unbound: integer overflow in the regional allocator via the ALIGN_UP macro

A flaw was found in unbound. An integer overflow in the regional allocator via the ALIGNUP macro may lead to a buffer overflow if the size can be controlled by an attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability...

kernel: ath11k: mhi: use mhi_sync_power_up()

In the Linux kernel, the following vulnerability has been resolved: ath11k: mhi: use mhisyncpowerup If amss.bin was missing ath11k would crash during 'rmmod ath11kpci'. The reason for that was that we were using mhiasyncpowerup which does not check any errors. But mhisyncpowerup on the other hand...

PT-2022-24230 · WordPress · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify plugin versions = 4.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to...

PT-2022-26198 · Unknown · Mantenimiento Web Plugin

Name of the Vulnerable Software and Affected Versions: Mantenimiento web plugin versions = 0.13 Description: The issue is related to an authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker who has admin or higher privileges can inject malicious scripts into the websit...

CVE-2022-36404

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in David Cole Simple SEO WordPress plugin plugin = 1.8.12 versions...

RHEL 8 : kernel-rt (RHSA-2022:7280)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7280 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Homepage Pop-up <= 1.2.5 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

PT-2022-18506 · Sick · Sick Sim2000St

Name of the Vulnerable Software and Affected Versions: SICK SIM2000ST versions =1.7.0 Description: A password recovery issue allows an unprivileged remote attacker to invoke the password recovery mechanism method, gaining access to the user level defined as RecoverableUserLevel. This results in...

RHEL 8 : kernel (RHSA-2022:7279)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7279 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: a use-after-free in clsroute...

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

PT-2022-20165 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: A command injection issue exists in the XCMD setUPnP functionality, allowing arbitrary command execution through a specially-crafted XCMD. An attacker can...

Exploit for Out-of-bounds Write in Linux Linux_Kernel

CVE-2022-1015 A write-up and Local Privilege Escalation Proof-...

CVE-2022-41638

Auth. Stored Cross-Site Scripting XSS in Pop-Up Chop Chop plugin = 2.1.7 on WordPress...

Cross site scripting

Auth. Stored Cross-Site Scripting XSS in Pop-Up Chop Chop plugin = 2.1.7 on WordPress...

CVE-2022-41638 WordPress Pop-Up Chop Chop plugin <= 2.1.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS in Pop-Up Chop Chop plugin = 2.1.7 on WordPress...

CVE-2022-41638

The CVE-2022-41638 entry concerns the WordPress plugin Pop-Up Chop Chop (versions

WordPress Plugin Pop-Up Chop Chop 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

SUSE SLES12 Security Update : clone-master-clean-up (SUSE-SU-2022:3674-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3674-1 advisory. - CVE-2021-32000: Fixed some potentially dangerous file system operations bsc1181050. Bugfixes: - Fixed failures to remove btrfs snapshots...

SUSE: Security Advisory (SUSE-SU-2022:3674-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Stored Cross-Site Scripting (XSS)

Description There is insufficient input validation in the pop-up notifications. Proof of Concept Steps to reproduce: 1. Log in to an admin account 2. Click on Services - Services Templates 3. Create a new Service Template with the Name alertdocument.location 4. The XSS is triggered when the...