9629 matches found
WordPress Disable Admin Notices individually plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Disable Admin Notices individually versions = 1.4.0...
PT-2024-39617
Name of the Vulnerable Software and Affected Versions SCP-Firmware versions 2.11.0 through 2.15.0 Description The issue arises from the transport message handler function not properly handling errors, which could allow an Application Processor AP to cause a buffer overflow in System Control...
PT-2024-35166 · Unopim · Unopim
Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.1.5 Description: A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...
CVE-2024-46892
A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing...
freerdp: OutOfBound Read in zgfx_decompress_segment
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate /gfx on by default, set /bpp or /rfx options...
kernel: cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window
In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window The Linux kernel CVE team has assigned CVE-2024-26761 to this issue. Upstream advisory:...
kernel: USB: core: Fix access violation during port device removal
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disablestore: usbhubtostructhub can return NULL if the hub that the port belongs to is concurrently removed, but...
kernel: x86/apic: Don't disable x2APIC if locked
In the Linux kernel, the following vulnerability has been resolved: x86/apic: Don't disable x2APIC if locked The APIC supports two modes, legacy APIC or xAPIC, and Extended APIC or x2APIC. X2APIC mode is mostly compatible with legacy APIC, but it disables the memory-mapped APIC interface in favor...
kernel: drm/amd/display: Fix disable_otg_wa logic
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix disableotgwa logic Why When switching to another HDMI mode, we are unnecesarilly disabling/enabling FIFO causing both HPO and DIG registers to be set at the same time when only HPO is supposed to be set. This...
kernel: clk: Get runtime PM before walking tree during disable_unused
In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disableunused Doug reported 1 the following hung task: INFO: task swapper/0:1 blocked for more than 122 seconds. Not tainted 5.15.149-21875-gf795ebc40eb8 1 "echo 0...
kernel: USB: core: Fix deadlock in port "disable" sysfs attribute
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port disable sysfs attribute The Linux kernel CVE team has assigned CVE-2024-26933 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26933-c18d@gregkh/T...
net: stmmac: Fix zero-division error when disabling tc cbs
...
PT-2024-9041 · Microsoft · Office Word
Name of the Vulnerable Software and Affected Versions: Microsoft Word affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Word, which can be exploited by a remote attacker to bypass security features, potentially allowing them to disable...
PT-2024-8713 · Siemens · Scalance Mum856-1 +13
Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.2 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.2 SCALANCE M804PB versions prior to V8.2 SCALANCE M812-1 ADSL-Router versions prior to V8.2 SCALANCE M816-1 ADSL-Router versions prior to V8.2...
PT-2024-22542 · D Link · Dlink Dwr 5G Cpe +1
Name of the Vulnerable Software and Affected Versions: DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 version DWR-2000M 1.34ME Dlink DWR 5G CPE version DWR-2000M 1.34ME Description: An issue in the affected devices allows a local attacker to execute arbitrary code via a crafted payload to the...
PT-2024-8973 · Citrix · Citrix Netscaler Application Delivery Controller +1
Name of the Vulnerable Software and Affected Versions: Citrix NetScaler Application Delivery Controller ADC and Citrix NetScaler Gateway affected versions not specified Description: The issue is related to a memory safety vulnerability that can lead to memory corruption and Denial of Service in...
PT-2024-16348 · WordPress · Kognetiks Chatbot
Name of the Vulnerable Software and Affected Versions: Kognetiks Chatbot for WordPress plugin for WordPress versions up to, and including, 2.1.7 Description: The issue is related to unauthorized modification of data due to a missing capability check on the update assistant function. This allows...
PT-2024-16783 · Dedecms · Dedecms
Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.116 Description: A vulnerability has been found in DedeCMS, affecting the file /dede/uploads/dede/friendlink add.php. The manipulation of the logoimg argument leads to unrestricted upload. It is possible to initiate the...
PT-2024-34489 · Unknown · Phpgurukul User Management System
Name of the Vulnerable Software and Affected Versions: PHPGurukul User Management System version 1.0 Description: A Cross Site Scripting XSS issue was found in the "/ums-sp/admin/registered-users.php" endpoint, allowing remote attackers to execute arbitrary code via the fname POST request...
PT-2024-20850 · Sublime Text · Sublime Text
Name of the Vulnerable Software and Affected Versions: Sublime Text version 4 Description: A command injection issue was found in Sublime Text via the New Build System module. It is noted that multiple third parties report this behavior as intended. Recommendations: For Sublime Text version 4, as...