AZL-53748 CVE-2024-8932 affecting package php for versions less than 8.1.31-1

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, uncontrolled long string inputs to ldapescape function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write...

WordPress ForumEngine theme <= 1.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by rajanhoyr in WordPress Theme ForumEngine versions = 1.8...

WordPress System Dashboard plugin < 2.8.15 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Dogus Demirkiran in WordPress Plugin System Dashboard versions 2.8.15...

WordPress BSK Forms Validation plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin BSK Forms Validation versions = 1.7...

WordPress SEO Plugin by Squirrly SEO plugin < 12.3.21 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SEO Plugin by Squirrly SEO versions 12.3.21...

AZL-53834 CVE-2024-53058 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data In case the non-paged data of a SKB carries protocol header and protocol payload to be transmitted on a certain platform that the DMA AXI address width is...

AZL-53894 CVE-2024-53047 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcureadlock Enabling CONFIGPROVERCULIST with its dependence CONFIGRCUEXPERT creates this splat when an MPTCP socket is created: ============================= WARNING: suspicious RCU usage 6.12.0-rc...

WordPress Jobify theme < 4.3.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Jobify versions 4.3.0...

WordPress Jobify theme < 4.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Jobify versions 4.3.0...

CVE-2024-49574

Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module...

PT-2024-33553 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8123 Description: The issue is related to SQL Injection in the reports module. This can potentially lead to data compromise, including access to sensitive information or manipulation and...

Apache Tomcat < 10.1.33 Vulnerability

Binary data 701491.pasl...

WordPress Steel plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Steel versions = 1.3.0...

WordPress SKT Donation plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Muhamad Agil Fachrian in WordPress Plugin SKT Donation versions = 1.9...

torchgeo Python Library < 0.6.1 RCE

The version of the torchgeo Python library installed on the remote host is prior to 0.6.1. It is, therefore, affected by a remote code execution vulnerability. The usage of 'eval' in torchgeo's 'getweight' API function could allow an unauthenticated, remote attacker to execute arbitrary commands...

PT-2024-35357 · Unknown · Budget Control Gateway

Name of the Vulnerable Software and Affected Versions: Budget Control Gateway versions prior to 1.5.2 Description: The Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. It does not properly validate auth tokens...

WordPress Automation By Autonami plugin < 3.3.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by y4ng0615 in WordPress Plugin FunnelKit Automations versions 3.3.0...

AZL-52910 CVE-2024-4741 affecting package hvloader for versions less than 1.0.1-6

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...

Drupal POST File module < 1.0.2 - Authenticated Multiple Vulnerabilities vulnerability

Authenticated Multiple Vulnerabilities vulnerability discovered by Pierre Rudloff in WordPress Module POST File versions 1.0.2...

CVE-2024-50558

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.2, SCALANCE...