PT-2024-9678 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, potentially exposing credentials for a remot...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel that stems from an incorrect boundary check in the rpcmsghandler and related handlers in drivers/misc/mediatek/ecci/portrpc.c, which can lead to out-of-bounds writes...

CVE-2024-39890: Out-of-bounds Write

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300. The baseband software does not properly check the length specified by the CC Call...

CVE-2024-53730: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in springthistle April's Call Posts aprils-call-posts allows Stored XSS.This issue affects April's Call Posts: from n/a through = 2.1.1...

WordPress plugin Aprils Call Posts: Cross-site Request Forgery vulnerability

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerabilit...

Cisco NX-OS Software Call Home Command Injection (CVE-2020-3454)

A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be executed with root privileges on the underlying operating system OS. The vulnerability is due to insufficient input validation of specific Call...

PT-2024-41065 · Git +1 · Shaderc

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A crash occurs due to a container-overflow READ 8 issue. The crash involves the glslang::HlslParseContext::decomposeIntrinsic and glslang::HlslParseContext::handleFunctionCall functions, as...

CVE-2024-11407

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPCARGTCPTXZEROCOPYENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network...

DEBIAN-CVE-2024-52336

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create

A flaw was found in the Linux kernel in which a system crash can occur if there are certain errors establishing RPC-over-RDMA connections...

kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create

A flaw was found in the Linux kernel in which a system crash can occur if there are certain errors establishing RPC-over-RDMA connections...

kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create

A flaw was found in the Linux kernel in which a system crash can occur if there are certain errors establishing RPC-over-RDMA connections...

PT-2024-8833

Name of the Vulnerable Software and Affected Versions: Tuned affected versions not specified Description: A script injection vulnerability was identified in the Tuned package. The instance create D-Bus function can be called by locally logged-in users without authentication, allowing a local...

GRPC security vulnerabilities

gRPC is a modern, open-source, high-performance Remote Procedure Call RPC framework from gRPC Open Source. A security vulnerability exists in gRPC that stems from the presence of a data corruption issue that could lead to a denial of service...

CVE-2024-53100

In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queuelock lock and destroy Commit 76d54bf20cdc "nvme-tcp: don't access released socket during error recovery" added a mutexlock call for the queue-queuelock in nvmetcpgetaddress. However, the mutexlo...

WordPress April's Call Posts plugin <= 2.1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin April's Call Posts versions = 2.1.1...

Astra Linux – Vulnerability in oath-toolkit

pamoath.so in oath-toolkit 2.6.7 through 2.6.11—before 2.6.12—allows root privilege escalation. This is because, in the context of PAM code running as root, it improperly handles user file access, such as by calling fchown when a symlink exists...

WordPress April's Call Posts Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software April's Call Posts Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53730 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 5fa9ffdca641 Credits SOPROBRO Required...

CVE-2024-8359

Visteon Infotainment REFLASHDDUFindFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability...

CVE-2024-8360

Visteon Infotainment REFLASHDDUExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerabilit...