PT-2024-9895 · Glpi +1 · Fields Plugin +1

Name of the Vulnerable Software and Affected Versions: Fields plugin for GLPI versions prior to 1.21.13 Description: The issue is related to a lack of protection against SQL injection attacks in the Fields plugin for GLPI. This allows an authenticated user to perform a SQL injection when the plug...

PT-2024-37770 · WordPress · Wp Hardening – Fix Your Wordpress Security

Name of the Vulnerable Software and Affected Versions: The WP Hardening – Fix Your WordPress Security plugin versions up to, and including, 1.2.6 Description: The issue is due to the use of an incorrect regular expression within the "Stop User Enumeration" feature, making it possible for...

PT-2024-37303

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain versions prior to 0.2.4 Description: A vulnerability in the FAISS.deserialize from bytes function allows for pickle deserialization of untrusted data, which can lead to the execution of arbitrary commands via the...

PT-2024-31969 · Frog Cms · Frog Cms

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A Cross-Site Request Forgery CSRF issue was discovered in FrogCMS. The vulnerability can be exploited via the "/admin/?/plugin/file manager/create directory" endpoint. This allows an attacker to perform...

PT-2024-7567

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to a use-after-free vulnerability in the cdns i3c master driver due to a race condition. This vulnerability can be exploited to impact the confidentiality, integrity, and...

PT-2024-31993 · Totolink · Totolink Ac1200 T8

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 T8 version 4.1.5cu.861 B20230220 Description: The issue is a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter. This vulnerability can be exploited, but details about the estimated number of...

PT-2024-28668 · Mattermost · Mattermost Desktop App

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop App versions =5.8.0 Description: The issue concerns a flaw in the screen capture functionality of the Mattermost Desktop App, allowing an attacker to silently capture high-quality screenshots via JavaScript APIs...

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Impact The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. Patches N/A Workarounds Review the user accounts tha...

PT-2024-31651 · Unknown · Manu225 Flipping Cards

Name of the Vulnerable Software and Affected Versions: Manu225 Flipping Cards versions n/a through 1.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: Fo...

SUSE CVE-2024-46698

In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfbdisable In apertureremoveconflictingpcidevices, we currently only call sysfbdisable on vga class devices. This leads to the following problem when the pimary device is not VGA...

SUSE CVE-2024-46699

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption around the writeseqcountbegin/end pair while updating GPU stats: WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221...

SUSE CVE-2024-46712

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if the host renders to them using accelerated apis. Without 3d the entire content of dumb buffers stays in the guest making all of the extra...

PT-2024-39281

Name of the Vulnerable Software and Affected Versions: aimhubio aim versions up to 3.24 Description: A problematic issue was found in the dangerouslySetInnerHTML function of the textbox.tsx file in the Text Explorer component. The manipulation of the query argument leads to cross-site scripting. ...

DEBIAN-CVE-2024-46699

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption around the writeseqcountbegin/end pair while updating GPU stats: WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221...

AZL-49278 CVE-2024-46698 affecting package kernel 6.6.126.1-1

In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfbdisable In apertureremoveconflictingpcidevices, we currently only call sysfbdisable on vga class devices. This leads to the following problem when the pimary device is not VGA...

UBUNTU-CVE-2024-46698

In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfbdisable In apertureremoveconflictingpcidevices, we currently only call sysfbdisable on vga class devices. This leads to the following problem when the pimary device is not VGA...

PT-2024-31889 · Tenda · Tenda O6

Name of the Vulnerable Software and Affected Versions: Tenda O6 V3.0 firmware version 1.0.0.72054 Description: The issue is a stack overflow vulnerability in the formexeCommand function. This vulnerability is present in the specified firmware version of the Tenda O6 V3.0 device. Recommendations:...

PT-2024-38337 · WordPress · Stream

Name of the Vulnerable Software and Affected Versions: The Stream plugin for WordPress versions up to, and including, 4.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the network options action function. This allows...

PT-2024-31886 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: The issue is a stack overflow vulnerability located in the RouteStatic function. This vulnerability enables remote code execution. Recommendations: For Tenda FH451 version 1.0.0.9, consider disabling t...

PT-2024-31885 · Tenda · Tenda Ch22

Name of the Vulnerable Software and Affected Versions: Tenda CH22 version 1.0.0.6468 Description: The issue is a stack overflow vulnerability located in the frmL7PlotForm function. Recommendations: For Tenda CH22 version 1.0.0.6468, as a temporary workaround, consider disabling the frmL7PlotForm...