Low: pam

Issue Overview: A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with /tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with pamnamespace configured will cause the openat in...

Important: kernel

Issue Overview: An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter: nftables: Reject tables of unsupported family; While creating a new netfilter table, lack of a safeguard against invalid nftables family pf values within nftablesnewtable...

Medium: python-jinja2

Issue Overview: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter...

Low: indent

Issue Overview: A flaw was found in Indent. This issue may allow a local user to use a specially-crafted file to trigger a heap-based buffer overflow, which can lead to an application crash. CVE-2024-0911 Affected Packages: indent Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: rear

Issue Overview: Relax-and-Recover aka ReaR through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root. CVE-2024-23301 Affected Packages: rear Note: This advisory is applicable to Amazon Linux 2...

Medium: python3-jinja2

Issue Overview: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter...

Important: nss

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

CVE-2023-52175

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Uno miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1...

CVE-2023-52175 WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Uno miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1...

CVE-2023-52175

CVE-2023-52175 affects the WordPress Auto Amazon Links – Amazon Associates Affiliate Plugin up through version 5.1.1. Root cause: improper neutralization of input during web page generation, enabling stored XSS. A fix is available in 5.1.2; update to a version later than 5.1.1 to mitigate. Patchs...

CVE-2023-52175 WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Uno miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1...

CVE-2023-52175 WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Uno miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1...

Amazon Linux 2 : runc (ALASECS-2024-033)

The version of runc installed on the remote host is prior to 1.1.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-033 advisory. AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under...

Amazon Linux 2 : runc (ALASDOCKER-2024-036)

The version of runc installed on the remote host is prior to 1.1.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-036 advisory. AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under...

PT-2024-14446 · WordPress · Auto Amazon Links – Amazon Associates Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: Auto Amazon Links – Amazon Associates Affiliate Plugin versions through 5.1.1 Description: The issue affects the Auto Amazon Links – Amazon Associates Affiliate Plugin, allowing Stored XSS due to improper neutralization of input during web pa...

WordPress plugin Auto Amazon Links Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Amazon Linux AMI : runc (ALAS-2024-1911)

The version of runc installed on the remote host is prior to 1.1.11-1.1. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1911 advisory. AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2024-036)

The version of runc installed on the remote host is prior to 1.1.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2024-036 advisory. AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management system...

Bref Security Vulnerabilities

Bref is an open source project by Matthieu Napoli Individual Developer that helps you go serverless on AWS using PHP. A security vulnerability exists in versions prior to Bref 2.1.13 that stems from inconsistent parsing of body text by the Bref and Event-Driven functions...

Amazon Linux 2023 : runc (ALAS2023-2024-501)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-501 advisory. 2024-02-01: CVE-2023-39326 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from...