AZL-50571 CVE-2024-21135 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

AZL-50526 CVE-2024-21125 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

AZL-50541 CVE-2024-20996 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

UBUNTU-CVE-2024-21159

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

DEBIAN-CVE-2024-6778

Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: High...

DEBIAN-CVE-2024-6773

Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2024-39917

xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this...

JVN#25583987: FUJITSU Network Edgiot GW1500 vulnerable to path traversal

FUJITSU Network Edgiot GW1500 M2M-GW for FENICS provided by Fujitsu Limited contains a path traversal vulnerability CWE-22. Impact If a logged-in attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information...

PT-2024-36574 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14 Description: An improper privilege management issue allowed users to migrate private repositories without having the appropriate scopes defined on the related Personal Access Token...

WordPress CM Email Registration Blacklist and Whitelist plugin < 1.4.9 - Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelist vulnerability

Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelist vulnerability discovered by Felipe Caon in WordPress Plugin CM Email Registration Blacklist and Whitelist versions 1.4.9...

WordPress RafflePress Lite plugin < 1.12.14 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Krugov Aryom in WordPress Plugin Giveaways and Contests by RafflePress versions 1.12.14...

PT-2024-5483

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 127.0.6533.88 Microsoft Edge affected versions not specified Description The issue is related to the use of uninitialized variables in the Dawn component, which implements the WebGPU specification. This could...

PT-2024-37366 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.5 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

Apache Linkis Security Vulnerability

Apache Linkis is a middleware product from the Apache Foundation that establishes an effective connection between upper-tier applications and the underlying data engine. A security vulnerability exists in Apache Linkis versions prior to 1.6.0, which stems from a lack of effective parameter...

WisdomGarden Tronclass ilearn Access Control Error Vulnerability

WisdomGarden Tronclass ilearn is a teaching platform from China WisdomGarden, Inc. An access control error vulnerability exists in WisdomGarden Tronclass ilearn versions prior to 1.69.61976, which stems from a lack of proper access control in the Thumbnail API, allowing an unauthenticated, remote...

PT-2024-37369 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.5 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

CVE-2024-5715

The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-32638 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 2.2.15 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escape...

PT-2024-24311 · Stonefly · Stonefly Storage Concentrator

Name of the Vulnerable Software and Affected Versions: StoneFly Storage Concentrator SC and SCVM versions prior to 8.0.4.26 Description: The issue allows directory traversal by authenticated users, potentially exposing sensitive system information. This can be achieved by using a crafted path...

PT-2025-7451 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x Description: The product implements access controls via a policy or other feature with the intention to disable or restrict accesses to...