ALSA-2024:2982 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-40414 webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-42852 webkitgtk: Processing...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-40414 webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-42852 webkitgtk: Processing...

PT-2024-33203 · WordPress · Ht Mega – Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.5.2 Description: The issue is related to Stored Cross-Site Scripting via the popover header text parameter due to insufficient input sanitization an...

Atlassian Confluence Administrator Code Macro Remote Code Execution

This module exploits an authenticated administrator-level vulnerability in Atlassian Confluence, tracked as CVE-2024-21683. The vulnerability exists due to the Rhino script engine parser evaluating tainted data from uploaded text files. This facilitates arbitrary code execution. This exploit will...

AZL-47642 CVE-2024-35955 affecting package kernel for versions less than 6.6.28.1-1

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULESTATELIVE - MODULESTATEGOING - MODULESTATEUNFORMED. Each change will take a time. ismoduletextaddress and...

DEBIAN-CVE-2024-35955

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULESTATELIVE - MODULESTATEGOING - MODULESTATEUNFORMED. Each change will take a time. ismoduletextaddress and...

AZL-47673 CVE-2024-35955 affecting package kernel for versions less than 5.15.157.1-1

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULESTATELIVE - MODULESTATEGOING - MODULESTATEUNFORMED. Each change will take a time. ismoduletextaddress and...

UBUNTU-CVE-2024-35955

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULESTATELIVE - MODULESTATEGOING - MODULESTATEUNFORMED. Each change will take a time. ismoduletextaddress and...

PT-2024-32315 · WordPress · Testimonial Carousel For Elementor

Name of the Vulnerable Software and Affected Versions: Testimonial Carousel For Elementor plugin for WordPress versions up to, and including, 10.1.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticat...

CVE-2024-35823

CVE-2024-35823: Linux kernel vt buffer corruption when deleting characters has been fixed. Root cause: overlapping buffers in VT text handling; solution: replace memcpy() with memmove() (same approach as VGA text buffer fix). Affected component: vt in the Linux kernel. Remediation: upgrade to a k...

GitLab 11.6 < 13.9.7 / 13.10.0 < 13.10.4 / 13.11.0 < 13.11.2 (CVE-2021-22206)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,...

ROS-20240516-01

Vulnerability of Less, a utility for UNIX-like text terminals, is related to incorrect processing of quotation marks in filename.c file. quotes in the filename.c file. Exploitation of the vulnerability could allow an attacker to execute arbitrary commands...

Magento Open Source Security Advisory: Patch SUPEE-10975

Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution RCE, cross-site scripting XSS, cross-site request forgery CSRF, and more. The following issues have been identified and...

GHSA-QM5C-M76R-2HFR Laravel RCE vulnerability in "cookie" session driver

Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the use...

[SECURITY] Fedora 39 Update: nano-7.2-5.fc39

GNU nano is a small and friendly text editor...

WordPress Magical Addons For Elementor plugin <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Text Effect Widget vulnerability discovered by João G. Barbosa 4rCanJ0x! in WordPress Plugin Magical Addons For Elementor versions = 1.1.37...

CVE-2024-4847

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘lastpostid’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficie...

CVE-2024-4847 Alt Text AI – Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘lastpostid’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficie...

CVE-2024-4847

CVE-2024-4847 affects the WordPress plugin Alt Text AI – Automatically generate image alt text for SEO and accessibility. The vulnerability is a generic SQL Injection via the last_post_id parameter in all versions up to 1.4.9, caused by insufficient escaping of the user-supplied value and lack of...

CVE-2024-4847 Alt Text AI – Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘lastpostid’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficie...