CVE-2024-42230 powerpc/pseries: Fix scv instruction crash with kexec

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL reloconexc, required for scv instruction support, before other CPUs have been shut down. This means they can execute scv instructions after AIL i...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from an uninitialized wxnumqvectors in the net:txgbe module when using MSI/INTx interrupts, resulting in a...

WonderCMS security vulnerabilities

WonderCMS is an open source PHP-based content management system CMS from WonderCMS Inc. A security vulnerability exists in WonderCMS version 3.4.3, which stems from an arbitrary file upload vulnerability in the uploadFileAction function, allowing an attacker to execute arbitrary code via a crafte...

SyroTech SY-GPON-1110-WDONT security vulnerability

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a missing security flag in a session cookie associated with the router's web management interface. An attacker could exploit thi...

Streamlit-geospatial code issues and vulnerabilities

streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A code issue vulnerability exists in streamlit-geospatial that stems from pages/9? The url variable in VectorDataVisualization.py accepts user input, which is then passed...

PT-2024-5305 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpipam version 1.6 Description: The issue is related to Cross Site Scripting XSS in the phpipam application. Specifically, the "/app/admin/widgets/edit.php" endpoint is vulnerable. This vulnerability can be exploited by a remote attacker to...

CVE-2024-6896

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-19015 · Atlassian · Bitbucket

Name of the Vulnerable Software and Affected Versions: Bitbucket Data Center versions 8.0.0 through 8.9.12 Bitbucket Data Center versions 8.19.0 through 8.19.1 Description: The issue is an open redirect vulnerability that allows an unauthenticated attacker to redirect a victim user upon login to...

Telegram security vulnerabilities

Telegram is an instant messaging mobile application open-sourced by Telegram. A security vulnerability exists in Telegram version 10.14.4 and earlier versions. An attacker exploiting the vulnerability could send a malicious application disguised as a video...

Potential memory exhaustion attack due to sparse slice deserialization

...

Security Bulletin: Multiple vulnerabilities in IBM JAVA JDK affect IBM Storage Scale packaged in IBM Storage Scale System

Summary Multiple vulnerabilities in IBM Java JDK, used by IBM Storage Scale System GUI, could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact and no availability impact. CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926,...

Ubuntu: Security Advisory (USN-6893-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-21126

Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.23 and 21.3-21.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable...

OpenJDK: potential UTF8 size overflow (8314794)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

Ubuntu: Security Advisory (USN-6898-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

New HardBit Ransomware 4.0 Uses Passphrase Protection to Evade Detection

Cybersecurity researchers have shed light on a new version of a ransomware strain called HardBit that comes packaged with new obfuscation techniques to deter analysis efforts. "Unlike previous versions, HardBit Ransomware group enhanced the version 4.0 with passphrase protection," Cybereason...

WordPress Support SVG plugin < 1.1.0 - Stored XSS via SVG Upload vulnerability

Stored XSS via SVG Upload vulnerability discovered by Rayhan Ramdhany Hanaputra in WordPress Plugin Support SVG versions 1.1.0...

PT-2024-18926 · Unknown · Langchain Experimental +1

Name of the Vulnerable Software and Affected Versions: langchain-experimental versions 0.0.15 through 0.0.21 Description: The issue allows for Arbitrary Code Execution when retrieving values from the database. An attacker can exploit this by controlling the input prompt and executing arbitrary...

CVE-2024-4269

The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...

WordPress plugin Support SVG security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress plugin Suppor...