7067 matches found
WordPress WP Flow Plus plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin WP Flow Plus versions = 5.2.2...
WordPress WP Flow Plus Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS)
Software WP Flow Plus Type Plugin Vulnerable versions = 5.2.2 Fixed in 5.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35651 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bcb093c2f536 Credits LVT-tholv2k Required privilege Contributo...
RHEL 9 : ovn2.13 (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ovn: service monitor MAC flow is not rate limited CVE-2023-3153 Note that Nessus has not tested for this issue but...
RHEL 8 : ovn2.13 (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ovn: service monitor MAC flow is not rate limited CVE-2023-3153 Note that Nessus has not tested for this issue but...
RHEL 7 : jasperreports-server-pro (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: Unsafe deserialization due to incomplete black list incomplete fix for CVE-2017-15095...
Fixed in ClickHouse v24.5, 2024-06-01
It is possible to redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of...
CVE-2024-36953
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgicv2parseattr vgicv2parseattr is responsible for finding the vCPU that matches the user-provided CPUID, which of course may not be valid. If the ID is invalid, kvmgetvcpubyid...
UBUNTU-CVE-2024-36903
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in ip6makeskb As it was done in commit fc1092f51567 "ipv4: Fix uninit-value access in ipmakeskb" for IPv4, check FLOWIFLAGKNOWNNH on fl6-flowi6flags instead of testing HDRINCL on the socket...
PT-2024-9018
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a refcount leak in the smc ib find route function, which may cause the disclosure of confidential information. The leak occurs because the neighbour found by...
CVE-2021-47563
In the Linux kernel, the following vulnerability has been resolved: ice: avoid bpfprog refcount underflow Ice driver has the routines for managing XDP resources that are shared between ndobpf op and VSI rebuild flow. The latter takes place for example when user changes queue count on an interface...
CVE-2021-47563 ice: avoid bpf_prog refcount underflow
In the Linux kernel, the following vulnerability has been resolved: ice: avoid bpfprog refcount underflow Ice driver has the routines for managing XDP resources that are shared between ndobpf op and VSI rebuild flow. The latter takes place for example when user changes queue count on an interface...
net/mlx5e: Prevent deadlock while disabling aRFS
...
CVE-2021-47246
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix page reclaim for dead peer hairpin When adding a hairpin flow, a firmware-side send queue is created for the peer net device, which claims some host memory pages for its internal ring buffer. If the peer net device...
SUSE CVE-2021-47246
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix page reclaim for dead peer hairpin When adding a hairpin flow, a firmware-side send queue is created for the peer net device, which claims some host memory pages for its internal ring buffer. If the peer net device...
SUSE CVE-2021-47265
In the Linux kernel, the following vulnerability has been resolved: RDMA: Verify port when creating flow rule Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5ib driver could cause to the below oops. Call trace:...
SUSE CVE-2021-47312
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix dereference of null pointer flow In the case where chain-flags & NFTCHAINHWOFFLOAD is false then nftflowrulecreate is not called and flow is NULL. The subsequent error handling execution via label...
PT-2024-4070 · Unknown · Spring Cloud Data Flow
Name of the Vulnerable Software and Affected Versions: Spring Cloud Data Flow affected versions not specified Description: The issue is related to improper sanitization for upload paths in the Skipper server, allowing a malicious user with access to the server API to write arbitrary files to any...
XML External Entity (XXE) Injection
neos/flow is vulnerable to XML External Entity XXE. The vulnerability is due to the MediaTypeConverter improperly handling XML input, which could be exploited to conduct XXE attacks...
