PT-2024-11105 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the xprtrdma component in the Linux kernel. After a reconnect, the reply handler opens the cwnd, enabling more RPC Calls to be sent before rpcrdma post recvs ca...

Easy Digital Downloads < 2.10.3 - Unauthorised Stripe Disconnect via CSRF

The plugin did not property check for CSRF when disconnecting Stripe, allowing attackers to make logged in users with the manageoptions capability disconnect the Stripe gateway via a CSRF attack. https://example.com/wp-admin/admin-post.php?page=edd-settings&edds-stripe-disconnect=1...

Easy Digital Downloads < 2.10.3 - Unauthorised Stripe Disconnect via CSRF

The plugin did not property check for CSRF when disconnecting Stripe, allowing attackers to make logged in users with the manageoptions capability disconnect the Stripe gateway via a CSRF attack. PoC https://example.com/wp-admin/admin-post.php?page=edd-settings&edds-stripe-disconnect;=1...

CVE-2021-24231

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...

CVE-2021-24231

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...

CVE-2021-24231 Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...

CVE-2021-24166

The wpajaxnfoauthdisconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection...

CVE-2021-24166

The wpajaxnfoauthdisconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection...

ALPINE-CVE-2021-29376

ircII before 20210314 allows remote attackers to cause a denial of service segmentation fault and client crash, disconnecting the victim from an IRC server via a crafted CTCP UTC message...

CVE-2021-29376

ircII before 20210314 allows remote attackers to cause a denial of service segmentation fault and client crash, disconnecting the victim from an IRC server via a crafted CTCP UTC message...

Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the plugin, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...

Update to Alert on Mitigating Microsoft Exchange Server Vulnerabilities

CISA is aware of threat actors using open source tools to search for vulnerable Microsoft Exchange Servers and advises entities to investigate for signs of a compromise from at least September 1, 2020. CISA has updated the Alert on the Microsoft Exchange server vulnerabilities with additional...

CVE-2021-1257

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The...

CVE-2021-1257 Cisco DNA Center Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The...

OSV-2018-40 UNKNOWN READ in ftp_disconnect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12173 Crash type: UNKNOWN READ Crash state: ftpdisconnect Curldisconnect ConnectionExists...

Combodo iTop 代码问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management functions. An information disclosure vulnerability exists in...

Mail.ru: Social Oauth Disconnect CSRF at znakcup.ru

The social-disconnect/twitter/ API maded possible to unlink Twitter OAuth from user account on znakcup.ru...

An issue was discovered in the Linux kernel through 5.10.1 as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.

...

CVE-2020-35555

An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 December 2020...

DEBIAN-CVE-2020-29569

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring-xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the...