CVE-2024-5582

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attribute...

PT-2024-36589 · WordPress · Schema & Structured Data For Wp & Amp

Name of the Vulnerable Software and Affected Versions: Schema & Structured Data for WP & AMP plugin for WordPress versions up to, and including, 1.33 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, specifically the url attribute...

CVE-2024-5582: Improper Neutralization of Input During Web Page Generation

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2022-48835

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Page fault in reply q processing A page fault was encountered in mpt3sas on a LUN reset error path: 145.763216 mpt3sascm1: Task abort tm failed: handle0x0002,timeout30 trmethod0x0 smid3 msixindex0 145.778932 scsi...

Malicious code in file-q-and-a (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2368 Malicious code in file-q-and-a (npm)

--- -= Per source details. Do not edit below this line.=-...

Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF

Description The theme does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack The PoC will be displayed on June 26, 2024, to give users the time to update...

Himer - Social Questions and Answers < 2.1.1 - Contributor+ Stored XSS

Description The theme does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks The PoC will be displayed on June 26, 2024, to give users the time to update...

Himer - Social Questions and Answers < 2.1.1 - Multiple CSRF on the Group Section

Description The theme does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group The PoC will be displayed on June 26, 2024, to give users the...

Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR

Description The plugin allows any authenticated user to join a private group due to a missing authorization check on a function The PoC will be displayed on June 26, 2024, to give users the time to update...

CVE-2024-35974

In the Linux kernel, the following vulnerability has been resolved: block: fix q-blkglist corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q-blkglist when calling blkcginitdisk for rebind, then...

CVE-2024-35974

In the Linux kernel, the following vulnerability has been resolved: block: fix q-blkglist corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q-blkglist when calling blkcginitdisk for rebind, then...

CVE-2024-35974 block: fix q->blkg_list corruption during disk rebind

In the Linux kernel, the following vulnerability has been resolved: block: fix q-blkglist corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q-blkglist when calling blkcginitdisk for rebind, then...

CVE-2024-35974

CVE-2024-35974 affects the Linux kernel block subsystem. The vulnerability arises from a q-&gt;blkg_list corruption introduced when multiple gendisk instances are allocated for a single request queue during disk rebind, allowing a blkg to linger in q-&gt;blkg_list during blkcg_init_disk() and thu...

CVE-2024-35974: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: block: fix q-blkglist corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q-blkglist when calling blkcginitdisk for rebind, then...

DEBIAN-CVE-2024-35911

In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver would previously panic after suspend. This is caused from the driver only calling the icevsifreeqvectors function by itself, when it is suspending. Since comm...

UBUNTU-CVE-2024-35911

In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver would previously panic after suspend. This is caused from the driver only calling the icevsifreeqvectors function by itself, when it is suspending. Since comm...

RHEL 5 : tcpdump (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - tcpdump: SMB data printing mishandled CVE-2018-10105 - The AH parser in tcpdump before 4.9.0 has a buffer...

RHEL 6 : tcpdump (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - tcpdump: SMB data printing mishandled CVE-2018-10105 - The AH parser in tcpdump before 4.9.0 has a buffer...

Mitsubishi Electric MELSEC-Q/L Series Integer Overflow or Wraparound (CVE-2024-0803)

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet. This plugin only works with Tenable.ot...