WordPress plugin VW Automobile Lite has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-37075 · Glpi · Tasklists

Name of the Vulnerable Software and Affected Versions: Tasklists versions prior to 2.0.4 Description: The issue is related to a blind SQL injection vulnerability. Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 are affected. Recommendations: For versions prior to 2.0.4, upda...

PT-2024-35160

Name of the Vulnerable Software and Affected Versions Khoj versions prior to 1.29.10 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the update subscription endpoint, allowing any authenticated user to manipulate other users' Stripe subscriptions by...

AZL-55070 CVE-2024-56746 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: sh7760fb: Fix a possible memory leak in sh7760fballocmem When information such as info-screenbase is not ready, calling sh7760fbfreemem does not release memory correctly. Call dmafreecoherent instead...

AZL-55401 CVE-2024-56716 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: netdevsim: prevent bad user input in nsimdevhealthbreakwrite If either a zero count or a large one is provided, kernel can crash...

AZL-54875 CVE-2024-56653 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtkprocesscoredump hcidevcdappend may lead to the release of the skb, so it cannot be accessed once it is called. ================================================================== BUG: KASAN:...

AZL-55533 CVE-2024-53210 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: s390/iucv: MSGPEEK causes memory leak in iucvsockdestruct Passing MSGPEEK flag to skbrecvdatagram increments skb refcount skb-users and iucvsockrecvmsg does not decrement skb refcount at exit. This results in skb memory leak in...

comfy_mtb security vulnerabilities

comfymtb is an animation-oriented ComfyUI node package from the individual developer Mel Massadian. A security vulnerability exists in comfymtb version 0.1.4 and prior versions, which stems from an incorrect operation that can lead to code injection...

PT-2024-36614 · Tabby · Tabby

Name of the Vulnerable Software and Affected Versions: Tabby versions prior to 1.0.216 Description: The Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application...

PT-2024-10263 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0 Description: The issue is related to the Web Runtime SEC component and can be easily exploited, allowing an unauthenticated attacker with network access via HTTP to compromise JD Edward...

AZL-54660 CVE-2024-56201 affecting package python-jinja2 for versions less than 3.1.2-2

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability...

PT-2024-36794 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.16 Description: An Improper URL Handling issue allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This issue is triggered via the "real-browser" request typ...

PT-2024-9850 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to a lack of authorization in the JetBrains TeamCity system, which can be exploited by a remote attacker to impact the integrity of protected information. This...

PT-2024-29125 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.52 Description: The issue is a cross-site scripting vulnerability in the management console. Attackers with system administrator permissions can interfere with another system administrator's use of...

DEBIAN-CVE-2024-45819

PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prio...

UBUNTU-CVE-2024-45819

PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prio...

PT-2024-17382 · Unknown · Corporate Training Management System

Name of the Vulnerable Software and Affected Versions: Corporate Training Management System versions prior to 10.13 Description: A vulnerability in the epaper draft function of the Corporate Training Management System allows remote authenticated users to bypass file upload restrictions and execut...

AZL-54449 CVE-2024-45338 affecting package ig for versions less than 0.32.0-3

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-56055

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplmsplugin allows Path Traversal.This issue affects WPLMS: from n/a through 1.9.9.5.2...

WordPress plugin Advance Menu Manager has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...