Authd security vulnerability

Authd is a cloud-based authentication daemon for identity providers in the Ubuntu open source. A security vulnerability exists in Authd versions prior to 0.3.6 that stems from insufficient randomization of user IDs to prevent conflicts, allowing a local attacker with a registered username to spoo...

pac4j code issues and vulnerabilities

pac4j is a simple yet powerful Java security engine from pac4j open source. It is used to authenticate users, obtain their profiles and manage authorizations to protect Web applications and Web services. A code issue vulnerability exists in pac4j versions prior to 4.0.0 that stems from being...

Bitcoin Core security vulnerabilities

Bitcoin Core is a Bitcoin open source client for verifying the validity of blockchain transactions. A security vulnerability exists in versions of Bitcoin Core prior to 25.0, which stems from a vulnerability that allows a remote attacker to cause a denial of service by including transactions that...

UBUNTU-CVE-2023-45872

An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. When a QML image refers to an image whose content is not known yet, there is an assumption that it is an SVG document, leading to a denial of service application crash if it is not actually an SVG document...

TRtek Distant Education Platform SQL Injection Vulnerability

TRtek Distant Education Platform is an application from TRtek, Inc. A SQL injection vulnerability exists in TRtek Distant Education Platform versions prior to 3.2024.11, which stems from improper input validation and allows for SQL injection and parameter injection...

Fortra Robot Schedule Enterprise Agent Security Vulnerability

Fortra Robot Schedule Enterprise Agent is a component of Fortra's Enterprise Task Scheduler software. A security vulnerability exists in Fortra Robot Schedule Enterprise Agent versions prior to 3.05 that stems from FTP username and password information being written to the agent log file when...

Google Chrome Type Obfuscation Vulnerability (CNVD-2024-44540)

Google Chrome is a web browser from Google, an American company. A type obfuscation vulnerability exists in versions prior to Google Chrome V8 129.0.6668.100, which can be exploited by an attacker to cause heap corruption via specially crafted HTML pages...

AZL-50144 CVE-2024-9026 affecting package php for versions less than 8.1.30-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

AZL-50164 CVE-2024-8927 affecting package php for versions less than 8.3.12-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

CVE-2024-43697

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input...

PT-2024-8643 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.6 Description: The issue is related to an infinite loop in the system, which can be exploited by a remote unauthenticated attacker to cause a denial of service. This means that the attacker can make the...

Adobe Experience Manager Cross-Site Script Vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The solution supports mobile content management, marketing and sales campaign management, and multi-site management. A...

PT-2024-26089 · Unknown · Librtppayload.So

Name of the Vulnerable Software and Affected Versions: librtppayload.so versions prior to SMR Oct-2024 Release 1 Description: The issue is an out-of-bounds write in parsing h.263 format, which allows remote attackers to execute arbitrary code with system privilege. User interaction is required fo...

HPESBGN04708 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF; Remote: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified...

PT-2024-32552 · Wpexperts · Wpexperts Square For Givewp

Name of the Vulnerable Software and Affected Versions: WPExperts Square For GiveWP versions 1.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

WordPress plugin ElementsReady Addons for Elementor: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2024-32584 · Yith · Yith Woocommerce Product Add-Ons

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Product Add-Ons versions prior to 4.13.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations...

CVE-2024-47847

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

WordPress plugin Keap Official Opt-in Forms has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

PT-2025-2777

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: A possible null pointer dereference issue has been identified in the Linux kernel. This issue occurs when the request lock function is called and lkb-lkb resource is not assigned yet, which...