mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

The Mozilla Foundation's Security Advisory: Memory safety bugs are present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort, some of these could have been exploited to run arbitrary code...

UBUNTU-CVE-2024-45679

Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product...

PT-2024-37272 · Eliz · Eliz Software Panel

Name of the Vulnerable Software and Affected Versions: Eliz Software Panel versions prior to 2.3.24 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

Eliz Panel SQL注入漏洞

Eliz Panel is a control panel from Eliz Corporation. A SQL injection vulnerability exists in Eliz Panel versions prior to 2.3.24, which arises from an improper neutralization of a particular element used, allowing commands to be executed via SQL injection...

Contao 路径遍历漏洞

Contao is Contao open source a set of open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A path traversal vulnerability exists in versions prior to Contao 4.13.49, which stems from a back-end authenticated user...

PT-2024-29103 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.7 macOS versions prior to 15 Description: The issue was addressed with improved memory handling. Processing a maliciously crafted video file may lead to unexpected app termination. Recommendations: For macOS version...

PT-2024-6311 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2024.1 Description: The issue is related to the lack of protection of the web page structure in the integrated development environment, allowing for HTML injection via the project name. This could...

SnappyMail 跨站脚本漏洞

SnappyMail is a simple, modern, lightweight and fast web-based e-mail client from Maarten Personal Developers. A cross-site scripting vulnerability exists in SnappyMail versions prior to v2.38.0, which stems from the cleanHtml function allowing too many invalid HTML elements. An attacker can...

Mattermost Desktop App 安全漏洞

Mattermost Desktop App is a messaging desktop application from Mattermost USA. A security vulnerability exists in Mattermost Desktop App version 5.8.0 and prior versions, which stems from a failure to specify an absolute path when searching for the cmd.exe file. An attacker can exploit the...

PT-2024-30975 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15 Description: The issue allows an app to potentially read sensitive location information due to inadequate redaction of sensitive data. This was addressed with improved redaction of sensitive information...

PT-2024-22079 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15 Description: A privacy issue allowed an app to potentially read sensitive location information due to inadequate private data redaction for log entries. Recommendations: For versions prior to 15, update to macOS...

PT-2024-29081 · Apple · Visionos +2

Name of the Vulnerable Software and Affected Versions: visionOS versions prior to 2 macOS Sequoia versions prior to 15 Description: A malicious app with root privileges may be able to modify the contents of system files due to inadequate checks. The issue was addressed with improved checks...

SFS Consulting InsureE GL SQL注入漏洞

SFS Consulting InsureE GL is an application from SFS Consulting. A SQL injection vulnerability exists in SFS Consulting InsureE GL versions prior to 4.6.2, which stems from an unsatisfactory neutralization of a special element that allows SQL injection...

PT-2024-30964 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15 iOS versions prior to 18 iPadOS versions prior to 18 Description: A permissions issue allowed a malicious app with root privileges to potentially access keyboard input and location information without user consent...

PT-2024-29114 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access user-sensitive data. Recommendations: For versions prior to 15, update to macOS Sequoia 15 to resolv...

PT-2024-37597 · Unknown · Insuree Gl

Name of the Vulnerable Software and Affected Versions: InsureE GL versions prior to 4.6.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, which can be exploited by attacke...

WordPress plugin Spiffy Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

WordPress plugin The FOX 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A code injection vulnerability...

WordPress Carousel Slider plugin < 2.2.14 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Carousel Slider versions 2.2.14...

AZL-49286 CVE-2024-46685 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in...