CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...

PT-2024-3679 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 1.42.2 Description: The issue is caused by errors in synchronization when using a shared resource in the Deno runtime environment for JavaScript and TypeScript. Exploitation of this issue may allow an attacker to disclo...

SUSE CVE-2021-47185

In the Linux kernel, the following vulnerability has been resolved: tty: ttybuffer: Fix the softlockup issue in flushtoldisc When running ltp testcaseltp/testcases/kernel/pty/pty04.c with arm64, there is a soft lockup, which look like this one: Workqueue: eventsunbound flushtoldisc Call trace:...

DEBIAN-CVE-2021-47185

In the Linux kernel, the following vulnerability has been resolved: tty: ttybuffer: Fix the softlockup issue in flushtoldisc When running ltp testcaseltp/testcases/kernel/pty/pty04.c with arm64, there is a soft lockup, which look like this one: Workqueue: eventsunbound flushtoldisc Call trace:...

UBUNTU-CVE-2021-47185

In the Linux kernel, the following vulnerability has been resolved: tty: ttybuffer: Fix the softlockup issue in flushtoldisc When running ltp testcaseltp/testcases/kernel/pty/pty04.c with arm64, there is a soft lockup, which look like this one: Workqueue: eventsunbound flushtoldisc Call trace:...

CVE-2024-29129 WordPress OxyExtras plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPLIT Pty Ltd OxyExtras allows Reflected XSS.This issue affects OxyExtras: from n/a through 1.4.4...

Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes

The threat actor known as TA577 has been observed using ZIP archive attachments in phishing emails with an aim to steal NT LAN Manager NTLM hashes. The new attack chain "can be used for sensitive information gathering purposes and to enable follow-on activity," enterprise security firm Proofpoint...

CVE-2024-24877

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9...

CVE-2024-24877

CVE-2024-24877 affects Wonder Slider Lite (Wonderplugin Slider Lite) up to version 13.9. This is a Reflected XSS caused by improper neutralization of input during web page generation. Public details from NVD indicate CVSS v3.1 base score around 6.1 (MEDIUM); PatchStack and related entries list a ...

CVE-2024-24877 WordPress Wonder Slider Lite Plugin <= 13.9 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9...

Graylog session fixation vulnerability through cookie injection

Impact Reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain elevated access to an existing Graylog login session, provided the malicious user could successfully inject...

CVE-2023-43295

Cross Site Request Forgery vulnerability in Click Studios SA Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request...

Code injection

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions...

Cross site request forgery (csrf)

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery CSRF...

Cross site scripting

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...

CVE-2022-36246 Shop Beat Services Vulnerable To Insecure Permissions

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions...

CVE-2022-36250

Shop Beat Media Player versions 2.5.95 through 3.2.57 are affected by a Cross Site Request Forgery (CSRF) vulnerability. The vulnerability enables CSRF attacks that could trick authenticated users into performing unintended actions. The connected PT-2023-13467 entry notes a CSRF issue and recomme...

CVE-2022-36247

Shop Beat Media Player versions 2.5.95–3.2.57 are vulnerable to an Insecure Direct Object Reference (IDOR) via controlpanel.shopbeat.co.za. The root cause is IDOR, leading to unauthorized access to resources; CVSS 3.1 indicates high confidentiality and integrity impact (score 9.1). No patch/versi...

CVE-2022-36246

CVE-2022-36246 affects Shop Beat Media Player versions 2.5.95 through 3.2.57. The issue is an insecure permissions vulnerability in the product, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, Network attack, no user interaction). Root cause and technical exploit ...