MAL-2024-10348 Malicious code in puppeteerrecordr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07fa60fc847aad89edf3e0b1a08fb616a974e04d1623735955408437bdb25e13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10347 Malicious code in puppeteerpluginstealth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a636c907637d75c99aadbb0e09e1e5e675cb6322277962a5d3b2a75622e0d3e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-31835 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue is a post-authentication command injection problem. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to setSWMGroup. This allows for potential comma...

PT-2024-31838 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue is a post-authentication command injection vulnerability. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to commandTable. This vulnerability happe...

Virtuozzo Hybrid Server 7.5 Update 7 (7.5.7-129)

Virtuozzo Hybrid Server 7.5 Update 7 introduces a way to convert system containers to virtual machines, support for Ubuntu 24.04 LTS, and bug fixes. Additionally, it provides a new kernel 3.10.0-1160.119.1.vz7.224.4. Vulnerability id: PSBM-159393 Memory corruption leading to a crash in nodes in...

RHEL 6 / 7 : ror40-rubygem-actionpack (RHSA-2016:1857)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1857 advisory. Ruby on Rails is a model-view-controller MVC framework for web application development. Action Pack implements the controller and the view...

PT-2024-16550 · Unknown · Codezips Hospital Appointment System

Name of the Vulnerable Software and Affected Versions: Codezips Hospital Appointment System version 1.0 Description: A critical issue has been found in the system, affecting some unknown processing of the file /doctorAction.php. The manipulation of the argument Name leads to sql injection. The...

RHEL 6 / 7 : ruby193-rubygem-actionpack (RHSA-2016:1858)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1858 advisory. Ruby on Rails is a model-view-controller MVC framework for web application development. Action Pack implements the controller and the view...

CVE-2024-8739 ReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site Scripting

The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-8739

CVE-2024-8739 concerns the ReCaptcha Integration for WordPress plugin vulnerable to Reflected Cross-Site Scripting (XSS) due to improper escaping in add_query_arg on the URL for all versions up to and including 1.2.5. The issue allows unauthenticated attackers to inject arbitrary scripts on pages...

SUSE-SU-2024:3877-1 Security update for rubygem-actionpack-5_1

This update for rubygem-actionpack-51 fixes the following issues: - CVE-2024-47887: Fixed Possible ReDoS vulnerability in HTTP Token authentication in Action Controller bsc1231729. - CVE-2024-42228: Fixed uninitialized value size when calling amdgpuvcecsreloc bsc1228667...

CVE-2024-10597

A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function delPolicyAction of the file /com/esafenet/servlet/system/PolicyActionService.java. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The...

PT-2024-16394 · Safenet · Esafenet Cdg 5

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG 5 Description: A critical vulnerability has been found in ESAFENET CDG 5, affecting the function delPolicyAction of the file /com/esafenet/servlet/system/PolicyActionService.java. The manipulation of the argument id leads to SQL...

Mattermost Server 9.5.x < 9.5.9 / 9.10.x < 9.10.2 / 9.11.x < 9.11.1 Multiple Vulnerabilities

The version of Mattermost Server installed on the remote host is prior to 9.5.9, 9.10.2, or 9.11.1. It is, therefore, affected by multiple vulnerabilities. - Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 fail to sanitize user inputs in the frontend that are used for...

CVE-2024-8871 Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scripting

The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to...

CVE-2024-8871 Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scripting

The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to...

MAL-2024-10278 Malicious code in req-bans (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 891a9d8d6df58ad3743a6ec2db7217d78ec1fe0a3d8bb938181ec4ac26ee5489 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10276 Malicious code in princedevmd1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a5e6c2e25296a36f3923783f37ad2d8bc6e4ee785afcd14f29978aecbd8e54c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-8792 Subscribe to Comments <= 2.3 - Reflected Cross-Site Scripting

The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

A vulnerability was found in the Linux kernel's networking subsystem in the actapi implementation within the tcfidrcheckalloc function, which lead to a possible infinite loop when multiple actions with the same index are added, causing the second request to block indefinitely while holding the...