The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from an incorrect limitation on the path name for the restricted access directory. This allows a malicious user to write files to arbitrary locations on the server when creating a working area.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to perform file writing operations at arbitrary locations o...

CVE-2024-24399

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area...

kernel: nfp: use-after-free in area_cache_get()

A vulnerability was found in areacacheget in drivers/net/ethernet/netronome/nfp/nfpcore/nfpcppcore.c in the Netronome Flow Processor NFP driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue...

kernel: nfp: use-after-free in area_cache_get()

A vulnerability was found in areacacheget in drivers/net/ethernet/netronome/nfp/nfpcore/nfpcppcore.c in the Netronome Flow Processor NFP driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue...

CVE-2024-24399

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area...

Cross site scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-0665

Summary: CVE-2024-0665 affects the WP Customer Area WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) via the tab parameter in versions up to and including 8.2.1, caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to in...

CVE-2024-0665 WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

SUSE CVE-2024-22705

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfromutf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled...

The vulnerability of the devinfo interface in D-Link’s microprogrammed router software allows a intruder to gain unauthorized access to protected information.

The vulnerability of the devinfo interface in D-Link’s microprogrammed router software is related to insufficient protection of operational data during the processing of the area parameter. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information by...

WordPress Plugin WP Customer Area Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress WP Customer Area Plugin <= 8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Customer Area Type Plugin Vulnerable versions = 8.2.2 Fixed in 8.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0665 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f88bc5bdc8b9 Credits Krzysztof Zając...

DEBIAN-CVE-2024-22705

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfromutf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled...

AZL-33961 CVE-2024-22705 affecting package kernel for versions less than 5.15.148.1-1

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfromutf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled...

The vulnerability of the Packet Forwarding Engine (PFE) in Juniper Networks’ Junos operating system, which allows a hacker to gain access to confidential data

The vulnerability of the packet forwarding engine PFE in Juniper Networks’ Junos operating system is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...

CVE-2023-6741

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address...

CVE-2023-6824

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6824

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6824 WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6824

CVE-2023-6824 affects the WordPress plugin WP Customer Area prior to version 8.2.1. The issue is that the plugin does not properly validate user capabilities in some AJAX actions , allowing any user to retrieve another user’s account address. The CVE is consistently described across sources as a ...