CVE-2024-54137

Removed by vendor...

liboqs 信息泄露漏洞

liboqs is an Open Quantum Safe open source C library for quantum-safe cryptographic algorithms. An information disclosure vulnerability exists in versions of liboqs prior to 0.12.0 that stems from an indexing error where part of the key is incorrectly treated as non-secret data, resulting in the...

firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims

The Mozilla Foundation's Security Advisory: Enhanced Tracking Protection's Strict mode may inadvertently allow a CSP frame-src bypass and DOM-based cross-site scripting XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could expose users to malicious frames...

GHSA-W8GC-X259-RC7X rails-html-sanitize has XSS vulnerability with certain configurations

Summary There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0 and Nokogiri = 1.16.8. Impact A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5...

firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims

The Mozilla Foundation's Security Advisory: Enhanced Tracking Protection's Strict mode may inadvertently allow a CSP frame-src bypass and DOM-based cross-site scripting XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could expose users to malicious frames...

[SECURITY] Fedora 40 Update: rust-zlib-rs-0.4.0-1.fc40

A memory-safe zlib implementation written in rust...

[SECURITY] Fedora 41 Update: rust-zlib-rs-0.4.0-1.fc41

A memory-safe zlib implementation written in rust...

Spotify, Audible, and Amazon used to push dodgy forex trading sites and more

Spotify and Amazon services have been flooded with bogus listings that push dubious "forex trading" sites, Telegram channels, and suspicious links claiming to offer pirated software according to our friends over at BleepingComputer. Cybercriminals are abusing the options to inject keywords and...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Google Chrome’s Safe Browsing feature before version 127.0.6533.72 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass discretionary access control through a malicious file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Google Chrome’s Safe Browsing feature before version 127.0.6533.72 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass discretionary access control through a malicious file. Chromium security severity: Low...

Querydsl 安全漏洞

Querydsl is a framework from the Querydsl open source that supports building type-safe SQL-like queries for multiple backends. A security vulnerability exists in Querydsl version 5.1.0 that stems from allowing SQL or HQL injection in orderBy in JPAQuery...

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

kernel: clk: imx: scu: use _safe list iterator to avoid a use after free

A use-after-free flaw was found in the Linux kernel's i.MX system control unit clock driver in the error cleanup path. A local user can trigger this issue during clock initialization failure scenarios on i.MX hardware with System Control Unit firmware, where the cleanup loop incorrectly uses a...

WordPress Safe SVG plugin < 2.2.6 - Author+ Cross Site Scripting (XSS) vulnerability

Author+ Cross Site Scripting XSS vulnerability discovered by Alexander Concha in WordPress Plugin Safe SVG versions 2.2.6...

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

CVE-2024-8378 relates to the WordPress Safe SVG plugin prior to version 2.2.6. The sanitisation logic only runs for paths that call wp_handle_upload and does not cover code using wp_handle_sideload, which is commonly used to upload attachments via raw POST data. This gap can permit bypass of sani...

UBUNTU-CVE-2023-1932

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or...

WordPress plugin Safe SVG 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Safe SVG Plugin < 2.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Safe SVG Type Plugin Vulnerable versions 2.2.6 Fixed in 2.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-8378 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6a85e49dfeba Credits Alexander Concha Required privilege Author...