kernel: net/tls: tls_is_tx_ready() checked list_entry

A memory leak flaw was found in the Linux kernel's TLS protocol. This issue could allow a local user unauthorized access to some memory...

PT-2024-20359 · Totolink · Totolink A8000Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A8000RU version 7.1cu.643 B20200521 Description: The issue is related to a hardcoded password for the root user stored in the /etc/shadow file. This could potentially allow unauthorized access to the system. Recommendations: For...

CVE-2020-36772

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment...

All users can reset the allowed apps list for Guest App users

None...

UBUNTU-CVE-2024-0641

A denial of service vulnerability was found in tipccryptokeyrevoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system...

Hitachi Tuning Manager Security Vulnerability

Hitachi Tuning Manager is a performance tuning and monitoring tool provided by Hitachi, Japan. A security vulnerability exists in Hitachi Tuning Manager versions prior to 8.8.5-04, which stems from incorrect default permissions that allow local users to read and write specific files...

CVE-2023-4962

The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'videopopup' shortcode in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-4960 WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfmstores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-31001

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653...

CVE-2023-31001 IBM Security Access Manager Container information disclosure

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653...

IBM Security Access Manager Appliance Security Vulnerability

IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from International Business Machines IBM. The product is primarily used for access control and Web-based threat protection, providing system performance monitoring, log analysis and diagnostics. A...

PT-2024-13762 · WordPress · Wcfm Marketplace

Name of the Vulnerable Software and Affected Versions: WCFM Marketplace plugin for WordPress versions up to, and including, 3.6.2 Description: The issue is related to Stored Cross-Site Scripting via the 'wcfm stores' shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-48245

The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user “root” via a crafted HTTP request...

GHSA-RWF9-8FQR-P44M Qualys Jenkins Plugin for Policy Compliance Cross-site Scripting vulnerability

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure o...

Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs...

Design/Logic Flaw

Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize t...

OpenVPN Connect Security Breach

OpenVPN Connect is a VPN Virtual Private Network client application from US-based OpenVPN. A security vulnerability exists in OpenVPN Connect versions 3.0 through 3.4.6, which stems from a vulnerability that allows local users to execute code in external third-party libraries using the...

My Agile Privacy < 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode

Description The My Agile Privacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access

Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact An attacker that...

GitLab 12.9.0 < 13.10.5 / 13.11.0 < 13.11.5 / 13.12.0 < 13.12.2 (CVE-2021-22221)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2...