CVE-2024-52871

The CVE-2024-52871 issue affects Flagsmith up to version 2.134.1, where the ALLOW_REGISTRATION_WITHOUT_INVITE setting can be bypassed. The vulnerability concerns the open-source Flagsmith product (feature flagging/remote configuration) and involves bypassing the invitation-requirement for registr...

PT-2024-35471 · Flagsmith · Flagsmith

Name of the Vulnerable Software and Affected Versions: Flagsmith versions prior to 2.134.1 Description: The issue allows bypassing the ALLOW REGISTRATION WITHOUT INVITE setting. Recommendations: For versions prior to 2.134.1, update to version 2.134.1 or later to resolve the issue...

CVE-2024-8978

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'initcontentregisteruseremailcontrols' function. This makes it possib...

CVE-2024-8978

CVE-2024-8978 affects the WordPress plugin Essential Addons for Elementor (

CVE-2024-50843

A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access sensitive files and directories via /loginsystem/assets...

CVE-2024-50843

A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access sensitive files and directories via /loginsystem/assets...

CVE-2024-48284

A Reflected Cross-Site Scripting XSS vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary scripts via the searchkey parameter in a POST HTTP request...

PHPGurukul User Registration & Login and User Management System 路径遍历漏洞

PHPGurukul User Registration & Login and User Management System is a user registration & login and user management system from PHPGurukul Inc. A path traversal vulnerability exists in PHPGurukul User Registration & Login and User Management System version 3.2. An attacker can use this vulnerabili...

The vulnerability of the LuCI web interface in the embedded operating system OpenWrt allows a hacker to elevate their privileges to the root level.

The vulnerability of the LuCI web interface in the embedded operating system OpenWrt is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the root level using the JSON-RPC API...

CVE-2024-8874

The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to...

CVE-2024-8874 AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting

The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to...

The vulnerability of the Create MyConfig (CMC) utility in Siemens Sinumerik programmable logic controllers allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the Create MyConfig CMC utility in Siemens Sinumerik programmable logic controllers is related to the disclosure of information through registration files in the log files. Exploiting this vulnerability can allow attackers to circumvent security restrictions and gain...

WordPress AJAX Login and Registration modal popup + inline form plugin <= 2.24 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin AJAX Login and Registration modal popup + inline form versions = 2.24...

CVE-2024-50386

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker...

CVE-2024-50386 Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker...

kernel: iio: core: fix memleak in iio_device_register_sysfs

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix memleak in iiodeviceregistersysfs When iiodeviceregistersysfsgroup fails, we should free iiodevopaque-chanattrgroup.attrs to prevent potential memleak...

kernel: NULL pointer dereference in zone registration error path

is a security vulnerability in the Linux kernel, specifically within the thermal management subsystem. This vulnerability is a NULL pointer dereference that occurs in the thermalzonedeviceregisterwithtrips function during the thermal zone registration error path. This issue can cause crashes and...

kernel: dpll: fix dpll_pin_on_pin_register() for multiple parent pins

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...

kernel: net: hns3: fix kernel crash problem in concurrent scenario

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash problem in concurrent scenario When link status change, the nic driver need to notify the roce driver to handle this event, but at this time, the roce driver may uninit, then cause kernel crash. To fix...

kernel: tracing/trigger: Fix to return error if failed to alloc snapshot

In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix registersnapshottrigger to return error code if it failed to allocate a snapshot instead of 0 success. Unless that, it will register snapshot trigger without an...