16855 matches found
CVE-2024-34820 WordPress If-So Dynamic Content Personalization plugin <= 1.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1...
CVE-2024-34820
CVE-2024-34820 : Missing Authorization vulnerability in the WordPress plugin If-So Dynamic Content Personalization (version range: n/a through 1.7.1). Multiple sources (e.g., Red Hat advisories, NVD/NVD detail) corroborate the same issue. The description specifies a broken/absent authorization co...
Google’s Chrome changes make life harder for ad blockers
Despite protests, Google is rolling out changes in the Chrome browser that make it harder for ad blockers to do their job. Starting last Monday, June 3, 2024, Chrome Beta, Dev, and Canary channels will see the effects of the implementation of the new extension platform Manifest V3. The gradual...
Microsoft Windows DHCP Server Digital Error Vulnerability
Microsoft Windows is a set of operating systems used by Microsoft Corporation USA for personal devices. A numeric error vulnerability exists in Microsoft Windows DHCP Server. An attacker could exploit this vulnerability to cause a denial of service on the system. The following products and editio...
PT-2024-4144 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in dynamic memory in the Winlogon program, which is part of the Windows operating system. This can be exploited by an attacker using specially...
RHEL 7 : bind, bind-dyndb-ldap, and dhcp (RHSA-2024:3741)
"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3741 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...
SUSE CVE-2024-37280
A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of "passthrough" type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of...
Elasticsearch 8.14.0 Security Update (ESA-2024-14)
Elasticsearch StackOverflow vulnerability ESA-2024-14 A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow...
The vulnerability of TP-Link Omada er605’s microprogramming software arises from incorrect processing of DDNS error codes, allowing a intruder to execute any arbitrary code in the root context.
The vulnerability of TP-Link Omada er605 microprogramming software is caused by incorrect processing of DDNS error codes. Exploiting this vulnerability allows a remote attacker to execute any code within the root context...
ROS-20240607-03
A vulnerability in the lrzip.c:initializecontrol component of the Irzip software tool is caused by a buffer overflow in dynamic memory. buffer overflow in dynamic memory. Exploitation of the vulnerability could allow an attacker acting remotely, affect confidentiality, integrity and availability ...
CVE-2024-37156
The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3...
CVE-2024-37156 TokenController formName not sanitized in hidden input
The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3...
CVE-2024-37156 TokenController formName not sanitized in hidden input
The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3...
CVE-2024-37156
CVE-2024-37156 affects SuluFormBundle (Sulu Admin) where the TokenController.get parameter formName is not sanitized in the returned input field, enabling Cross-Site Scripting (XSS). The issue is fixed in version 2.5.3. Mitigation is to upgrade to 2.5.3 or apply the provided patch; no exploit det...
Dynamsoft Service Security Vulnerability
Dynamsoft Service is a core part of a Dynamic Web TWAIN from Dynamsoft Canada when running in service mode. A security vulnerability exists in Dynamsoft Service that stems from incorrect access control...
Cross-site Scripting (XSS)
activeadmin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input in dynamic legends, which allows for the injection of arbitrary JavaScript code when creating entities with names that include a script payload...
SUSE CVE-2024-36925
In the Linux kernel, the following vulnerability has been resolved: swiotlb: initialise restricted pool listhead when SWIOTLBDYNAMIC=y Using restricted DMA pools CONFIGDMARESTRICTEDPOOL=y in conjunction with dynamic SWIOTLB CONFIGSWIOTLBDYNAMIC=y leads to the following crash when initialising the...
CVE-2024-36914
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip on writeback when it's not applicable WHY dynamic memory safety error detector KASAN catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as writeback connector does not support certain...
CVE-2024-37031
The Active Admin aka activeadmin framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities to be later edited in forms with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version...
CVE-2024-37031
The Active Admin aka activeadmin framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities to be later edited in forms with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version...