WordPress theme The Next 安全漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress theme The Next version 1.1.0 and earlier version...

PT-2024-38421 · WordPress · The Next

Name of the Vulnerable Software and Affected Versions: The Next theme for WordPress versions up to, and including, 1.1.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input from the wpeden post...

WordPress The Next theme <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme The Next LVL versions = 1.1.0...

WordPress The Next LVL Theme <= 1.1.0 is vulnerable to PHP Object Injection

Software The Next LVL Type Theme Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7561 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID b79740b6d53a Credits Francesco Carlucci Required privilege...

Medium: openssl

Issue Overview: Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected applicati...

Introducing the Rapid7 Command Platform

Integrated Security Operations for the Next-Generation Attack Surface As cybercrime and attack surfaces have sprawled, Rapid7 has been able to grow with our customers because we are relentlessly focused on relevance. The way we see it, relevance doesn’t mean aligning to market definitions of...

CVE-2024-42109

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nftctxupdate include/net/netfilter/nftables.h:1831 KASAN: slab-uaf in nftcommitrelease net/netfilter/nftablesapi.c:9530...

CVE-2024-42161 bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPFCOREREADBITFIELD Changes from V1: - Use a default branch in the switch statement to initialize val'. GCC warns that val' may be used uninitialized in the BPFCREREADBITFIELD macro, defined in...

CVE-2024-42109 netfilter: nf_tables: unconditionally flush pending work before notifier

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nftctxupdate include/net/netfilter/nftables.h:1831 KASAN: slab-uaf in nftcommitrelease net/netfilter/nftablesapi.c:9530...

DEBIAN-CVE-2024-41032

In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: check if a hash-index is in cpupossiblemask The problem is that there are systems where cpupossiblemask has gaps between set CPUs, for example SPARC. In this scenario addrtovbxa hash function can return an index whic...

Italtel i-MCS NFV 安全漏洞

Italtel i-MCS NFV is an IMS/NGN core and border suite from Italtel Italy. A security vulnerability exists in Italtel i-MCS NFV version 12.1.0-20211215, which stems from stored cross-site scripting that may occur via POST parameters...

CBL Mariner 2.0 Security Update: cloud-hypervisor-cvm / openssl (CVE-2024-5535)

The version of cloud-hypervisor-cvm / openssl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5535 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty...

Malicious code in next-react-notify (npm)

The package executes multiple malicious commands to download and execute further payloads. The tactics used are characteristic of an ongoing North Korean campaign...

Medium: edk2

Issue Overview: Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected applicati...

PT-2024-10477 · Ibm · Ibm Engineering Requirements Management Doors Next

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management DOORS Next versions 7.0.2 and 7.0.3 Description: IBM Engineering Requirements Management DOORS Next is susceptible to a race condition that can allow a remote attacker to bypass security restrictions an...

CVE-2022-48841

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in iceupdatevsitxringstats It is possible to do NULL pointer dereference in routine that updates Tx ring stats. Currently only stats and bytes are updated when ring pointer is valid, but later on...

UBUNTU-CVE-2022-48841

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in iceupdatevsitxringstats It is possible to do NULL pointer dereference in routine that updates Tx ring stats. Currently only stats and bytes are updated when ring pointer is valid, but later on...

Denial Of Service (DoS)

next is vulnerable to Denial of Service DoS. The vulnerability is due to an unspecified bug which can trigger an application crash, resulting in Denial of Service DoS...

Prototype Pollution

@jsonic/jsonic-next is vulnerable to Prototype Pollution. The vulnerability is due to the functions empty, util.clone, util.prop, util.deep, and make not properly handling inputs containing the special property proto. Attackers can exploit this to modify the built-in Object.prototype, potentially...

Prototype Pollution

@jsonic/jsonic-next is vulnerable to Prototype Pollution. The vulnerability is due to several functions including empty, util.clone, util.prop, util.deep, and make, which can be exploited by passing crafted arguments with the proto property. This allows attackers to alter the behavior of all...