11664 matches found
PT-2024-23958 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to improper input validation in the AutofillManagerServiceImpl.java, specifically in the newServiceInfoLocked method. This could allow an enabled Autofill...
PT-2024-4856 · Microsoft · Xbox +1
Name of the Vulnerable Software and Affected Versions: Microsoft Xbox affected versions not specified Description: The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted malicious link or file. This can...
Siemens RUGGEDCOM
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
PT-2024-4801 · Microsoft · Windows Iscsi Service +1
Name of the Vulnerable Software and Affected Versions: Windows iSCSI Service affected versions not specified Description: The issue is related to an uncontrolled consumption of resources in the Windows iSCSI Service, which can be exploited by a remote attacker to cause a denial of service. This c...
PT-2024-18858 · Microsoft · Sql Server Native Client Ole Db Provider
Name of the Vulnerable Software and Affected Versions: SQL Server Native Client OLE DB Provider affected versions not specified Description: The issue is related to a remote code execution vulnerability. There is no information provided about the estimated number of potentially affected devices...
CLSA-2024-1720468480 kernel: Fix of 89 CVEs
kvm: initialize all of the kvmdebugregs structure before sending it to userspace CVE-2023-1513 - wifi: mac80211: fix MBSSID parsing use-after-free CVE-2022-42719 - mac80211: always allocate struct ieee80211elems CVE-2022-42719 - netfilter: nftables: initialize registers in nftdochain...
Dark Web Malware Logs Expose 3,300 Users Linked to Child Abuse Sites
An analysis of information-stealing malware logs published on the dark web has led to the discovery of thousands of consumers of child sexual abuse material CSAM, indicating how such information could be used to combat serious crimes. "Approximately 3,300 unique users were found with accounts on...
qemu-kvm: 'qemu-img info' leads to host file read/write
A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...
qemu-kvm: 'qemu-img info' leads to host file read/write
A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...
WordPress WP Cookie Law Info plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by filime Patchstack Alliance in WordPress Plugin WP Cookie Law Info versions = 1.1...
PT-2024-27376 · WordPress · Wp Scraper
Name of the Vulnerable Software and Affected Versions: WP Scraper versions 5.7 and earlier Description: A Server-Side Request Forgery SSRF issue has been identified. This issue allows an attacker to forge requests from the server, potentially leading to unauthorized access to internal resources...
WordPress WP Cookie Law Info Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Software WP Cookie Law Info Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37557 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f9392fcaab80 Credits filime Required privilege Administrator...
PT-2024-5464 · Google +6 · Google Chrome +7
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.182 Microsoft Edge versions affected versions not specified Description: The issue is related to an out of bounds memory access in the V8 JavaScript engine, allowing a remote attacker to potentially...
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Impact The Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of an XSS vulnerability in an upstream...
CVE-2024-39023
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via admin/infodeal.php?mudi=add&nohrefStr=close...
PT-2024-7053
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue is related to a mistake in the rtw89 sta info get iter function, where status-he gi is compared to array size, but then rate-he gi is used as an array index instead of status-he gi...
The vulnerability of the System Info Page component of the Data Management System’s SourceCodester Service Provider Management System allows a attacker to perform XSS attacks.
The vulnerability of the System Info Page component of the Data Management System SourceCodester Service Provider Management System exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...
Insertion Of Sensitive Information Into Sent Data
github.com/pomerium/pomerium is vulnerable to Insertion of Sensitive Information Into Sent Data. The vulnerability is due to the inclusion of serialized OAuth2 access and ID tokens from the logged-in user's session in the user info page /.pomerium...
GO-2024-2965 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium...
