11656 matches found
PT-2024-39203 · WordPress · Waitlist Woocommerce
Name of the Vulnerable Software and Affected Versions: The Waitlist Woocommerce Back in stock notifier plugin for WordPress versions up to, and including, 2.7.5 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the...
New Android Malware 'Ajina.Banker' Steals Financial Data and Bypasses 2FA via Telegram
Bank customers in the Central Asia region have been targeted by a new strain of Android malware codenamed Ajina.Banker since at least November 2023 with the goal of harvesting financial information and intercepting two-factor authentication 2FA messages. Singapore-headquartered Group-IB, which...
SUSE CVE-2024-45022
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix page mapping if vmareaallocpages with high order fallback to order 0 The vmappagesrangenoflush assumes its argument pages contains pages with the same page shift. However, since commit e9c3cda4d86e "mm, vmalloc: f...
SUSE CVE-2024-45028
In the Linux kernel, the following vulnerability has been resolved: mmc: mmctest: Fix NULL dereference on allocation failure If the "test-highmem = allocpages" allocation fails then calling freepagestest-highmem will result in a NULL dereference. Also change the error code to -ENOMEM instead of...
AZL-49200 CVE-2024-45028 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: mmc: mmctest: Fix NULL dereference on allocation failure If the "test-highmem = allocpages" allocation fails then calling freepagestest-highmem will result in a NULL dereference. Also change the error code to -ENOMEM instead of...
UBUNTU-CVE-2024-45024
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb vs. core-mm PT locking We recently made GUP's common page table walking code to also walk hugetlb VMAs without most hugetlb special-casing, preparing for the future of having less hugetlb-specific page tab...
kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge
CVE-2024-36000 addresses a synchronization issue in the Linux kernel's management of huge pages. The problem arises when multiple threads modify the reservation map concurrently without proper locking, leading to potential inconsistencies and system instability...
kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domainsitree after splitting ioptarea In ioptareasplit, if the original ioptarea has filled a domain and is linked to domainsitree, pagesnodes have to be properly reinserted. Otherwise the...
CVE-2024-6792
The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...
WordPress plugin WP ULike 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
[SECURITY] Fedora 40 Update: seamonkey-2.53.19-1.fc40
SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...
Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service', 'Description' = %q The vulnerability allows remote unauthenticated attackers to force...
CVE-2024-5024 MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters
The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'meprscreenname' and 'meprkey' parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM SDK, Java Technology Edition Quarterly CPU - Jul 2024 are affected by multiple vulnerabilities
Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their July 2024 Critical Patch Update, plus CVE-2024-27267. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed i...
SUSE CVE-2024-44943
In the Linux kernel, the following vulnerability has been resolved: mm: gup: stop abusing trygrabfolio A kernel warning was reported when pinning folio in CMA memory when launching SEV virtual machine. The splat looks like: 464.325306 WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313...
DEBIAN-CVE-2024-44943
In the Linux kernel, the following vulnerability has been resolved: mm: gup: stop abusing trygrabfolio A kernel warning was reported when pinning folio in CMA memory when launching SEV virtual machine. The splat looks like: 464.325306 WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313...
New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials
Cybersecurity researchers are calling attention to a new QR code phishing aka quishing campaign that leverages Microsoft Sway infrastructure to host fake pages, once again highlighting the abuse of legitimate cloud offerings for malicious purposes. "By using legitimate cloud applications, attacke...
PT-2024-32203
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.9 Description The issue arises when PG hwpoison pages are freed and treated differently in free pages prepare, leading to isolation instead of release. Page allocation tag counters are decremented, consideri...
CVE-2024-41848 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...
