WordPress Audio Comparison Lite Plugin <= 3.4 is vulnerable to Cross Site Scripting (XSS)

Software Audio Comparison Lite Type Plugin Vulnerable versions = 3.4 Fixed in 3.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51627 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a5a84c2cb69 Credits SOPROBRO Required privilege...

FreeBSD -- Multiple issues in the bhyve hypervisor

Problem Description: Several vulnerabilities were found in the bhyve hypervisor's device models. The NVMe driver function nvmeopcgetlogpage is vulnerable to a buffer over- read from a guest-controlled value. CVE-2024-51562 The virtiovqrecordon function is subject to a time-of-check to time-of-use...

ROS-20241025-02

Vulnerability of usb-audio component of Linux kernel is related to NULL pointer dereferencing in the sndusbsetsampleratev2v3 function in sound/usb/clock.c. Exploitation of the vulnerability could allow an attacker to cause a denial of service A vulnerability in the target component of the target...

WordPress Compact WP Audio Player plugin <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via scembedplayer Shortcode vulnerability discovered by theviper17y in WordPress Plugin Compact WP Audio Player versions = 1.9.13...

WordPress plugin Compact WP Audio Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Compact WP Audio Player Plugin <= 1.9.13 is vulnerable to Cross Site Scripting (XSS)

Software Compact WP Audio Player Type Plugin Vulnerable versions = 1.9.13 Fixed in 1.9.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10176 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 039bee66f701 Credits theviper17y...

The vulnerability of the create_mute_led_cdev() function (sound/pci/hda/hda_generic.c) in the ALSA sound subsystem of the Linux operating system allows a hacker to exploit their privileges.

The vulnerability of the createmuteledcdev function sound/pci/hda/hdageneric.c in the ALSA sound subsystem of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

SUSE CVE-2022-48951

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in sndsocputvolswsx are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stere...

CVE-2024-47224

A vulnerability in the AWV Audio, Web and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perfo...

CVE-2024-47189

The API Interface of the AWV Audio, Web and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of...

CVE-2024-47189

The API Interface of the AWV Audio, Web and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of...

DEBIAN-CVE-2022-49005

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for sx controls For sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in sndsocputvolswsx needs to jus...

DEBIAN-CVE-2022-48992

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Add NULL check in BE reparenting Add NULL check in dpcmbereparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test...

DEBIAN-CVE-2022-48951

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in sndsocputvolswsx are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stere...

UBUNTU-CVE-2022-48992

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Add NULL check in BE reparenting Add NULL check in dpcmbereparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test...

UBUNTU-CVE-2024-50011

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item There is no linksnum in struct sndsocacpimach , and we test !link-numadr as a condition to end the loop in hdasdwmachineselect. So an empty item in struct...

SUSE CVE-2024-7730

A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtiosndpcmincb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element...

CVE-2024-47224

The CVE concerns Mitel MiCollab’s AWV component, affecting versions prior to 9.8 SP1 FP2 (9.8.1.201). An unauthenticated attacker can exploit inadequate encoding of user input in URLs to perform a CRLF injection, enabling phishing via crafted links. Red Hat and related feeds corroborate the issue...

CVE-2024-47224

A vulnerability in the AWV Audio, Web and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perfo...

CVE-2024-47223

CVE-2024-47223 affects the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab up to version 9.8 SP1 FP2 (9.8.1.201). The Red Hat/NCSC/PTSecurity and CVE records describe an unauthenticated SQL injection caused by insufficient input sanitization, enabling access to non-sensitive u...