WordPress plugin “Giveaways and Contests” by RafflePress: Cross-site scripting vulnerabilities

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

GitLab Information Disclosure

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to clean up data at the management level. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to...

Security update for the Linux Kernel

The SUSE Linux Enterprise FIXME kernel was updated to fix various security issues The following security issues were fixed: CVE-2022-50327: ACPI: processor: idle: Check acpifetchacpidev return value bsc1249859. CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfsparseparam bsc1249857...

kernel: smb: client: fix use-after-free in cifs_oplock_break

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifsoplockbreak A race condition can occur in cifsoplockbreak leading to a use-after-free of the cinode structure when unmounting: cifsoplockbreak cifsFileInfoputcfile cifsFileInfoputfinal...

WordPress plugin Gutenify has a cross-site scripting vulnerability

WordPress Gutenify plugin is a free visual site builder for WordPress that provides Full Site Edit FSE functionality to help users quickly build websites with preset blocks and templates. WordPress Gutenify plugin suffers from a cross-site scripting vulnerability that stems from the application's...

WordPress plugin CSV to SortTable has a cross-site scripting vulnerability

WordPress CSV to SortTable plugin is WordPress plugin for converting CSV files to interactive sorting tables. The WordPress CSV to SortTable plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data,...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-49877)

ocfs2: When doing cleanup, if flags do not have OCFS2BHREADAHEAD set, it may trigger NULL pointer dereference in the following ocfs2setbufferuptodate if bh is NULL. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

SolarWinds Observability Self-Hosted Input Validation Vulnerability

SolarWinds Observability Self-Hosted is an observation platform from SolarWinds USA. SolarWinds Observability Self-Hosted suffers from an input validation error vulnerability that stems from improper URL cleanup, which could lead to an open redirection attack...

Information Technology of East: WinPlus SQL Injection Vulnerability

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. An SQL injection vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from insufficient cleanup and escaping of the parameters val1 and cont, which...

Times Software E-Payroll security vulnerability

Times Software E-Payroll is a payroll management system from Times Software, Singapore. A security vulnerability exists in Times Software E-Payroll that stems from improper POST parameter cleanup, which could lead to denial of service attacks and SQL injection attacks...

PT-2025-51632

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the CIFS implementation, specifically within the smb3 fs context parse param function. The issue arises when processing Opt source mount option...

WordPress plugin VK All in One Expansion Unit has security vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

Siemens SCALANCE and RUGGEDCOM Devices Allocation of Resources Without Limits or Throttling (CVE-2024-39484)

mmc: davinci: Vulnerability from resource leaks. Using exit for the remove function results in the remove callback being discarded with CONFIGMMCDAVINCI=y. When such a device gets unbound e.g. using sysfs or hotplug, the driver is just removed without the cleanup being performed. This plugin only...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-56661)

tipc: NULL deref in cleanupbearer. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504583; scriptversion"1.3";...

PT-2025-49080

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The mlx5 irq alloc function in the Linux kernel could inadvertently free the entire rmap, leading to a crash when request irq fails due to exhausted IRQ vectors. This issue occurs when...

Dependency-Track Front-End Cross-Site Script Vulnerabilities

Dependency-Track Front-End is a Dependency-Track open source front-end UI for dependency tracking. A cross-site scripting vulnerability exists in Dependency-Track Front-End versions 4.12.0 through prior to 4.13.6, which stems from improper HTML cleanup and could lead to arbitrary JavaScript...

Linux kernel binderTransactionBufferRelease Heap Buffer Overflow DoS

The vulnerability of the binderTransactionBufferRelease function in the drivers/android/binder.c module of the Linux operating system’s kernel is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

dmaengine: idxd: Refactor remove call with idxd_cleanup() helper

...

Linux kernel Ethernet driver Heap Buffer Overflow DoS

The vulnerability of the ixgbevfinitmodule function in the drivers/net/ethernet/intel/ixgbevf/ixgbevfmain.c file of the Linux kernel’s Ethernet driver framework is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to cause a...

PT-2025-51711

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The CAN driver within the Linux kernel contains an issue in the gs usb xmit callback function related to the handling of failed transmitted URBs. The driver does not properly clean up...