CVE-2024-39680 WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...

CVE-2024-6830

A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument orderid leads to sql injection. It is possible to launch t...

CVE-2024-39700 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to...

CVE-2024-39700 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to...

Xapi: Metadata injection attack against backup/restore functionality

ISSUE DESCRIPTION For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk...

SUSE CVE-2024-40995

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc syzbot found hanging tasks waiting on rtnllock 1 A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, t...

CVE-2024-40456

ThinkSAAS v3.7.0 contains an SQL injection vulnerability exploitable via the name parameter in /system/action/update.php. Root cause described in connected sources as insufficient validation of external input in that endpoint. CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no pri...

MAL-2024-7753 Malicious code in jfrog-jfconfig-grpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 177a2d1912b1051b4347d51ff6410db1077d40c3cd21468d673acef023e3e1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-40995

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix possible infinite loop in tcfidrcheckalloc syzbot found hanging tasks waiting on rtnllock 1 A reproducer is available in the syzbot bug. When a request to add multiple actions with the same index is sent, t...

CVE-2024-40957

In the Linux kernel, the following vulnerability has been resolved: seg6: fix parameter passing when calling NFHOOK in End.DX4 and End.DX6 behaviors inputactionenddx4 and inputactionenddx6 are called NFHOOK for PREROUTING hook, in PREROUTING hook, we should passing a valid indev, and a NULL outde...

CVE-2024-40907 ionic: fix kernel panic in XDP_TX action

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

CVE-2024-40907

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

CVE-2024-40907 ionic: fix kernel panic in XDP_TX action

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

Malicious code in sap-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a86fb8f978ad82ca9de70f4315ffa1df414b3ff775a936c4e79ffff2f585c024 The OpenSSF Package Analysis project identified 'sap-action' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7487 Malicious code in sap-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a86fb8f978ad82ca9de70f4315ffa1df414b3ff775a936c4e79ffff2f585c024 The OpenSSF Package Analysis project identified 'sap-action' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7705 Malicious code in flammerxdjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8b6b80199d2f6500f4b47a77309fa995e34a633ea2fa5f5e265d0b1ffb7b085 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7719 Malicious code in stylesnox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 231ba61276a9baae8583e87d40a97b7ee4c4dff960555a6df856c57ed2adff0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7475 Malicious code in stylishhteks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab7ae115a3f473013d0ef082a8248081b7ba44388a767650b9cf36ff622e657b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7440 Malicious code in ali-in-wlnd-test-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0d89d3dbaa5fb0db4821d7bddc99121add0aec27e506f275ad018fb0c0608af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6411

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pmuploadimage' AJAX action. This makes it possible for authenticated...