PT-2024-26835

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A missing lock when picking a channel in the smb3 module of the Linux kernel has been identified. This issue was spotted by Coverity, which reported a data race condition due to the missing loc...

The vulnerability of Eclipse Jetty servlet containers, related to uncontrolled resource consumption, allows attackers to limit the server’s ability to accept new connections from legitimate clients.

The vulnerability of Eclipse Jetty servlet containers relates to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to limit the server’s ability to accept new connections from legitimate clients...

Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery < 2.7.7.22 - Authenticated (Author+) Cross-Site Scripting

Description The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.7.7.21 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-31208

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

WordPress VK Block Patterns plugin <= 1.31.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin VK Block Patterns versions = 1.31.0...

WordPress VK Block Patterns Plugin <= 1.31.0 is vulnerable to Broken Access Control

Software VK Block Patterns Type Plugin Vulnerable versions = 1.31.0 Fixed in 1.31.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32826 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 0e6a476cb12d Credits Mika Required privilege...

CVE-2024-3818 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Block

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Social Icons" block in all versions up to, and including, 4.5.9 due to insufficient input sanitization and output escaping on user supplie...

SUSE CVE-2024-26822

In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the...

SUSE CVE-2024-26844

In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in copyfromiter Syzkaller reports a warning in copyfromiter because an ioviter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of...

SUSE CVE-2024-26899

In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between bdlinkdiskholder and partition scan 'openmutex' of gendisk is used to protect open/close block devices. But in bdlinkdiskholder, it is used to protect the creation of symlink between holding disk and...

SUSE CVE-2024-31582

FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the drawblockrectangle function of libavfilter/vfcodecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service DoS via crafted input...

Fedora 38 : wordpress (2024-0a2f144348)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0a2f144348 advisory. WordPress 6.4.4 Security Release Security updates included in this release A cross-site scripting XSS vulnerability affecting the Avatar block type; reported...

PT-2024-27198

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A vulnerability in the Linux kernel has been resolved, related to the blk-iocost module. The issue occurs when the iocg pay debt function triggers a warning if the active list is empty, which i...

PT-2024-8484 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.37 Description: The issue is related to a memory leak in the Linux kernel's bcmasp component when bringing down the interface. This occurs because the flushed packets are not reclaimed, leading to a memory...

PT-2024-26845

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A vulnerability has been resolved in the Linux kernel, specifically in the ax25 module, which handles Amateur Radio AX.25 packet protocol. The issue is related to a netdev refcount problem. Whe...

CVE-2024-32586

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Munir Kamal Gutenberg Block Editor Toolkit allows Stored XSS.This issue affects Gutenberg Block Editor Toolkit: from n/a through 1.40.4...

CVE-2024-32586

The CVE-2024-32586 entry corresponds to a Cross-Site Scripting (XSS) vulnerability in the WordPress Gutenberg Block Editor Toolkit plugin (EditorsKit) for WordPress. Affected versions are

CVE-2024-32586 WordPress Gutenberg Block Editor Toolkit plugin <= 1.40.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Munir Kamal Gutenberg Block Editor Toolkit allows Stored XSS.This issue affects Gutenberg Block Editor Toolkit: from n/a through 1.40.4...

kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service...

PT-2024-27896 · WordPress · The Essential Blocks – Page Builder Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress versions up to, and including, 4.5.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's "Social Icons" block due to...