AZL-71317 CVE-2024-6485 affecting package reaper for versions less than 3.1.1-22

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting XSS attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribut...

WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Change From Email versions = 1.2.1...

WordPress VikRentCar Car Rental Management System plugin < 1.3.2 - Cross Site Request Forgery vulnerability

Cross Site Request Forgery vulnerability discovered by Srikar V in WordPress Plugin VikRentCar versions 1.3.2...

WordPress FormFlow plugin < 2.12.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dikshita Trivedi Cybersecdexter and Dipak Panchal th3.d1p4k in WordPress Plugin FormFlow versions 2.12.2...

UBUNTU-CVE-2024-6609

When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox 128 and Thunderbird 128...

PT-2024-22596 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.3.0p8 Checkmk versions 2.2.0p29 Checkmk versions 2.1.0p45 Checkmk versions = 2.0.0p39 Description: Cross-Site request forgery in Checkmk could lead to 1-click compromise of the site. Recommendations: For Checkmk versions...

AZL-43255 CVE-2024-39684 affecting package rapidjson for versions less than 1.1.0-8

Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the GenericReader::ParseNumber function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer...

DEBIAN-CVE-2024-6609

When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox 128 and Thunderbird 128...

DEBIAN-CVE-2024-6601

A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability

Sensitive Data Exposure via Log File vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme SmartMag versions 10.1.0...

CVE-2024-39568

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 HF1. The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading proxy configurations. This could allow an authenticated local attacker...

WordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin ARForms Form Builder versions = 1.6.7...

AZL-43198 CVE-2024-5569 affecting package python-zipp for versions less than 3.17.0-3

A Denial of Service DoS vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the...

CVE-2024-37829

An issue in Outline = v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link...

AZL-43224 CVE-2024-39695 affecting package exiv2 for versions less than 0.28.3-1

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds...

AZL-43210 CVE-2024-3651 affecting package python-pip for versions less than 24.0-2

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...

AZL-43201 CVE-2024-3651 affecting package python-idna for versions less than 3.7-1

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...

AZL-43207 CVE-2024-3651 affecting package tensorflow for versions less than 2.16.1-7

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...

WordPress Himer theme < 2.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Theme Himer versions 2.1.1...

AZL-43110 CVE-2023-24531 affecting package golang for versions less than 1.21.0-1

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...