SUSE CVE-2023-52633

In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode without =inf-cpu or =ext, we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timerread, which pushes time forward just a...

CVE-2024-3030

CVE-2024-3030 (Announce from the Dashboard for WordPress): Stored XSS via admin settings in all versions

WP-CRM System < 3.2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The WordPress CRM Plugin – WP-CRM System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-26686 fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

In the Linux kernel, the following vulnerability has been resolved: fs/proc: dotaskstat: use sig-statslock to gather the threads/children stats locktasksighand can trigger a hard lockup. If NRCPUS threads call dotaskstat at the same time and the process has NRTHREADS, it will spin with irqs...

Unspecified Vulnerability in JetBrains TeamCity

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in JetBrains...

Prenotazioni <= 1.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Prenotazioni plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2024-21505 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel version 6.6.17+ Description: The issue is related to the Linux kernel's handling of interrupts on non-boot CPUs during hotplug operations. To silence warnings and avoid potential errors due to unexpected interrupts, the kernel no...

DEBIAN-CVE-2023-52633

In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode without =inf-cpu or =ext, we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timerread, which pushes time forward just a...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094-info - CVE-2024-3094 PoC Exploration https://gi...

CVE-2024-23449

A flaw was found in the Elasticsearch package. An uncaught exception occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with...

CVE-2024-2968

CVE-2024-2968 affects the WP-Eggdrop WordPress plugin. The vulnerability is a Stored Cross-Site Scripting flaw in admin settings across all versions up to 0.1, due to insufficient input sanitization and output escaping. It requires authenticated access (administrator-level) and affects multisite ...

MGASA-2024-0099 Updated curl packages fix security vulnerabilities

CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak A memory leak coul...

Updated curl packages fix security vulnerabilities

CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak A memory leak coul...

SUSE CVE-2024-2004

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been...

CVE-2024-31134

In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled...

CVE-2024-31134

In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled...

CVE-2024-31134

CVE-2024-31134 affects JetBrains TeamCity prior to 2024.03. The vulnerability arises from authorization weaknesses that allow authenticated users without administrative permissions to register other users when self-registration is disabled. Evidence from multiple sources (Red Hat, CVE listings, P...

Astra < 4.6.5 - Editor+ Stored XSS via Theme Header/Footer

Description The theme is vulnerable to Stored Cross-Site Scripting via the theme header and footer content due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in JetBrains...

[slackware-security] curl

New curl packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/curl-8.7.1-i586-1slack15.0.txz: Upgraded. This release fixes the following security issues: TLS certificate check bypass with mbedTLS...