UBUNTU-CVE-2024-48936

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via...

PT-2024-33282 · Schedmd · Slurm

Name of the Vulnerable Software and Affected Versions: SchedMD Slurm versions prior to 24.05.4 Description: A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This issue is limited to jobs explicitly running with --stepmgr, or on...

CVE-2024-48936

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via...

CVE-2024-48936

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via...

CVE-2024-48936

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via...

SUSE CVE-2024-49876

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more wor...

WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin Multi Step Form versions = 1.7.21...

Pterodactyl 安全漏洞

Pterodactyl is an open source game server administration panel built using PHP, Nodejs and Go. A security vulnerability exists in Pterodactyl versions prior to 1.11.8 that stems from passwords being recorded in plaintext in logs when a user disables two-step authentication; if a malicious user...

WordPress Multi Step Form Plugin <= 1.7.21 is vulnerable to Broken Access Control

Software Multi Step Form Type Plugin Vulnerable versions = 1.7.21 Fixed in 1.7.22 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-50428 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 836c6987cc2b Credits Muhamad Agil Fachrian...

DEBIAN-CVE-2022-49005

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for sx controls For sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in sndsocputvolswsx needs to jus...

DEBIAN-CVE-2024-49876

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more wor...

CVE-2024-47680

CVE-2024-47680 affects the Linux kernel’s f2fs discard handling for conventional zones on zoned block devices. The root cause is that f2fs relied on a discard capability check performed by bdev_max_discard_sectors() and bdev_is_zoned(), which bypasses to discard even when a device doesn’t support...

CVE-2024-47331

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NinjaTeam Multi Step for Contact Form allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through 2.7.7...

CVE-2024-47331

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through = 2.7.7...

CVE-2024-47331 WordPress Multi Step for Contact Form plugin <= 2.7.7 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through = 2.7.7...

CVE-2024-47331

CVE-2024-47331 — Unauthenticated SQL Injection in WordPress plugin “Multi Step for Contact Form” (NinjaTeam) affecting versions

CVE-2024-9507

CVE-2024-9507 concerns the WordPress plugin Bit Form (Contact Form by Bit Form) up to version 2.15.2. The issue arises from improper input validation in the iconUpload function, enabling authenticated attackers with Administrator-level access and above to perform a PHP filter chain attack and rea...

CVE-2024-9507 Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This...

PT-2024-32545 · Ninja Team · Ninjateam Multi Step For Contact Form

Name of the Vulnerable Software and Affected Versions: NinjaTeam Multi Step for Contact Form versions n/a through 2.7.7 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

WordPress plugin Multi Step for Contact Form SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability...