PT-2024-40877 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, with a crash type indicating a Heap-buffer-overflow READ 1. The crash state involves the...

HHS OIG Report Underscores Challenges of Securing the Cloud

On July 22, 2024, HHS Health and Human Services OIG published a report identifying a need for the Department of Health and Human Services, Office of the Secretary HHS OS to improve key security controls to better protect cloud information systems. The report, while focused on HHS OS, underscores...

WordPress TrueBooker plugin <= 1.0.2 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin TrueBooker versions = 1.0.2...

PT-2024-26141 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a possible out of bounds read due to a heap buffer overflow in the sdpu compare uuid with attr function of sdp utils.cc. This...

CVE-2024-28799

creationtimestamp| type| source ---|---|--- 2024-08-14 19:03:55+00:00| seen| https://t.me/cvedetector/3173...

CVE-2024-3913

creationtimestamp| type| source ---|---|--- 2024-08-13 16:16:58+00:00| seen| https://t.me/cvedetector/3016 2025-01-29 07:18:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3363...

CVE-2024-6640

In ICMPv6 Neighbor Discovery ND, the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation NS can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to...

WordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerability

Subscriber+ Arbitrary Settings Change vulnerability discovered by Dave Jong Patchstack in WordPress Plugin WHMpress versions = 6.2-revision-5...

PT-2024-6829 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud affected versions not specified Description: The issue is related to insufficient protection of service data in SAP Commerce Cloud, allowing a remote attacker to potentially disclose protected information. In SAP Commerce,...

CVE-2024-6640 pf incorrectly matches different ICMPv6 states in the state table

In ICMPv6 Neighbor Discovery ND, the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation NS can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to...

CVE-2024-6640

CVE-2024-6640 concerns FreeBSD pf: In ICMPv6 Neighbor Discovery, the ND state ID is always 0. When pf is configured to allow ND but block incoming Echo Requests, a crafted Echo Request after a Neighbor Solicitation from the same host with identifier 0 can trigger an Echo Reply, causing ICMPv6 pac...

CVE-2024-6640 pf incorrectly matches different ICMPv6 states in the state table

In ICMPv6 Neighbor Discovery ND, the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation NS can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to...

WordPress Easy PayPal & Stripe Buy Now Button plugin <= 1.9 - Open Redirection vulnerability

Open Redirection vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Easy PayPal Buy Now Button versions = 1.9...

WordPress Timeline and History slider plugin <= 2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Timeline and History slider versions = 2.3...

WordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dmitriy Prokhorov Patchstack Alliance in WordPress Plugin Kodex Posts likes versions = 2.5.0...

WordPress MultiVendorX Marketplace plugin <= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin MultiVendorX versions = 4.1.17...

WordPress Unite Gallery Lite plugin <= 1.7.62 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Unite Gallery Lite versions = 1.7.62...

WordPress Orchid Store theme <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Plugin Activation vulnerability discovered by Lucio Sá in WordPress Theme Orchid Store versions = 1.5.6...

Keys to the Kingdom - Gaining access to the Physical Facility through Internal Access

This is a story of network segmentation and the impact that seemingly trivial misconfigurations can have for your organization. This is one of those occasions. This particular pen test asked for goals-based assessment focusing on post-compromise activities — an attempt by the client to discover h...

WordPress 3D FlipBook plugin <= 1.15.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.15.6...