SUSE-SU-2024:2961-1 Security update for osc

This update for osc fixes the following issues: - 1.9.0 - Security: - Fix possibility to overwrite special files in .osc CVE-2024-22034 bsc1225911 Source files are now stored in the 'sources' subdirectory which prevents name collisons. This requires changing version of '.osc' store to 2.0. -...

CVE-2024-25582

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social...

CVE-2024-25582

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social...

PT-2024-21018

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions up to 7.10.6-rev42 Description The issue allows attackers to inject references to malicious code delivered through the same domain, potentially leading to malicious API requests or extraction of user account...

CVE-2024-43399: Relative Path Traversal

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure...

CVE-2024-25582: Improper Neutralization of Input During Web Page Generation

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social...

CVE-2023-3416: Improper Neutralization of Special Elements used in an SQL Command

The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'createstripesubscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

PT-2024-6093

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad versions 0.6.1 through 1.6.13 HashiCorp Nomad versions 1.7.0 through 1.7.10 HashiCorp Nomad versions 1.8.0 through 1.8.2 Description The archive unpacking process in HashiCorp Nomad is vulnerable to writes outside the allocatio...

CVE-2024-21981

Improper key usage control in AMD Secure Processor ASP may allow an attacker with local access who has gained arbitrary code execution privilege in ASP to extract ASP cryptographic keys, potentially resulting in loss of confidentiality and integrity...

Exploit for Special Element Injection in Google Android

CVE-2024-0044 Overview CVE-2024-0044 is a vulnerabili...

CVE-2024-7548: Improper Neutralization of Special Elements used in an SQL Command

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2023-5000 Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode

The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

WordPress plugin Horizontal scrolling announcements 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

PT-2024-13845

Name of the Vulnerable Software and Affected Versions Horizontal scrolling announcements plugin for WordPress versions up to, and including, 2.4 Description The issue arises from insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in t...

SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34375)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a lack of encryption when storing usernames and passwords in the router's firmware/database. An attacker can exploit this...

CVE-2024-5614

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafepostslist' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of...

CVE-2024-41690

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to...

CVE-2024-41688

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the...

PT-2024-29512 · Syrotech · Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: This issue exists due to the storage of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with...

PT-2024-29511 · Syrotech · Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: This issue exists due to the storage of default username and password credentials in plaintext within the router's firmware/database. An attacker with physical...