1997 matches found
WordPress Advanced Custom Fields PRO plugin < 5.11 - Missing Authorization on Option Changes vulnerability
Missing Authorization on Option Changes vulnerability discovered by Keitaro Yamazaki in WordPress Plugin Advanced Custom Fields PRO versions 5.11...
UBUNTU-CVE-2024-9392
A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131...
WordPress PWA plugin <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin PWA versions = 1.6.3...
AZL-52774 CVE-2024-9355 affecting package golang for versions less than 1.22.9-1
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
WordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Robert DeVore Patchstack Alliance in WordPress Plugin Bold Page Builder versions 5.1.1...
WordPress The Post Grid plugin < 7.5.0 - Editor+ Stored XSS via Grid Creation vulnerability
Editor+ Stored XSS via Grid Creation vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin The Post Grid versions 7.5.0...
AZL-49927 CVE-2024-46854 affecting package kernel for versions less than 6.6.56.1-5
In the Linux kernel, the following vulnerability has been resolved: net: dpaa: Pad packets to ETHZLEN When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETHZLEN, ensuring nothing is leaked in the padding...
CVE-2024-8291 Concrete CMS Stored XSS in Image Editor Background Color
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector...
AZL-49380 CVE-2024-46800 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netemdequeue If netemdequeue enqueues packet to inner qdisc and that qdisc returns NETXMITSTOLEN. The packet is dropped but qdisctreereducebacklog is not called to update the parent's q.qlen,...
AZL-49398 CVE-2024-46739 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Fix kernel NULL pointer dereference in hvuiorescind For primary VM Bus channels, primarychannel pointer is always NULL. This pointer is valid only for the secondary channels. Also, rescind callback is meant for...
AZL-49395 CVE-2024-46723 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode may out-of-bounds...
AZL-49275 CVE-2024-46692 affecting package kernel for versions less than 6.6.51.1-1
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Mark getwqctx as atomic call Currently getwqctx is wrongly configured as a standard call. When two SMC calls are in sleep and one SMC wakes up, it calls getwqctx to resume the corresponding sleeping thread. B...
AZL-49147 CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed)
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server. Exploitation is facilitated by bypassing...
AZL-48627 CVE-2024-44987 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...
AZL-48804 CVE-2024-45619 affecting package opensc for versions less than 0.23.0-5
A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer...
WordPress Web Directory Free plugin < 1.7.3 - Unauthenticated LFI vulnerability
Unauthenticated LFI vulnerability discovered by Simone Onofri, Kim Cerra, Andrea De Dominicis in WordPress Plugin Web Directory Free versions 1.7.3...
WordPress CoBlocks plugin < 3.1.13 - Editor+ Stored XSS vulnerability
Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin CoBlocks versions 3.1.13...
WordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Seb Patchstack Alliance in WordPress Plugin Super Store Finder versions 6.9.8...