DEBIAN-CVE-2021-47005

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix NULL pointer dereference for -getfeatures getfeatures ops of pciepcops may return NULL, causing NULL pointer dereference in pciepftestallocspace function. Let us add a check for pciepcfeature pointer in...

CVE-2024-0975

The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Make Website Members Only" feature when unset and view...

WordPress Plugin Thank You Page Customizer for WooCommerce Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Cross site scripting

User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS rende...

Inappropriate Implementation

chromium is vulnerable to Inappropriate Implementation. The vulnerability is due to inappropriate implementation in the Navigation feature of Google Chrome, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page...

PT-2024-1853

Name of the Vulnerable Software and Affected Versions FontForge versions through 20230101 Description The issue allows command injection via crafted archives or compressed files. This is due to the lack of measures to neutralize special elements, which can enable an attacker to execute arbitrary...

PT-2024-1850

Name of the Vulnerable Software and Affected Versions FontForge versions through 20230101 Description The issue exists due to the lack of neutralization of special elements in the software. This can allow an attacker to execute arbitrary commands via crafted filenames. The estimated number of...

Open redirect

Rejected reason: This is unused...

CVE-2023-37540

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

Design/Logic Flaw

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2023-37540 HCL Sametime Chat is affected by an unimplemented feature in the UI

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2023-37540 HCL Sametime Chat is affected by an unimplemented feature in the UI

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2024-26152 Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a Choices or Labels tag, resulting in an XSS vulnerability. Details Need permission to use the "data import" function. This was reproduced on Label...

GHSA-66C2-P8RH-QX87 baserCMS Cross-site Scripting vulnerability in Site search Feature

There is a XSS Vulnerability in Site search Feature to baserCMS. Target baserCMS 5.0.8 and earlier versions Vulnerability Malicious code may be executed in Site search Feature. Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more...

SUSE-SU-2024:0590-1 Security update for bind

This update for bind fixes the following issues: Update to release 9.16.48: Feature Changes: The IP addresses for B.ROOT-SERVERS.NET have been updated to 170.247.170.2 and 2801:1b8:10::b. Security Fixes: Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load,...

Security feature bypass

A maliciously crafted STP or SLDPRT file when ODXSWDLL.dll parsed through Autodesk AutoCAD can be used to uninitialized variable. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process...

Adobe Commerce Cross-Site Request Forgery Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A cross-site request forgery vulnerability exists in Adobe Commerce, which stems from the impact of the presence of a cross-site request forgery CSRF...

PT-2024-13191 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 5.0.9 Description: The issue is related to a cross-site scripting vulnerability in the site search feature of baserCMS, a website development framework. This vulnerability allows malicious code to be executed in the...

PT-2024-20770 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 15.5.99.76 Tuleap Enterprise Edition versions prior to 15.5-4 Tuleap Enterprise Edition versions prior to 15.4-7 Description: Tuleap is an open source suite to improve management of software...

Signal Introduces Usernames, Allowing Users to Keep Their Phone Numbers Private

End-to-end encrypted E2EE messaging app Signal said it's piloting a new feature that allows users to create unique usernames not to be confused with profile names and keep the phone numbers away from prying eyes. "If you use Signal, your phone number will no longer be visible to everyone you chat...