kernel: drm/i915: Fix memory leaks in i915 selftests

A memory leak flaw was found in the Linux kernel's Intel i915 graphics driver in the selftest page allocation logic. A local user can trigger this issue when running i915 selftests and the fakegetpages function encounters errors, causing the function to return without freeing previously allocated...

kernel: memcontrol: ensure memcg acquired by id is properly set up

In the Linux kernel, the following vulnerability has been resolved: memcontrol: ensure memcg acquired by id is properly set up In the eviction recency check, we attempt to retrieve the memcg to which the folio belonged when it was evicted, by the memcg id stored in the shadow entry. However, ther...

Open Redirect

github.com/portainer/portainer is vulnerable to Open Redirect. The vulnerability is due to improper validation of user-supplied URLs which allow redirects to arbitrary web pages not limited to index.yaml...

aioHTTP < 3.9.4 XSS

The version of aioHTTP installed on the remote host is prior to 3.9.4. It is, therefore, affected by a cross-site scripting XSS vulnerability. aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This...

USN-6751-1 zabbix vulnerabilities

It was discovered that Zabbix incorrectly handled input data in the discovery and graphs pages. A remote authenticated attacker could possibly use this issue to perform reflected cross-site scripting XSS attacks. CVE-2022-35229, CVE-2022-35230...

eCommerce Product Catalog Plugin for WordPress < 3.3.33 - Reflected Cross-Site Scripting

Description The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.3.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

Open Redirect

cg is vulnerable to Open Redirect. The vulnerability is due to insufficient validation of the referrer header under certain conditions, allowing attackers to manipulate it and potentially redirect users to malicious websites, phishing pages, or other dangerous destinations...

SUSE CVE-2024-26869

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate meta inode pages forcely Below race case can cause data corruption: Thread A GC thread - gcdatasegment - radatablock - locked metainode page - f2fsinplacewritedata - invalidatemappingpages : fail to invalida...

[SECURITY] Fedora 40 Update: php-8.3.6-1.fc40

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2023-47435

An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages...

CVE-2023-47435

An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages...

SUSE CVE-2024-27306

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...

hexo-theme-matery 安全漏洞

hexo-theme-matery is a comprehensive and beautiful Hexo theme based on material design and responsive design by the individual developers at blinkfox. A security vulnerability exists in hexo-theme-matery version v2.0.0, which originated from a vulnerability that allows an attacker to bypass...

CVE-2023-47435

An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected pages...

TCPDF 安全漏洞

TCPDF is an open source library from Tecnick. It is used to generate PDF documents and barcodes. TCPDF 6.6.5 and earlier versions of a security vulnerability , the vulnerability stems from the use of carefully crafted color HTML pages vulnerable to denial of service attacks...

PT-2024-13451 · Unknown · Hexo-Theme-Matery

Name of the Vulnerable Software and Affected Versions: hexo-theme-matery version 2.0.0 Description: The issue lies in the verifyPassword function, allowing attackers to bypass authentication and access password-protected pages. Recommendations: For hexo-theme-matery version 2.0.0, as a temporary...

CVE-2024-21872

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter...

AZL-43357 CVE-2024-27306 affecting package python-aiohttp 3.6.2-3

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...

UBUNTU-CVE-2024-27306

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...

CVE-2024-27306

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...