WordPress plugin Email Subscribers by Icegram Express 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the WordPress plugin...

PT-2024-39239 · Icegram Express · Email Subscribers

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin versions up to, and including, 5.7.34 Description: The issue allows unauthorized access to data due to a missing capability che...

Express.js Express-Session Weak Secret Key

Express.js applications with Express-Session use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations. When a weak or easily...

MAL-2024-8951 Malicious code in express-request-ip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d640e010ac10316c3c6f0419c77b933e2695ff224fd189773e30020995ab3895 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-request-ip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d640e010ac10316c3c6f0419c77b933e2695ff224fd189773e30020995ab3895 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-49560 CVE-2024-46761 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnvphp: Fix hotplug driver crash on Powernv The hotplug driver for powerpc pci/hotplug/pnvphp.c causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because...

UBUNTU-CVE-2024-46765

In the Linux kernel, the following vulnerability has been resolved: ice: protect XDP configuration with a mutex The main threat to data consistency in icexdp is a possible asynchronous PF reset. It can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same...

Exploit for CVE-2024-2876

CVE-2024-2876 Description Of Vulnerability: The Email Subscr...

CVE-2024-44574

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sysconf function...

CVE-2024-44570

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the getParams function in phpinf.php...

CVE-2024-44572

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sysmgmt function...

nvme: fix reconnection fail due to reserved tag allocation

...

kernel: nvme: avoid double free special payload

A flaw was found in the Linux kernel's NVMe component. This vulnerability is due to a double free error that occurs when a discard request needs to be retried and fails before a new special payload is added. A local attacker could exploit this memory corruption issue to cause a denial of service...

Relyum RELY-PCIe 安全漏洞

The Relyum RELY-PCIe is an intelligent pluggable board from the Spanish company Relyum. A security vulnerability exists in Relyum RELY-PCIe versions v22.2.1 through v23.1.0, which stems from the sysconf function containing a command injection vulnerability...

Relyum RELY-PCIe 安全漏洞

The Relyum RELY-PCIe is an intelligent pluggable board from the Spanish company Relyum. A security vulnerability exists in Relyum RELY-PCIe versions v22.2.1 through v23.1.0, which stems from a command injection vulnerability contained in the timedate function...

GHSA-CM22-4G7W-348P serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +12391 more potentially affected by CVE-2024-43796 via express (>=4.0.0, <=4.19.2)

express NPM version =4.0.0, =1.0.0, =1.0.1, =1.0.3, =0.2.0, =1.0.2, =1.0.0, =2.0.0, =0.2.0, =0.2.0, =0.0.28, =0.0.36 and more Source cves: CVE-2024-43796 Source advisory: OSV:GHSA-QW6H-VGH9-J6WX...

GHSA-QW6H-VGH9-J6WX express vulnerable to XSS via response.redirect()

Impact In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issu...

express vulnerable to XSS via response.redirect()

Impact In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issu...