UBUNTU-CVE-2024-55629

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data out of band data can lead to Suricata analyzing data differently than the applications at the TCP endpoints, leading to possible...

PT-2025-1490 · Unknown · Kali Forms

Name of the Vulnerable Software and Affected Versions: Kali Forms versions through 2.3.28 Description: The issue is related to a Missing Authorization vulnerability in the Kali Forms Contact Form builder with drag & drop, allowing exploitation of incorrectly configured access control security...

PT-2025-1503 · Unknown · Kali Forms

Name of the Vulnerable Software and Affected Versions: Kali Forms versions 2.3.27 and earlier Description: The issue is related to a Missing Authorization vulnerability in Kali Forms Contact Form builder with drag & drop, which allows exploiting incorrectly configured access control security...

PT-2026-5511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device leak exists in the dma-crossbar driver on the am335x platform during route allocation. The issue occurs because a reference to the crossbar platform device is not dropped when...

PT-2026-5512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device leak exists in the dmaengine subsystem, specifically within the stm32 dmamux component, during route allocation. The issue stems from failing to release a reference to the DMA m...

UBUNTU-CVE-2024-56749

In the Linux kernel, the following vulnerability has been resolved: dlm: fix dlmrecovermembers refcount on error If dlmrecovermembers fails we don't drop the references of the previous created rootlist that holds and keep all rsbs alive during the recovery. It might be not an unlikely event becau...

SUSE CVE-2024-53176

In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instances drop their dentry The unmount process cifskillsb calling closeallcacheddirs can race with various cached directory operations, which ultimately results in dentries not being...

AZL-55564 CVE-2024-53206 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsktimerhandler. The cited commit replaced inetcskreqskqueuedropandput with inetcskreqskqueuedrop and reqskput in reqsktimerhandler. Then, oreq should be passed to reqskput instead of req;...

CVE-2024-53176 smb: During unmount, ensure all cached dir instances drop their dentry

In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instances drop their dentry The unmount process cifskillsb calling closeallcacheddirs can race with various cached directory operations, which ultimately results in dentries not being...

CVE-2024-53176

The CVE covers a race in the Linux kernel SMB client (CIFS) during unmount: when unmounting, cached dentries may not be dropped due to racing with cached_dir operations, causing busy inodes and kernel BUGs. The fix introduces queued work in cfid_put_wq to drop dentries and flush it via close_all_...

BIT-NODE-MIN-2020-11080 Denial of service in nghttp2

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes 2400 individual settings entries over and over again. The attack causes th...

quarkus-core: Leak of local configuration properties into Quarkus applications

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been...

CVE-2024-10517 ProfilePress < 4.15.15 - Admin+ Stored XSS

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti...

CVE-2024-12201: Missing Authorization

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

CVE-2024-10517: Improper Neutralization of Input During Web Page Generation

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti...

[SECURITY] Fedora 41 Update: uv-0.5.5-2.fc41

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

CVE-2024-11436 Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization an...

CVE-2024-11436: Improper Neutralization of Input During Web Page Generation

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization an...

PT-2024-16991 · WordPress · The Drag & Drop Builder

Name of the Vulnerable Software and Affected Versions: The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress versions up to, and including, 1.4.19 Description: The issue is related to Reflected Cross-Site Scriptin...

WordPress Drag & Drop Builder plugin <= 1.4.19 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Colin Xu in WordPress Plugin Drag & Drop Builder versions = 1.4.19...