified Description: The issue is related to a possible out of bounds read in the EUTRAN LCS DecodeFacilityInformationElement function of LPP LcsManagement.c due to a missing bounds check. This coul...

[SECURITY] Fedora 40 Update: json_simple-1.1.1-34.fc40

JSON.simple is a simple Java toolkit for JSON. You can use JSON.simple to encode or decode JSON text. Full compliance with JSON specification RFC4627 and reliable Provides multiple functionalities such as encode, decode/parse and escape JSON text while keeping the library lightweight Flexible,...

PT-2024-40652 · Aom · Aom

Name of the Vulnerable Software and Affected Versions: aom affected versions not specified Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This error is identified in the get ls tile buffers...

PT-2024-40053 · Eth Abi · Eth Abi

Name of the Vulnerable Software and Affected Versions: eth-abi affected versions not specified Description: The issue is related to a recursive pointer problem. It can cause an OverflowError when decoding a specially crafted payload using the decode function from the eth abi module. The error...

json-jwt allows bypass of identity checks via a sign/encryption confusion attack

The json-jwt aka JSON::JWT gem 1.16.x before 1.16.6, 1.15.x before 1.15.3.1 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...

CVE-2023-51773

BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacappdecodeapplicationdata in bacapp.c...

CVE-2023-51774

The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...

Design/Logic Flaw

The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...

Fedora 39 : libxls (2024-e74783429c)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e74783429c advisory. Security fix for CVE-2023-38852 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...