PT-2024-32332 · WordPress · Wp Table Builder

Name of the Vulnerable Software and Affected Versions: The WP Table Builder – WordPress Table Plugin versions up to, and including, 1.4.14 Description: The issue is related to Stored Cross-Site Scripting via the button element due to insufficient input sanitization and output escaping. This allow...

NULL Pointer Dereference

VTK is vulnerable to a NULL Pointer Dereference. The vulnerability is due to improper return value validation, where the libxml2 API xmlDocGetRootElement function can return NULL, but the code in IO/Infovis/vtkXMLTreeReader.cxx dereferences it without a check, allowing an attacker to trigger a...

CVE-2024-27397

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system. Mitigation In order to trigger the issue, it requires the ability to create user/net...

CVE-2024-2637

The CVE-2024-2637 issue is an Uncontrolled Search Path Element vulnerability affecting multiple B&R Industrial Automation products: Scene Viewer, Automation Runtime, mapp Vision, mapp View, mapp Cockpit, mapp Safety, VC4, APROL, various CAN drivers, Tou0ch Lock, B&R Single-Touch Driver, Serial Us...

AZL-40679 CVE-2024-27397 affecting package hyperv-daemons for versions less than 5.15.158.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

CVE-2024-27397

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

AZL-40546 CVE-2024-27397 affecting package hyperv-daemons for versions less than 6.6.56.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

DEBIAN-CVE-2024-27397

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

UBUNTU-CVE-2024-27397

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

netfilter: nf_tables: use timestamp to check for set element timeout

...

RHEL 7 : gstreamer-plugins-good (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gstreamer-plugins-good: Heap buffer overflow in FLIC decoder CVE-2016-9636 - The gstaacparsesinksetcaps...

CVE-2024-27397

CVE-2024-27397 affects the Linux kernel nf_tables in netfilter. The root cause is a race where set elements could expire during unfinished control-plane transactions. The fix adds a timestamp field at the start of a transaction and stores it per-netns, updating the set backends’ insert, deactivat...

CVE-2024-27397 netfilter: nf_tables: use timestamp to check for set element timeout

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

CVE-2024-27397 netfilter: nf_tables: use timestamp to check for set element timeout

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to u...

Cross Site Scripting (XSS)

vditor is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a lack of default xss sanitization within the editor, which allows an attacker to execute XSS via an attribute of an A element...

The vulnerability of the DCH-compatible Thunderbolt driver, related to incorrect elimination of special elements in the output data, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the DCH-compatible Thunderbolt driver is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the DCH-compatible Thunderbolt driver lies in the absence of quotation marks around element or search path names, allowing attackers to exploit their privileges.

The vulnerability of the DCH-compatible Thunderbolt driver is related to the absence of quotation marks in the code for elements or search paths. Exploiting this vulnerability can allow an attacker to gain increased privileges...

SUSE CVE-2024-27011

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix memleak in map from abort path The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result ...

GHSA-M5JF-8CRM-R65M Vditor allows Cross-site Scripting via an attribute of an `A` element

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...

Vditor allows Cross-site Scripting via an attribute of an `A` element

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...