WordPress Automatically Hierarchic Categories in Menu plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin Automatically Hierarchic Categories in Menu versions = 2.0.5...

CVE-2024-4847: Improper Neutralization of Special Elements used in an SQL Command

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘lastpostid’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficie...

PT-2024-23301 · Mesonlsp · Mesonlsp

Name of the Vulnerable Software and Affected Versions: MesonLSP versions prior to 4.1.4 Description: A vulnerability in MesonLSP allows overwriting arbitrary files if an attacker can make the victim run the language server within a specific crafted project or execute mesonlsp --full...

CVE-2023-47633

Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions...

CVE-2023-25059

CVE-2023-25059 affects the avalex WordPress plugin (versions ≤ 3.0.3). The vulnerability is a Stored Cross-Site Scripting (XSS) that requires authentication with admin+ privileges and is exploitable via user interaction. The underlying issue relates to insufficient input cleanup/output escaping i...

CVE-2023-25059: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in avalex GmbH avalex – Automatically secure legal texts plugin = 3.0.3 versions...

Gigaset Android Update Server Hacked to Install Malware on Users' Devices

Gigaset has revealed a malware infection discovered in its Android devices was the result of a compromise of a server belonging to an external update service provider. Impacting older smartphone models — GS100, GS160, GS170, GS180, GS270 plus, and GS370 plus series — the malware took the form of...

grok:grk_decompress_fuzzer: Heap-use-after-free in grk::SOTMarker::read

Detailed Report: https://oss-fuzz.com/testcase?key=5720229752340480 Project: grok Fuzzing Engine: afl Fuzz Target: grkdecompressfuzzer Job Type: aflasangrok Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x60d000000380 Crash State: grk::SOTMarker::read grk::j2kreadsot...

CVE-2020-1773

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...

quickjs:fuzz_regexp: Heap-buffer-overflow in re_parse_disjunction

Detailed Report: https://oss-fuzz.com/testcase?key=5730680467357696 Project: quickjs Fuzzing Engine: honggfuzz Fuzz Target: fuzzregexp Job Type: honggfuzzasanquickjs Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x7f559109dea8 Crash State: reparsedisjunction reparseterm...

Code injection

LibreOffice and OpenOffice automatically open embedded content...

Denial Of Service (DoS)

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...

CVE-2013-7464

In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...

imagemagick/encoder_wpg_fuzzer: Use-of-uninitialized-value in ConstrainColormapIndex

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5521019725938688 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderwpgfuzzer Fuzz target binary: encoderwpgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Fsociety Hacking Tools Pack

Fsociety Menu Information Gathering Password Attacks Wireless Testing Exploitation Tools Sniffing & Spoofing Web Hacking Private Web Hacking Post Exploitation INSTALL & UPDATE Information Gathering : Nmap Setoolkit Port Scanning Host To IP wordpress user CMS scanner XSStracer Dork – Google Dorks...

chakra: Crash in Js::JavascriptObject::CreateKeysHelper

Detailed report: https://oss-fuzz.com/testcase?key=5612339362529280 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x007fe19e6e44 Crash State: Js::JavascriptObject::CreateKeysHelper Js::JavascriptOperators::GetOwnPropertyNames...

dlplibs: Crash in librevenge::IStorage::load

Detailed report: https://oss-fuzz.com/testcase?key=5488429968130048 Project: dlplibs Fuzzer: afldlplibsbmifuzzer Fuzz target binary: bmifuzzer Job Type: aflasandlplibs Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x619800000f78 Crash State: librevenge::IStorage::load...

pcre2: Heap-buffer-overflow in _pcre2_auto_possessify_8

Project: svn://vcs.exim.org/pcre2/code/trunk Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4892227272704000 Target: pcre2 Fuzzer: libFuzzerpcre2fuzzer Fuzzer binary: pcre2fuzzer Job Type: libfuzzerasanpcre2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

libass: Global-buffer-overflow in ass_strtod

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5423111939817472 Target: libass Fuzzer: libFuzzerlibassfuzzer Fuzzer binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Global-buffer-overflow READ 8...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20151216)

A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive serve...