PT-2024-18774 · Snap · Snap

Name of the Vulnerable Software and Affected Versions: SNAP in HAL prior to SMR May-2024 Release 1 Description: The issue is an out of bounds write vulnerability that allows local privileged attackers to execute arbitrary code. Recommendations: For versions prior to SMR May-2024 Release 1, update...

CVE-2024-20863: Out-of-bounds Write

Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code...

kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2024-34069 via werkzeug (0.13.0)

werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2024-34069 Source advisory: OSV:GHSA-2G68-C3QC-8985...

CVE-2024-4060

Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-4331

Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-4058

Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

CVE-2024-4059

Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML page. Chromium security severity: High...

CVE-2024-4368

Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Social Snap < 1.3.6 - Missing Authorization

Description The Social Snap plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init function in versions up to, and including, 1.3.5. This makes it possible for unauthenticated attackers to modify the plugin's settings...

WordPress Social Snap plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Social Snap versions = 1.3.5...

WordPress Social Snap Plugin <= 1.3.5 is vulnerable to Broken Access Control

Software Social Snap Type Plugin Vulnerable versions = 1.3.5 Fixed in 1.3.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32805 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4bb46049199a Credits Majed Refaea Required...

CVE-2024-3834

Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-3841

Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. Chromium security severity: Medium...

CVE-2024-3843

Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-3863

The executable file warning was not presented when downloading .xrm-ms files. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

CVE-2024-3857

The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

CVE-2024-3852

GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

CVE-2024-3859

On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

CVE-2024-3856

A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects Firefox 125...

CVE-2024-3860

An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vulnerability affects Firefox 125...