CVE-2024-42475 OAuth library for nim allows insecure generation of state values by generateState - entropy too low and uses regular PRNG instead of CSPRNG

In the OAuth library for nim prior to version 0.11, the state values generated by the generateState function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected...

Boa 安全漏洞

Boa is a Boa open source open source code for embedded applications. A security vulnerability exists in Boa versions prior to 0.16 through 0.19.0, which stems from a vulnerability that allows an attacker to trigger a state transition in an AsyncGenerator object via carefully constructed code,...

Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`

A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Details Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by method...

RUSTSEC-2024-0444 Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`

A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Details Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by method...

Employees Pay Slip PDF Generator System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Employees Pay Slip PDF Generator System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefo...

Oracle Linux 8 : edk2 (ELSA-2024-5297)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5297 advisory. - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch RHEL-21854 RHEL-21856 RHEL-40099 - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch...

The vulnerability of the OpenAPI Generator software for automatically generating client libraries arises from incorrect restrictions on the path name to the restricted access directory. This allows attackers to circumvent security restrictions and gain read, modify, or delete access to data.

The vulnerability of the OpenAPI Generator software for automatically generating client libraries is related to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain access to...

Oracle Linux 9 : edk2 (ELSA-2024-4749)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4749 advisory. - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch RHEL-40270 RHEL-40272 - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch RHEL-40270...

[SECURITY] Fedora 39 Update: rapidjson-1.1.0-41.fc39

RapidJSON is a fast JSON parser and generator for C++. It was inspired by RapidXml. RapidJSON is small but complete. It supports both SAX and DOM style API. The SAX parser is only a half thousand lines of code. RapidJSON is fast. Its performance can be comparable to strlen. It also optionally...

Ubuntu 14.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6866-3)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6866-3 advisory. It was discovered that the ext4 file system implementation in the Linux kernel did not properly validate data state on write operations. An attacker coul...

Ubuntu: Security Advisory (USN-6866-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6866-3: Linux kernel (Azure) vulnerabilities

It was discovered that the ext4 file system implementation in the Linux kernel did not properly validate data state on write operations. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service system crash. CVE-2021-33631 It w...

WordPress Featured Image Generator plugin <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Images Upload vulnerability discovered by Lucio Sá in WordPress Plugin Featured Image Generator versions = 1.3.1...

WordPress plugin Featured Image Generator security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2024-6316

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.0.6. This is due to missing nonce validation and missing file type validation in the 'wpcf7pdfdashboardhtmlpage' function. This makes...

RHEL 9 : edk2 (RHSA-2024:4419)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4419 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware f...

USN-6866-2: Linux kernel (Azure) vulnerabilities

It was discovered that the ext4 file system implementation in the Linux kernel did not properly validate data state on write operations. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service system crash. CVE-2021-33631 It w...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6866-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6866-2 advisory. It was discovered that the ext4 file system implementation in the Linux kernel did not properly validate data state on write operations. An...

USN-6865-1: Linux kernel vulnerabilities

It was discovered that the ext4 file system implementation in the Linux kernel did not properly validate data state on write operations. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service system crash. CVE-2021-33631 It w...