WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin WPSPX versions = 1.0.2...

kernel: HID: i2c-hid-of: fix NULL-deref on failed power up

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures...

kernel: firmware: cs_dsp: Return error if block header overflows file

A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...

WordPress Koko Analytics plugin <= 1.3.12 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Koko Analytics versions = 1.3.12...

kernel: mlxsw: spectrum: Protect driver from buggy firmware

A vulnerability was found in the Linux kernel's mlxsw spectrum driver, where processing port up/down events leads to a NULL pointer dereference. This issue occurs when the driver fails to handle events for the CPU port, which exists but lacks a corresponding network device, resulting in system...

kernel: HID: i2c-hid-of: fix NULL-deref on failed power up

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures...

PT-2024-39218 · WordPress · Beam Me Up Scotty – Back To Top Button

Name of the Vulnerable Software and Affected Versions: Beam me up Scotty – Back to Top Button plugin for WordPress versions up to, and including, 1.0.21 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This...

WordPress Beam me up Scotty – Back to Top Button Plugin <= 1.0.21 is vulnerable to Cross Site Scripting (XSS)

Software Beam me up Scotty – Back to Top Button Type Plugin Vulnerable versions = 1.0.21 Fixed in 1.0.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8741 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b85fc952fded...

PT-2024-39011 · Themehunk · Easy Mega Menu Plugin

Name of the Vulnerable Software and Affected Versions: Easy Mega Menu Plugin for WordPress – ThemeHunk plugin versions up to, and including, 1.0.9 Description: The issue arises from a missing capability check on several functions hooked via AJAX, allowing authenticated attackers with...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by bugcraftx Patchstack Alliance in WordPress Plugin Themify – WooCommerce Product Filter versions = 1.5.1...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

ROS-20240923-02

Vulnerability of ANGLE library in Mozilla Firefox, Firefox ESR and Thunderbird email client browsers is related to writing beyond buffer boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. remotely to cause a denial of service...

CVE-2024-46101

GDidees CMS = v3.9.1 has a file upload vulnerability...

PT-2024-32094 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions up to 4.7.1 Description: The issue is a Directory Traversal vulnerability, which occurs via the download/folder path. Recommendations: For versions up to 4.7.1, consider restricting access to the download/folder path as a...

SUSE CVE-2024-46753

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfsdecref properly In walkupproc we BUGONret from btrfsdecref. This is incorrect, we have proper error handling here, return the error...

PT-2024-26524

Name of the Vulnerable Software and Affected Versions sqlitedict versions up to v2.1.0 Description The issue is related to insecure deserialization, which allows attackers to execute arbitrary code. Recommendations For versions up to v2.1.0, update to a version later than v2.1.0 to resolve the...

Brave 安全漏洞

Brave is a fast, private and secure web browser from Brave USA. A security vulnerability exists in versions prior to Brave 1.67.116 that stems from the omission of domain names from the right side instead of the left side of the Brave Shields pop-up window, which can lead to domain name confusion...

PT-2024-12164 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium versions through 11.0.2 Description: An issue in the software enables attackers to launch amplification attacks, potentially causing denial-of-service DoS with an amplification factor three times higher than other software like BIN...

WordPress Share This Image plugin <= 2.03 - Open Redirect via link Parameter vulnerability

Open Redirect via link Parameter vulnerability discovered by Krzysztof Zając in WordPress Plugin Share This Image versions = 2.03...