MAL-2024-10656 Malicious code in eslint-plugin-add-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8efa7275ffd4613db923c31dba516fc3434fb3fecb4ccfbd1e1cb929399a6b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-add-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8efa7275ffd4613db923c31dba516fc3434fb3fecb4ccfbd1e1cb929399a6b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Teachers Record Management System add-teacher.php File SQL Injection Vulnerability

Teachers Record Management System is a teacher record management system. Teachers Record Management System is vulnerable to a SQL injection vulnerability that stems from the presence of a SQL injection vulnerability in the add-teacher.php file via a cell phone number or email parameter. No detail...

CVE-2024-10265

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for...

driver core: Fix a potential null-ptr-deref in module_add_driver()

...

net: do not delay dst_entries_add() in dst_release()

...

CVE-2024-10683

CVE-2024-10683 affects the WordPress plugin Contact Form 7 – PayPal & Stripe Add-on, due to unsafe use of add_query_arg/remove_query_arg without proper escaping. The issue is Reflected XSS, exploitable by unauthenticated actors who can trick a user into clicking a manipulated link, with exploitat...

WordPress Contact Form 7 - PayPal & Stripe Add-on plugin <= 2.3.1 - Reflected Cross-Site Scripting vulnerability

WordPress Contact Form 7 - PayPal & Stripe Add-on plugin = 2.3.1 - Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.3.1...

CVE-2024-50966

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/doAdminAction.php?act=addAdmin...

The vulnerability of the iommufd component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the iommufd component in the Linux operating system’s kernel is related to improper release of resources in the ioptaddaccess function. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2024-34476 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/doAdminAction.php?act=addAdmin component. This allows for attacker-controlled admin creation, resulting in unauthorized privileged...

PT-2024-40628 · Git +1 · Krb5

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves the k5 hashtab add and insert entry functions in the fuzz...

Mars: unauthorized access and add user and change personal information all users

The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...

CVE-2024-43425 Moodle: remote code execution via calculated question types

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

UBUNTU-CVE-2024-50159

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix the double free in scmidebugfscommonsetup Clang static checkerscan-build throws below warning： | drivers/firmware/armscmi/driver.c:line 2915, column 2 | Attempt to free released memory. When...

CVE-2024-50140 sched/core: Disable page allocation in task_tick_mm_cid()

In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in tasktickmmcid With KASAN and PREEMPTRT enabled, calling taskworkadd in tasktickmmcid may cause the following splat. 63.696416 BUG: sleeping function called from invalid context at...

CVE-2024-51358

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application...

WordPress plugin Seriously Simple Podcasting 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Seriously Simple...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the addattributes Twig function. PoC php Dangerous user supplied variable % set payload = 'alertxss' % Here, Twig escapes it payload Here it is not escaped alertxss' foo Details...

PT-2024-16515 · Unknown · Codezips Pet Shop Management System

Name of the Vulnerable Software and Affected Versions: Codezips Pet Shop Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file /productsadd.php. The manipulation of the argument id leads to sql injection. It is possible to...