PT-2024-17522 · WordPress · Beautiful Taxonomy Filters

Name of the Vulnerable Software and Affected Versions: The Beautiful taxonomy filters plugin for WordPress versions up to, and including, 2.4.3 Description: The issue is related to SQL Injection via the selects0term parameter due to insufficient escaping on the user-supplied parameter and lack of...

CVE-2024-12270: Improper Neutralization of Special Elements used in an SQL Command

The Beautiful taxonomy filters plugin for WordPress is vulnerable to SQL Injection via the 'selects0term' parameter in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2024-11844

The CVE-2024-11844 entry concerns the IdeaPush WordPress plugin (versions up to and including 8.71). Root cause: missing capability check in the idea_push_taxonomy_save_routine allows authenticated users with Subscriber-level access or higher to delete terms in the boards taxonomy, effectively en...

The vulnerability of the mlx5_eswitch_add_termtbl_rule() function in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mlx5eswitchaddtermtblrule function in the drivers/net/ethernet/mellanox/mlx5/core/eswitchoffloadstermtbl.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2024-50259 netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsimnexthopbucketactivitywrite This was found by a static analyzer. We should not forget the trailing zero after copyfromuser if we will further do some string operations,...

CVE-2023-7295

The Video Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

WordPress plugin Video Grid 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-15276

Name of the Vulnerable Software and Affected Versions Video Grid plugin for WordPress versions up to, and including, 1.21 Description The issue is related to Reflected Cross-Site Scripting via the search term parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-47780 Information Disclosure in TYPO3 Page Tree

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected...

WordPress Rank Math SEO plugin <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete vulnerability

Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete vulnerability discovered by Leo in WordPress Plugin Rank Math SEO versions = 1.0.228...

CVE-2024-9161

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'updatemetadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated...

CVE-2024-9161

The Rank Math SEO plugin for WordPress (versions up to and including 1.0.228 ) is vulnerable to broken access control due to a missing capability check in the update_metadata function. This flaw allows unauthenticated attackers to insert, update, or delete metadata, including user and term metada...

Tor anonymity compromised by law enforcement. Is it still safe to use?

Despite people generally considering the Tor network as an essential tool for anonymous browsing, german law enforcement agencies have managed to de-anonymize Tor users after putting surveillance on Tor servers for months. Before we go into the what the agencies did, let's take a look at some...

Microsoft Publisher 安全漏洞

Microsoft Publisher is an entry-level desktop publishing application from Microsoft USA that provides more control over page elements than Microsoft Word. A security vulnerability exists in Microsoft Publisher. An attacker could exploit the vulnerability to bypass certain features. The following...

Stable Channel Update for ChromeOS / ChromeOS Flex

Hello All, The Stable channel is being updated to 128.0.6613.133 Platform version: 15964.48.0 for ChromeOS devices and will be rolled out over the next few days. If you find new issues, please let us know one of the following ways: File a bug Visit our Chrome OS communities General: Chromebook He...

CVE-2024-45589

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

PT-2024-31692 · Identity Automation · Rapididentity Lts +1

Name of the Vulnerable Software and Affected Versions: RapidIdentity LTS versions 2023.0.2 and earlier RapidIdentity Cloud versions 2024.08.0 and earlier Description: The issue allows a remote attacker to cause a denial of service via the username parameters by improperly restricting excessive...

Uncovering Hybrid Cloud Attacks Part 2 – The Attack

in this second part of the series, we’ll share the details of a real-world sophisticated, long-term attack in the cloud...

DEBIAN-CVE-2024-44943

In the Linux kernel, the following vulnerability has been resolved: mm: gup: stop abusing trygrabfolio A kernel warning was reported when pinning folio in CMA memory when launching SEV virtual machine. The splat looks like: 464.325306 WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313...

PT-2024-25696 · Bpq32 · Bpq32

Name of the Vulnerable Software and Affected Versions: BPQ32 version 6.0.24.1 Description: The issue is related to an SEH-based buffer overflow in the BPQ32 HTTP Server, allowing remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request...