13197 matches found
ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure ...
ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure ...
bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
A flaw was found in bind9. By flooding a DNSSEC resolver with responses coming from a DNSEC-signed zone using NSEC3, an attacker can lead the targeted resolver to a CPU exhaustion, further leading to a Denial of Service on the targeted host. This vulnerability applies only for systems where DNSSE...
bind9: Parsing large DNS messages may cause excessive CPU load
A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service...
WordPress plugin WPKoi Templates for Elementor 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-31286 · WordPress · Awesome Contact Form7
Name of the Vulnerable Software and Affected Versions: Awesome Contact Form7 for Elementor plugin for WordPress versions up to, and including, 2.9 Description: The issue is related to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget due to insufficient input sanitization and output...
Blackprint 安全漏洞
Blackprint is a visual programming interface from Blackprint Open Source. A security vulnerability exists in blackprint version v.0.9.0, which originated from a vulnerability that allows attackers to execute arbitrary code via the utils.setDeepProperty function of engine.min.js...
PT-2024-5352 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.11.3 Argo CD versions prior to 2.10.12 Argo CD versions prior to 2.9.17 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate...
WordPress Essential Addons for Elementor plugin <= 5.9.15 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Essential Addons for Elementor versions = 5.9.15...
WordPress plugin Chauffeur Taxi Booking System 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in versions of Linux kernel prior to 6.9, which stems from the fact that an untrusted hypervisor can inject a virtual interrupt and trigger its...
bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
A flaw was found in bind9. By flooding a DNSSEC resolver with responses coming from a DNSEC-signed zone using NSEC3, an attacker can lead the targeted resolver to a CPU exhaustion, further leading to a Denial of Service on the targeted host. This vulnerability applies only for systems where DNSSE...
CVE-2024-30274
Substance3D - Painter versions 9.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
Intel FPGA 安全漏洞
Intel FPGA products is a family of software applications from Intel Corporation USA. A security vulnerability exists in Intel FPGA prior to version 2.9.0 that stems from an out-of-bounds write issue. It could lead to privilege escalation and information disclosure...
Intel Thunderbolt DCH drivers 安全漏洞
Intel Thunderbolt DCH drivers is a driver for Windows from Intel Corporation USA. A security vulnerability exists in Intel Thunderbolt DCH drivers prior to version 89, which stems from an improper access control issue. It could allow an authenticated user to escalate privileges via local access...
Intel FPGA products 安全漏洞
Intel FPGA products is a family of software applications from Intel Corporation USA. A security vulnerability exists in Intel FPGA products prior to version 2.9.1 that stems from an incorrect input validation issue. A denial of service attack may be allowed...
PT-2024-25806 · Parisneo · Lollms-Webui
Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions prior to 9.5 Description: A path traversal issue exists in the "save settings" endpoint due to insufficient sanitization of the config parameter in the apply settings function. This allows an attacker to...
PHP Shopping Cart SQL注入漏洞
PHP Shopping Cart is an open source shopping cart system by Phpjabbers. PHP Shopping Cart version 0.9 suffers from a SQL injection vulnerability that stems from the presence of a SQL injection vulnerability that allows an attacker to retrieve all information stored in the database by sending a...
The vulnerability of the Temp File Handler component in the Plan 9 rc command line interface allows a hacker to create arbitrary temporary files.
The vulnerability of the Temp File Handler component in the Plan 9 rc shell environment is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to create arbitrary temporary files...