CVE-2024-12000: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /controllers/updatesettings.php of the component Setting Handler. The manipulation of the argument firstname leads to cross site scripting. Th...

CVE-2024-12001: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is an unknown function of the file /controllers/updatesettings.php of the component Setting Handler. The manipulation of the argument firstname leads to cross site scripting. It is possible to...

PT-2024-17395 · Unknown · Code-Projects Blood Bank System

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank System version 1.0 Description: A problem has been found in the Setting Handler component, specifically in the /controllers/updatesettings.php file. The issue affects some unknown processes and can be exploited...

CVE-2024-50358

A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by authenticated users by restoring a tampered...

CVE-2024-10393

CVE-2024-10393 affects the WordPress Tutor LMS plugin, vulnerable in versions

PT-2024-16930

Name of the Vulnerable Software and Affected Versions The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress versions up to, and including, 3.3 Description The issue is related to unauthorized access of data due to a missing capability check on the get setting function. This...

CVE-2024-53082 virtio_net: Add hash_key_length check

In the Linux kernel, the following vulnerability has been resolved: virtionet: Add hashkeylength check Add hashkeylength check in virtnetprobe to avoid possible out of bound errors when setting/reading the hash key...

DEBIAN-CVE-2024-50298

In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vfstate during PF probes In the previous implementation, vfstate is allocated memory only when VF is enabled. However, netdeviceops::ndosetvfmac may be called before VF is enabled to configure the MAC address...

AZL-53468 CVE-2024-50298 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vfstate during PF probes In the previous implementation, vfstate is allocated memory only when VF is enabled. However, netdeviceops::ndosetvfmac may be called before VF is enabled to configure the MAC address...

CVE-2024-50298 net: enetc: allocate vf_state during PF probes

In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vfstate during PF probes In the previous implementation, vfstate is allocated memory only when VF is enabled. However, netdeviceops::ndosetvfmac may be called before VF is enabled to configure the MAC address...

PT-2024-9898

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.9.14, 4.13.2, and 5.5.2 Description Craft CMS is susceptible to a remote code execution issue. This affects users whose php.ini configuration has register argc argv enabled. An unspecified remote code execution vector is...

CVE-2024-52871

In Flagsmith before 2.134.1, it is possible to bypass the ALLOWREGISTRATIONWITHOUTINVITE setting...

Flagsmith 安全漏洞

Flagsmith is an open source, full-featured feature flagging and remote configuration service from Flagsmith Open Source. A security vulnerability exists in Flagsmith versions prior to 2.134.1 that stems from the ability to bypass the ALLOWREGISTRATIONWITHOUTINVITE setting...

CVE-2024-52871

In Flagsmith before 2.134.1, it is possible to bypass the ALLOWREGISTRATIONWITHOUTINVITE setting...

CVE-2024-52871

In Flagsmith before 2.134.1, it is possible to bypass the ALLOWREGISTRATIONWITHOUTINVITE setting...

CVE-2024-52871

The Flagsmith feature flagging and remote configuration service is vulnerable in versions prior to 2.134.1 due to a security weakness that allows an attacker to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting. This bypass enables unauthorized registration despite intended restrictions. Remed...

PT-2024-35471 · Flagsmith · Flagsmith

Name of the Vulnerable Software and Affected Versions: Flagsmith versions prior to 2.134.1 Description: The issue allows bypassing the ALLOW REGISTRATION WITHOUT INVITE setting. Recommendations: For versions prior to 2.134.1, update to version 2.134.1 or later to resolve the issue...

CVE-2024-9529: Undefined Security Weakness

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privile...

AZL-53209 CVE-2024-10978 affecting package postgresql for versions less than 16.5-1

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

ALPINE-CVE-2024-10978

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...