PT-2024-21617

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.7.0-rc4 net next mlx5 5483eb2 Description The issue is related to a potential deadlock in the Linux kernel when disabling aRFS Accelerated Receive Flow Steering under certain conditions. Specifically, when the...

PT-2024-22879 · Gnu · Gnu Savane

Name of the Vulnerable Software and Affected Versions: GNU Savane versions 3.13 and earlier Description: An issue allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the "upload.php" component. Recommendations: For GNU Savane versions 3.13 and earlier,...

DEBIAN-CVE-2021-47201

In the Linux kernel, the following vulnerability has been resolved: iavf: free qvectors before queues in iavfdisablevf iavffreequeues clears adapter-numactivequeues, which iavffreeqvectors relies on, so swap the order of these two function calls in iavfdisablevf. This resolves a panic encountered...

UBUNTU-CVE-2021-47201

In the Linux kernel, the following vulnerability has been resolved: iavf: free qvectors before queues in iavfdisablevf iavffreequeues clears adapter-numactivequeues, which iavffreeqvectors relies on, so swap the order of these two function calls in iavfdisablevf. This resolves a panic encountered...

AnythingLLM 输入验证错误漏洞

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has an input validation error vulnerability that stems from an incorrect input validation vulnerability that allows an attacker to escalate privileges by disabling Multi-User Mode...

PT-2024-5072 · Nozomi · Nozomi Central Management Console +1

Name of the Vulnerable Software and Affected Versions: Nozomi Guardian and Nozomi Central Management Console CMC affected versions not specified OpenAPI affected versions not specified Description: The issue is related to insufficient protection of audit records for OpenAPI requests, which may...

PT-2024-26916 · Sourcecodester · Sourcecodester Warehouse Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Warehouse Management System version 1.0 Description: A vulnerability has been found in the SourceCodester Warehouse Management System, affecting the file customer.php. The manipulation of the arguments nama customer, alamat...

GHSA-J55W-HJPJ-825G Contao: Insufficient BBCode sanitizer

Impact If BBCode is enabled for comments, users can inject CSS styles. Patches Update to Contao 4.13.40 or 5.3.4. Workarounds Disable BBCode for comments. References https://contao.org/en/security-advisories/insufficient-bbcode-sanitization For more information If you have any questions or commen...

Contao: Insufficient BBCode sanitizer

Impact If BBCode is enabled for comments, users can inject CSS styles. Patches Update to Contao 4.13.40 or 5.3.4. Workarounds Disable BBCode for comments. References https://contao.org/en/security-advisories/insufficient-bbcode-sanitization For more information If you have any questions or commen...

GHSA-V24P-7P4J-QVVF Contao: Cross site scripting in the file manager

Impact Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend. Patches Update to Contao 4.13.40 or Contao 5.3.4. Workarounds Disable uploads for untrusted users. References...

Contao: Cross site scripting in the file manager

Impact Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend. Patches Update to Contao 4.13.40 or Contao 5.3.4. Workarounds Disable uploads for untrusted users. References...

CVE-2024-30262

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me...

GHSA-R4R6-J2J3-7PP5 Contao: Remember-me tokens will not be cleared after a password change

Impact When a front end member changes their password, the corresponding remember-me tokens are not removed. Patches Update to Contao 4.13.40. Workarounds Disable "Allow auto login" in the login module. References...

CVE-2024-28190

Contao core/file management is vulnerable to Cross‑Site Scripting via filenames during file upload. In Contao 4.x and 5.x, versions prior to 4.13.40 and 5.3.4 allow attackers to inject malicious code in uploaded filenames, which is then executed in backend tooltips and popups. Affected versions i...

CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...

PT-2024-23579 · Unknown · Ros2 Galactic Geochelone

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: An insecure logging issue allows attackers to obtain sensitive information due to inadequate security measures in the logging mechanisms. Recommendations: For ROS2 Galactic Geochelone version 2...

PT-2024-15087 · WordPress · Wp Reset – Most Advanced Wordpress Reset Tool

Name of the Vulnerable Software and Affected Versions: The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress versions up to, and including, 2.0 Description: The issue allows unauthenticated attackers to extract sensitive data, including site backups, by brute-forcing snapshot...

PT-2024-4869 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda F1202 version 1.2.0.20408 Description: A critical issue has been found in the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to a stack-based buffer overflow. The...

PT-2024-2857 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue exists due to inadequate protection of the web page structure. An attacker could exploit this to inject malicious scripts into vulnerable form fields, potentially...

PT-2024-2860 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript m...