CVE-2024-1909 Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory

The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it possible for unauthenticated attackers to rename categori...

PT-2024-18000 · WordPress · Yuki Theme

Name of the Vulnerable Software and Affected Versions: Yuki theme for WordPress versions up to, and including, 1.3.13 Description: The issue allows authenticated attackers with subscriber-level access and above to reset the theme's settings due to a missing capability check on the reset customize...

PT-2024-18420 · Byzoro · Byzoro Smart S42 Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S42 Management Platform versions up to 20240219 Description: A critical vulnerability has been found in the Byzoro Smart S42 Management Platform, affecting an unknown functionality of the file /useratte/userattestation.php. The...

DEBIAN-CVE-2021-46906

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hidsubmitctrl In hidsubmitctrl, the way of calculating the report length doesn't take into account that report-size can be zero. When running the syzkaller reproducer, a report of size 0 causes...

UBUNTU-CVE-2024-26606

In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In epoll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDERWRITEREAD without a read buffer...

CVE-2024-24714

Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4...

PT-2024-21218 · WordPress · Woocommerce Checkout Field Editor

Name of the Vulnerable Software and Affected Versions: WooCommerce Easy Checkout Field Editor, Fees & Discounts versions n/a through 3.5.12 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the specified versions of WooCommerce Easy Checkout...

PT-2024-21205 · Skymoonlabs · Skymoonlabs Moveto

Name of the Vulnerable Software and Affected Versions: Skymoonlabs MoveTo versions n/a through 6.2 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Skymoonlabs MoveTo. This allows for the upload of files with potentially dangerous types withou...

AZL-35148 CVE-2024-27319 affecting package pytorch for versions less than 2.2.2-1

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...

CVE-2024-25928

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1.0.5...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: cilium-cli, zot, kubescape, k9s, chartmuseum, up, eksctl, zarf, k8sgpt, kubevela, kots, flux-helm-controller, helm-operator, trivy, flux-source-controller, helm-push...

CVE-2024-26583

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete; any code past that point risks touching already freed data. This could lead to a use-after-free issue an...

CVE-2024-24802

Cross-Site Request Forgery CSRF vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9...

CVE-2024-24876

Cross-Site Request Forgery CSRF vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12...

PT-2024-17953 · WordPress · Imagerecycle

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.13 Description: The issue is due to missing or incorrect nonce validation on the disableOptimization function, making it possible for unauthenticated...

PT-2024-18140 · WordPress · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress plugin for WordPress versions up to, and including, 4.14.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's login-password shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-52373

Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing...

CVE-2023-52373

Summary of CVE-2023-52373 : A permission verification flaw in the Huawei HarmonyOS/EMUI share box module's content sharing pop-up allows unauthorized file sharing. The vulnerability is described across multiple sources (NVD, Red Hat CVE page, CNVD/CNNVD entries) with a high impact on confidential...

SUSE CVE-2024-0793

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

PT-2024-14563 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue concerns a vulnerability of permission verification in the content sharing pop-up module. Successful exploitation of this issue may cause unauthorized file sharing...