9522 matches found
UBUNTU-CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system including project dependencies. An attacker could exploit this vulnerability to gather details abou...
CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system including project dependencies. An attacker could exploit this vulnerability to gather details abou...
CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system including project dependencies. An attacker could exploit this vulnerability to gather details abou...
ProfilePress < 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
Description The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's reg-select-role shortcode in all versions up to, and including, 4.15.0 due to...
WordPress theme Socialdriver security vulnerability
WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. A security vulnerability exists in versions prior to WordPress theme Socialdriver 2024, which stems...
PT-2024-18917
Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.12.1 Description The issue allows for Information Exposure when the style attribute is permitted on the backend, enabling an attacker to enumerate files in the system, including project dependencies. This coul...
SUSE CVE-2023-52436
In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed...
DEBIAN-CVE-2023-52436
In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed...
Cross-site Scripting (XSS)
Overview markdown-to-jsx is a lightweight, customizable React markdown component. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in...
SUSE-SU-2024:0538-1 Security update for hdf5
This update for hdf5 fixes the following issues: Updated to version 1.10.11 Changed the error handling for a not found path in the find plugin process. Fixed CVE-2018-11202, a malformed file could result in chunk index memory leaks. Fixed a file space allocation bug in the parallel library for...
Missing Permission Checks
libzephyr.so is vulnerable to Missing Permission Checks. This vulnerability is due to improper handling of attribute permissions, specifically for LE Secure Connection encryption. The vulnerability arises because even when the BTGATTPERMREADLESC and BTGATTPERMWRITELESC configuration parameters ar...
PT-2024-16474 · WordPress · Siteorigin Widgets Bundle
Name of the Vulnerable Software and Affected Versions: SiteOrigin Widgets Bundle plugin for WordPress versions up to, and including, 1.58.2 Description: The issue is related to Stored Cross-Site Scripting via the features attribute due to insufficient input sanitization and output escaping. This...
PT-2024-7724 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the netlink component of the Linux kernel, where the validation code reads past a malformed attribute due to a missing size in the minlen array for NLA BE32. Th...
PT-2024-18186 · Bluetooth · Bluetooth
Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue concerns the BT GATT PERM READ LESC and BT GATT PERM WRITE LESC defines for a Bluetooth characteristic, which specify attribute read/write permission with LE Secure Connection...
SUSE CVE-2024-1062
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in logentryattr...
CVE-2024-23763
SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiersattribute parameter...
DEBIAN-CVE-2024-1062
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in logentryattr...
UBUNTU-CVE-2024-1062
A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in logentryattr...
Gambio SQL Injection Vulnerability
Gambio is an all-in-one e-commerce solution from Gambio, Inc. A SQL injection vulnerability exists in Gambio 4.9.2.0 and earlier versions, which stems from a vulnerability that allows an attacker to run arbitrary SQL commands using a crafted GET request via the attribute parameter...