6273 matches found
open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper
A flaw was found in open-vm-tools. This flaw allows a malicious actor with non-root privileges to hijack the /dev/uinput file descriptor, allowing them to simulate user inputs...
WordPress Forminator Plugin <= 1.27.0 is vulnerable to Arbitrary File Upload
Software Forminator Type Plugin Vulnerable versions = 1.27.0 Fixed in 1.28.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6133 Patch priority Low CVSS severity Low 6.6 Developer WPMU DEV PSID e543496c8db2 Credits István Márton Required privilege Administrator...
CVE-2023-48013
Removed by vendor...
RHEL 8 : open-vm-tools (RHSA-2023:7261)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7261 advisory. The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualizati...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : HTML Tidy vulnerability (USN-6483-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6483-1 advisory. Neeraj Pal discovered that HTML Tidy incorrectly handled parsing certain HTML data. If a user or automated system were tricked into...
RHEL 8 : open-vm-tools (RHSA-2023:7262)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7262 advisory. The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualizati...
CVE-2023-47384
MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gfisomaddchapter at /isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted MP4 file...
PT-2024-14752
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.52-syzkaller Description The vulnerability is related to the ipvlan module in the Linux kernel. It was discovered through syzbot reports using a stack of multiple ipvlan devices. The issue arises from the nee...
CVE-2023-46621
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...
CVE-2023-46621
CVE-2023-46621 is an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress plugin User Avatar (ctltwp User Avatar) affecting versions up to and including 1.4.11 . The issue has a published CVE and is mitigated by upgrading to 1.4.12 or later. PatchStack corroborates the vulner...
CVE-2023-46621: Improper Neutralization of Input During Web Page Generation
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...
CVE-2023-5998
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV...
CVE-2023-5998
CVE-2023-5998 affects the gpac/gpac project (multimedia framework) with an Out-of-bounds Read vulnerability reported for builds prior to 2.3.0-DEV. The connected documents confirm the affected product/version and the issue type, but do not provide a remediation, patch version, or exploit details....
kernel: gpiolib: fix memory leak in gpiochip_setup_dev()
A flaw was found in the Linux kernel's General Purpose Input/Output GPIO library gpiolib. This vulnerability, located in the gpiochipsetupdev function, results from resources not being properly released during error handling after a device is added. This oversight can lead to a gradual waste of...
flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console
A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. It contains a vulnerability similar to CVE-2017-5226 but using the TIOCLINUX ioctl command instead of TIOCSTI. If a Flatpak app is run on a Linux virtual console such as /dev/tty...
Malware in stripe-terminal-react-native-dev-app
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
WordPress Defender Security Plugin <= 4.2.0 is vulnerable to Bypass Vulnerability
Software Defender Security Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-47189 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID 9d721f7eb609 Credits Naveen Muthusamy Required...
Debian DSA-5545-1 : vlc - security update
The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5545 advisory. An out-of-bounds write was discovered in the MMS demuxer of the VLC media player. For the oldstable distribution bullseye, this problem has been fixed in version...