CVE-2024-47815 Cross-site Scripting in IncidentReporting

IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those w...

CVE-2024-9675

creationtimestamp| type| source ---|---|--- 2024-10-09 18:09:35+00:00| seen| https://t.me/cvedetector/7482 2025-03-11 02:40:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7100 2025-03-11 04:41:14+00:00| seen| Telegram/Pt4fFyvF70RTIDh0c52rTM9OVYsTLILGhiRshDwuSuo3m8M5 2025-04-10...

CVE-2024-45746

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided and controlled mailbox messages contain a pointer to a list of input arguments invec and output arguments outvec. These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

UBUNTU-CVE-2023-36325

i2p before 2.3.0 Java allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services aka eepsites via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior discrepancy it may be dropped, or may result in a Wrong...

Denial Of Service (DoS)

@rocket.chat/message-parser is vulnerable to Denial Of Service DoS. The vulnerability is due to by crafted messages with specific characters crashing the workspace due to an issue in the message parser, allowing an attacker to exploit this weakness...

Open WebUI Information Leakage Vulnerability

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. An information disclosure vulnerability exists in Open WebUI version v0.3.8, which stems from the presence of an information disclosure vulnerability that allows an attacker to disclose sensiti...

PT-2024-39761 · WordPress · Notification For Telegram

Name of the Vulnerable Software and Affected Versions: The Notification for Telegram plugin for WordPress versions up to, and including, 3.3.1 Description: The issue allows authenticated attackers with subscriber-level access and above to send unauthorized test messages via the Telegram Bot API t...

CVE-2024-47832: Improper Verification of Cryptographic Signature

ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers...

CVE-2024-42934

OpenIPMI before 2.0.36 has an out-of-bounds array access for authentication type in the ipmisim simulator, resulting in denial of service or with very low probability authentication bypass or code execution...

ImportDump security vulnerabilities

ImportDump is an open source application from Miraheze. A security vulnerability exists in ImportDump, which stems from the fact that anyone who can edit wiki interface strings can embed cross-site scripting in date messages...

Citrix Virtual Apps and Desktops: Session Launch Issues

Introduction This article provides a list of Knowledge Base resources on how to investigate, troubleshoot, and prevent the most common issues with session launch in Citrix Virtual Apps and Desktops. Overview of the Issue The process of session launch in Citrix Virtual Apps and Desktops is depende...

CentOS 7 : kernel-alt (RHSA-2021:1379)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1379 advisory. - An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idlebook3s.S does not have save/restore...

CVE-2024-45746

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided and controlled mailbox messages contain a pointer to a list of input arguments invec and output arguments outvec. These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length...

CVE-2024-45746

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided and controlled mailbox messages contain a pointer to a list of input arguments invec and output arguments outvec. These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length...

CentOS 7 : thunderbird (RHSA-2022:9079)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:9079 advisory. - If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER...

CentOS 7 : kpatch-patch (RHSA-2021:1069)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1069 advisory. - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsitransportiscsi.c is adversely affected by the ability of an unprivileged...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

Fedora 39 : webkitgtk (2024-e1357fc22f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e1357fc22f advisory. Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent fi...