Medium: php8.2

Issue Overview: The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/138...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

...

GHSA-32JF-H775-G29H MongoDB Rust driver may issue unintended commands

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2...

PT-2024-27766 · Pingcap · Tidb

Name of the Vulnerable Software and Affected Versions: PingCAP TiDB versions prior to 8.2.0 Description: A nil pointer dereference in PingCAP TiDB allows attackers to crash the application via expression.inferCollation. Recommendations: For versions prior to 8.2.0, update to version 8.2.0 or late...

CVE-2024-35757

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in 5 Star Plugins Easy Age Verify allows Stored XSS.This issue affects Easy Age Verify: from n/a through 1.8.2...

OESA-2024-1734 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Important: php8.2

Issue Overview: The vulnerability allows a remote attacker to bypass implemented security restrictions. The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cook...

IBM TXSeries for Multiplatforms 安全漏洞

IBM TXSeries for Multiplatforms is a transaction monitoring and management software product from International Business Machines IBM designed to support distributed transaction processing on multiple platforms. A security vulnerability exists in IBM TXSeries for Multiplatforms version 8.2 that...

QEMU 安全漏洞

QEMU Quick Emulator is a suite of simulation processor software by Fabrice Bellard, an individual developer in France. The software is fast and cross-platform. A security vulnerability exists in QEMU versions 8.2.3 and 9.0.0, which stems from a flaw found in QEMU in the Virtio PCI binding...

PT-2024-19351 · Ibm · Ibm Txseries For Multiplatforms

Name of the Vulnerable Software and Affected Versions: IBM TXSeries for Multiplatforms version 8.2 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For IBM TXSeries for Multiplatforms version 8.2, consider...

PT-2025-40555

Name of the Vulnerable Software and Affected Versions Redis versions 8.2.1 and below Redis versions prior to 8.2.2 Description Redis, an in-memory database, contains an issue where an authenticated user can utilize a crafted Lua script to trigger an integer overflow. This could potentially lead t...

PHP 安全漏洞

PHP is a scripting language that executes on the server side. A security vulnerability exists in PHP where a password stored using the passwordhash function begins with a null byte x00, and testing a blank string as the password via the passwordverify function will incorrectly return true. the...

WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability

Group Members Limit Bypass vulnerability discovered by Kyle Sanchez Patchstack Alliance in WordPress Plugin ProfileGrid versions = 5.8.2...

apache-airflow-providers-smtp (>=1.0.0rc1 <=1.8.1rc1) potentially affected by CVE-2024-29735 via apache-airflow (=2.8.2)

apache-airflow PYPI version =2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-airflow-providers-smtp =1.0.0rc1, =1.8.1rc1 Source cves: CVE-2024-29735 Source advisory: OSV:GHSA-CFF3-5QRP-HQX7...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions 2.8.2 through 2.8...

PT-2024-22174 · WordPress · Wp Enhanced Free Downloads Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Enhanced Free Downloads WooCommerce versions 3.5.8.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically Stored...

PYSEC-2024-42

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view.With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by defaul...

Intel Ethernet Products Security Vulnerability

Intel Ethernet Products is a networking product from Intel Corporation. A security vulnerability exists in Intel Ethernet Products versions prior to 28.2, which stems from an issue with incorrect access control elements that could lead to privilege escalation via local access by an authenticated...

Pegasystem PEGA Platform Security Vulnerability

Pegasystem PEGA Platform is a suite of application development platforms from the US-based Pegasystem. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-Time Decision Making and CRM Customer Relationship Management. A security vulnerabilit...

UBUNTU-CVE-2024-20969

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...