CVE-2024-7090

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lhaddmediafromurl-fileurl’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2023-52903 io_uring: lock overflowing for IOPOLL

In the Linux kernel, the following vulnerability has been resolved: iouring: lock overflowing for IOPOLL syzbot reports an issue with overflow filling for IOPOLL: WARNING: CPU: 0 PID: 28 at iouring/iouring.c:734 iocqringeventoverflow+0x1c0/0x230 iouring/iouring.c:734 CPU: 0 PID: 28 Comm:...

CVE-2024-7090 LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lhaddmediafromurl-fileurl’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

WordPress LH Add Media From Url plugin <= 1.23 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Piotr Kuśpit in WordPress Plugin LH Add Media From Url versions = 1.23...

CVE-2024-7090: Improper Neutralization of Input During Web Page Generation

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lhaddmediafromurl-fileurl’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

WordPress plugin Download Plugins and Themes in ZIP from Dashboard 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

CVE-2024-7501: Cross-Site Request Forgery (CSRF)

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the downloadtheme function. This makes it possible for unauthenticated...

CVE-2024-34739

CVE-2024-34739 concerns a logic error in shouldRestrictOverlayActivities within UsbProfileGroupSettingsManager.java, potentially allowing local escalation of privilege in Android’s framework. The vulnerability description is consistent across multiple sources (NVD, Red Hat advisory, CNVD, OSV, et...

CVE-2024-34739

In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

kernel: ice: fix memory corruption bug with suspend and rebuild

This is a flaw in the Linux kernel's ICE driver for Intel Ethernet controllers. The problem arises when the system enters a suspended state, and the driver frees queue vectors without resetting the numqvectors variable. This oversight causes the icerebuild function to allocate an incorrectly size...

PT-2024-30214 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14 Description: The issue is related to a stack overflow that allows attackers to cause a Denial of Service DoS via a crafted POST request. This is achieved by exploiting the wanmode parameter in the fromAdvSetWan...

Tenda FH1206 安全漏洞

Tenda FH1206 is a dual-band wireless router from Tenda, designed for large homes with fiber optics. The Tenda FH1206 suffers from a buffer overflow vulnerability, which originates from a buffer overflow vulnerability in the PPPOEPassword parameter of the fromAdvSetWan function, which can be...

CVE-2024-38787: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.8...

Authorization Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of authorization logic with 'but not' and 'from' expressions and a userset, allowing an attacker to bypass authorization checks and gain unauthorized access to resources...

CVE-2024-42473: Incorrect Authorization

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As...

Malicious code in ethercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c202b40df14e5a6ba231853aefc190984e981a5f22ef90d3d2e3da641643e8dd During importing, the code attempts to decrypt data embeded in READMEs. The decrypted code is then used to download further remote scripts --- Category:...

MAL-2024-12264 Malicious code in ethercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c202b40df14e5a6ba231853aefc190984e981a5f22ef90d3d2e3da641643e8dd During importing, the code attempts to decrypt data embeded in READMEs. The decrypted code is then used to download further remote scripts --- Category:...

CVE-2024-42254 io_uring: fix error pbuf checking

In the Linux kernel, the following vulnerability has been resolved: iouring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs ISERR inconsistent error handling in ioallocpbufring. KASAN: null-ptr-deref in range 0x0000000000000000-0x0000000000000007 RIP:...

CVE-2024-7551

creationtimestamp| type| source ---|---|--- 2024-08-06 15:51:22+00:00| seen| https://t.me/cvedetector/2582...

PT-2024-37446 · Haloitsm · Haloitsm

Name of the Vulnerable Software and Affected Versions: HaloITSM versions up to 2.146.1 Description: The issue is related to a Template Injection vulnerability within the engine used to generate emails, which can lead to the leakage of potentially sensitive information. Recommendations: For versio...