Google Chrome < 126.0.6478.182 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 126.0.6478.182. It is, therefore, affected by multiple vulnerabilities as referenced in the 202407stable-channel-update-for-desktop advisory. - Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2024-40965

In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clkgetrate during transfer Instead of repeatedly calling clkgetrate for each transfer, lock the clock rate and cache the value. A deadlock has been observed while adding tlv320aic32x4 audio codec to the...

CVE-2024-40965

CVE-2024-40965 (Linux kernel: i2c/lpi2c): The provided documents confirm a fix for a deadlock scenario in i2c-lpi2c where repeated clk_get_rate() calls during transfers could lock the clk mutex and cause deadlock when a tlv320aic32x4 codec is added. The resolution caches the clock rate and uses a...

CVE-2024-40965 i2c: lpi2c: Avoid calling clk_get_rate during transfer

In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clkgetrate during transfer Instead of repeatedly calling clkgetrate for each transfer, lock the clock rate and cache the value. A deadlock has been observed while adding tlv320aic32x4 audio codec to the...

CVE-2024-40965 i2c: lpi2c: Avoid calling clk_get_rate during transfer

In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clkgetrate during transfer Instead of repeatedly calling clkgetrate for each transfer, lock the clock rate and cache the value. A deadlock has been observed while adding tlv320aic32x4 audio codec to the...

USN-6895-1: Linux kernel vulnerabilities

It was discovered that the ATA over Ethernet AoE driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2023-6270 It was discovered that the HugeTLB file syst...

The vulnerability of the log loading function of the HarmonyOS AILife Audio Service platform for managing audio devices allows a malicious actor to elevate their privileges and gain access to read, modify, or delete files.

The vulnerability of the log loading function of the HarmonyOS AILife Audio Service platform relates to an incorrect limitation on the path to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and gain access to read, modify, or delete...

CVE-2024-5664

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664 MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664

CVE-2024-5664 affects the MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar WordPress plugin. It allows Stored XSS via the id attribute in the sonaar_audioplayer shortcode in all versions up to 5.5 due to insufficient input sanitization/output escaping. Exploitation requires authe...

CVE-2024-5664 MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

24-hr-music (1.0.3), 2pg-music (>=1.0.0, <=1.1.2) +151 more potentially affected by CVE-2024-21521 via @discordjs/opus (>=0.1.0, <=0.8.0)

@discordjs/opus NPM version =0.1.0, =1.0.0, =1.1.2, =1.0.0, =1.0.3, =1.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2024-21521 Source advisory: OSV:GHSA-43WQ-XRCM-3VGR...

WordPress plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in t...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

Software MP3 Audio Player for Music, Radio & Podcast by Sonaar Type Plugin Vulnerable versions = 5.5 Fixed in 5.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5664 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 61d58242086...

DEBIAN-CVE-2024-39473

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension If a process module does not have base config extension then the same format applies to all of it's inputs and the process-baseconfigext i...

Vulnerability of ASoC components: mediatek’s Linux operating system kernels, which allow attackers to cause malfunctions during maintenance operations.

Vulnerability of ASoC components: mediatek’s Linux operating system kernels are vulnerable to pointer arithmetic errors. Exploiting this vulnerability can allow attackers to cause service failures...

GHSA-79W7-VH3H-8G4J yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...