PT-2024-13093 · Qualcomm · Snapdragon +62

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption that occurs when an Access Point AP includes a TID Traffic ID to link mapping Information Element IE in its beacons...

PT-2024-13087 · Qualcomm · 315 5G Iot Modem Firmware +239

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption while processing the event ring. The context read pointer is untrusted and can be passed with arbitrary values,...

CVE-2024-0586: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Login/Register Element in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escapi...

WordPress Element Pack Elementor Addons Plugin <= 5.4.11 is vulnerable to Broken Access Control

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.4.11 Fixed in 5.4.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24840 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 61b5b426744b Credits Khalid Yusuf...

Denial Of Service (DoS)

Craft CMS is vulnerable to Denial Of Service DoS. The vulnerability is due to improper input validation within the Feed-Me Name and Feed-Me URL fields while saving a feed using an Asset element type with no volume selected. This issue can be exploited by an attacker to perform a DoS...

GHSA-6P78-F7H9-6838 Craft CMS Feed-Me

An issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service DoS via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected...

Craft CMS Feed-Me

An issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service DoS via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected...

CVE-2023-36260

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service DoS via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about cod...

Code injection

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service DoS via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about cod...

CVE-2023-36260

CVE-2023-36260 affects the Feed Me plugin (version 4.6.1) on Craft CMS (version 4.6.1). The issue allows remote attackers to cause a Denial of Service by supplying crafted strings to the Feed-Me Name and Feed-Me URL fields when saving a feed via an Asset element with no volume selected. The root ...

CVE-2023-36260: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service DoS via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about cod...

HotKey Services Driver DoS

The vulnerability of the HotKey Services driver in Intel NUC P14E Laptop Element microprogramming software is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to cause service failures...

Intel Integrated Sensor Hub Driver Privilege Escalation

The vulnerability of the Intel Integrated Sensor Hub driver for NUC P14E Laptop Element notebooks is related to the default access settings. Exploiting this vulnerability can allow attackers to gain increased privileges...

libxml2: crafted xml can cause global buffer overflow

A flaw was found in Libxml2, where it contains a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a denial of service DoS by supplying a crafted XML file...

Server Side Request Forgery (SSRF)

whooglesearch is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to not sanitizing user-supplied data from the location variable in the window endpoint which passes the same user supplied input to send method within request.py. This can be exploited to send crafted GET...

CVE-2021-43584: Improper Neutralization of Input During Web Page Generation

DOM-based Cross Site Scripting XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent NCPA before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log...

PYSEC-2024-19

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in requests.py. The returned...

PYSEC-2024-20

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a...

CVE-2024-22203: Server-Side Request Forgery (SSRF)

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a...

whoogle-search Cross-Site Scripting Vulnerability

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting meta-search engine A cross-site scripting vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the element method in app/routes.py that does not validate user-controlled srctype and...