CVE-2024-12771: Cross-Site Request Forgery (CSRF)

The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customerpanelpasswordreset' function. This makes it possible for...

PT-2024-17730 · WordPress · Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions up to, and including, 3.3.43 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the customer panel password reset function...

WordPress eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.43 - Cross-Site Request Forgery to Password Reset vulnerability

Cross-Site Request Forgery to Password Reset vulnerability discovered by shaman0x01 in WordPress Plugin eCommerce Product Catalog versions = 3.3.43...

CVE-2024-7139

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7138

An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7139 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7139 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7139

The CVE-2024-7139 entry concerns Silicon Labs RS9116 Bluetooth SDK. The issue is caused by an unchecked buffer length in L2CAP processing, allowing a buffer overflow that triggers an assertion and leads to a temporary denial of service. The impact is a DoS, with a potential required hard reset to...

CVE-2024-7139 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7138 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7138 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7137 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

The L2CAP receive data buffer for L2CAP packets is restricted to packet sizes smaller than the maximum supported packet size. Receiving a packet that exceeds the restricted buffer length may cause a crash. A hard reset is required to recover the crashed device...

CVE-2021-26102

A relative path traversal vulnerability CWE-23 in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to...

Malicious code in @add-wallet-exchange/reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb76748dbba1a0501ea786fecbf98f24109ef841f992cc7a4ebda7f06d6b95b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RLSA-2024:10785 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code CVE-2024-10979 postgresq...

CVE-2024-53270

A flaw was found in Envoy. In systems where http1serverabortdispatch is configured, Envoy does not properly handle the control flow during H1 stream resets. This can trigger a null pointer error and lead to an application crash. Mitigation Mitigation for this issue is either not available or the...

PT-2024-38103 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue is related to the L2CAP receive data buffer for L2CAP packets, which is restricted to packet sizes smaller than the maximum supported packet size. Receiving a packet that exceed...

PT-2024-38104 · Silabs.Com · Rs9116 Bluetooth Sdk

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog tim...

CVE-2024-53270 HTTP/1: sending overload crashes when the request is reset beforehand in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called. However, the...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness due to the management of client connections by OTAPI, which allows stale UUIDs to remain on RemoteClient instances after a player disconnects. An attacker can assume the login state of a...