WordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Express Payments Module versions = 1.1.8...

DEBIAN-CVE-2024-50296

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF is disabled concurrently, a kernel crash occurs. The reason is that the two actions call function pcidisablesriov. The numVFs is check...

WordPress Express Payments Module Plugin <= 1.1.8 is vulnerable to SQL Injection

Software Express Payments Module Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-52474 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d7d5c29bb8d4 Credits LVT-tholv2k Required privilege...

Security Bulletin: IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component uses third party libraries which is vulnerable to multiple CVEs

Summary IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component uses FlaskCors-4.0.1-py2.py3-none-any.whl, requests-2.31.0-py3-none-any.whl, express-4.19.2.tgz, commons-compress-1.22.jar, commons-io-2.11.0.jar, urllib3-1.26.18-py2.py3-none-any.whl,...

qemu-kvm: pcie: improper validation of NumVFs leads to buffer overflow

A flaw was found in the SR/IOV emulation support of QEMU. The registervfs function in hw/pci/pciesriov.c mishandled the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF Virtual Function implementations. This flaw allows a malicious guest to crash QEM...

kernel: cxl/pmem: Fix nvdimm registration races

A race condition was found in the CXL persistent memory driver. Rapid module load/unload cycles can cause async nvdimm device registration to run after the CXL context has been torn down, resulting in a NULL pointer dereference...

kernel: PCI/ASPM: Fix deadlock when enabling ASPM

A flaw was found in the Linux kernel, where a deadlock scenario was triggered when enabling Active State Power Management ASPM during the probe of Qualcomm PCIe controllers. This deadlock was identified by lockdep and stemmed from a recursive locking scenario. This issue occurred when a task...

AZL-53444 CVE-2024-50163 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpfredirect flags don't overlap The bpfredirectinfo is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri-flags field specifically,...

UBUNTU-CVE-2024-50163

In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpfredirect flags don't overlap The bpfredirectinfo is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri-flags field specifically,...

Epson Express Home XP255 安全漏洞

The Epson Express Home XP255 is a printer from the Japanese company Epson Epson. A security vulnerability exists in the Epson Express Home XP255 version 20.08, which stems from lax management of access rights to the public community for SNMPv1 and the epson community, which allows unauthorized...

Epson Express Home XP255 安全漏洞

The Epson Express Home XP255 is a printer from Epson Japan. A security vulnerability exists in the Epson Express Home XP255 version 20.08, which stems from a failure to validate the legitimacy of a POST request via a CSRF token or other mechanism, making it susceptible to cross-site request forge...

SUSE CVE-2024-50135

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvmedevdisable nvmedevdisable modifies the dev-onlinequeues field, therefore nvmepciupdatenrqueues should avoid racing against it, otherwise we could end up passing invalid values to...

The vulnerability of the nvme_directive_receive() function in the NVMe emulator virtual device of the QEMU hardware infrastructure, which allows a hacker to trigger a service failure.

The vulnerability of the nvmedirectivereceive function in the NVMe virtual device emulator for QEMU hardware infrastructure is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Express ressource injection

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...

GHSA-CM5G-3PGC-8RG4 Express ressource injection

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...

CVE-2024-10491

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...

DEBIAN-CVE-2024-10491

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...

UBUNTU-CVE-2024-10491

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...

CVE-2024-10491 Preload arbitrary resources by injecting additional `Link` headers

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...

CVE-2024-10491

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in "Link" header values, which can allow a combination of characters like ",", ";", a...