CVE-2024-45612 Insert tag injection via canonical URL in Contao

Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page front end. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root...

CVE-2024-45612

Vulnerability summary: CVE-2024-45612 affects Contao CMS. An untrusted user can inject insert tags into canonical URLs, which are then evaluated and rendered on the front end. Affected product/version (as per sources): Contao 4.13 up to 4.13.48; Contao 5.0–5.4.x up to 5.3.14 and 5.4.2, with fixes...

CVE-2024-45612 Insert tag injection via canonical URL in Contao

Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page front end. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root...

CVE-2024-45612 Insert tag injection via canonical URL in Contao

Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page front end. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root...

GHSA-2XPQ-XP6C-5MGJ Contao affected by insert tag injection via canonical URL

Impact It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered. Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. Workarounds Disable canonical tags in the settings of the website root page. References...

PT-2024-37770 · WordPress · Wp Hardening – Fix Your Wordpress Security

Name of the Vulnerable Software and Affected Versions: The WP Hardening – Fix Your WordPress Security plugin versions up to, and including, 1.2.6 Description: The issue is due to the use of an incorrect regular expression within the "Stop User Enumeration" feature, making it possible for...

PT-2024-9895 · Glpi +1 · Fields Plugin +1

Name of the Vulnerable Software and Affected Versions: Fields plugin for GLPI versions prior to 1.21.13 Description: The issue is related to a lack of protection against SQL injection attacks in the Fields plugin for GLPI. This allows an authenticated user to perform a SQL injection when the plug...

PT-2024-37303

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain versions prior to 0.2.4 Description: A vulnerability in the FAISS.deserialize from bytes function allows for pickle deserialization of untrusted data, which can lead to the execution of arbitrary commands via the...

PT-2024-31969 · Frog Cms · Frog Cms

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A Cross-Site Request Forgery CSRF issue was discovered in FrogCMS. The vulnerability can be exploited via the "/admin/?/plugin/file manager/create directory" endpoint. This allows an attacker to perform...

PT-2024-7567

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to a use-after-free vulnerability in the cdns i3c master driver due to a race condition. This vulnerability can be exploited to impact the confidentiality, integrity, and...

PT-2024-31993 · Totolink · Totolink Ac1200 T8

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 T8 version 4.1.5cu.861 B20230220 Description: The issue is a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter. This vulnerability can be exploited, but details about the estimated number of...

PT-2024-28668 · Mattermost · Mattermost Desktop App

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop App versions =5.8.0 Description: The issue concerns a flaw in the screen capture functionality of the Mattermost Desktop App, allowing an attacker to silently capture high-quality screenshots via JavaScript APIs...

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Impact The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. Patches N/A Workarounds Review the user accounts tha...

PT-2024-31651 · Unknown · Manu225 Flipping Cards

Name of the Vulnerable Software and Affected Versions: Manu225 Flipping Cards versions n/a through 1.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: Fo...

SUSE CVE-2024-46698

In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfbdisable In apertureremoveconflictingpcidevices, we currently only call sysfbdisable on vga class devices. This leads to the following problem when the pimary device is not VGA...

SUSE CVE-2024-46699

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption around the writeseqcountbegin/end pair while updating GPU stats: WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221...

SUSE CVE-2024-46712

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if the host renders to them using accelerated apis. Without 3d the entire content of dumb buffers stays in the guest making all of the extra...

PT-2024-39281

Name of the Vulnerable Software and Affected Versions: aimhubio aim versions up to 3.24 Description: A problematic issue was found in the dangerouslySetInnerHTML function of the textbox.tsx file in the Text Explorer component. The manipulation of the query argument leads to cross-site scripting. ...

DEBIAN-CVE-2024-46699

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption around the writeseqcountbegin/end pair while updating GPU stats: WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221...

AZL-49278 CVE-2024-46698 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfbdisable In apertureremoveconflictingpcidevices, we currently only call sysfbdisable on vga class devices. This leads to the following problem when the pimary device is not VGA...