go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

WordPress 2D Tag Cloud plugin <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter vulnerability

Reflected Cross-Site Scripting via addqueryarg Parameter vulnerability discovered by Francesco Carlucci in WordPress Plugin 2D Tag Cloud versions = 6.0.2...

ALSA-2024:8038 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm CVE-2023-45290 go/parser: golang: Calling any of the...

WordPress 2D Tag Cloud Plugin <= 6.0.2 is vulnerable to Cross Site Scripting (XSS)

Software 2D Tag Cloud Type Plugin Vulnerable versions = 6.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9670 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b507e6e6c829 Credits Francesco Carlucci...

PT-2024-32873 · Astro · Astro

Name of the Vulnerable Software and Affected Versions: Astro versions 3.0.0 through 4.16.0 Description: The Astro web framework has a DOM Clobbering gadget in the client-side router. This issue can lead to cross-site scripting XSS in websites that enable Astro's client-side routing and have store...

CVE-2024-9670

The CVE-2024-9670 entry concerns the WordPress plugin 2D Tag Cloud (vulnerable

CVE-2024-9670 2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter

The 2D Tag Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 6.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

WordPress plugin 2D Tag Cloud 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

BIT-DISCOURSE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

PT-2024-39839 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: LyLme spage version 1.9.5 Description: A critical issue has been found in the code of the file /admin/tag.php, where the manipulation of the id argument leads to SQL injection. This issue can be initiated remotely. Recommendations: For LyLme...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-48901: btrfs: do not start relocation until in progress drops are done bsc1229607. CVE-2022-48911: kabi: add nfqueuegetrefs for kabi compliance. bsc1229633...

PT-2024-39640 · WordPress · Auto Iframe

Name of the Vulnerable Software and Affected Versions: Auto iFrame plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to Stored Cross-Site Scripting via the tag parameter due to insufficient input sanitization and output escaping. This allows authenticated...

CentOS 7 : thunderbird (RHSA-2022:6710)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6710 advisory. - When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects...

CentOS 7 : thunderbird (RHSA-2022:9079)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:9079 advisory. - If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER...

WordPress Auto iFrame plugin <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter vulnerability

Authenticated Author+ Stored Cross-Site Scripting via tag Parameter vulnerability discovered by tjoffe in WordPress Plugin Auto iFrame versions = 1.7...

CVE-2024-45297

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

CVE-2024-45297

Discourse (open source forum software) is affected by CVE-2024-45297: users can see topics labeled with hidden tags if they know the tag name, exposing restricted content. The issue has been patched in the latest stable, beta, and tests-passed releases; all users should upgrade. No public exploit...

PT-2024-31550 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issu...

Important: golang

Issue Overview: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. CVE-2024-34155 Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...