PT-2021-21404

Name of the Vulnerable Software and Affected Versions Hide My WP WordPress plugin versions = 6.2.3 Description The issue arises from how the IP address is retrieved and used in a SQL query. The hmwp get user ip function attempts to retrieve the IP address from multiple headers, including IP addre...

WordPress 插件 SQL注入漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin suffers from a SQL injection vulnerability that stems from the hmwp get user ip function attempting to retrieve an ip address from multiple headers, including ip address headers that the user can spoof, such...

PT-2024-11457

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference issue has been resolved in the Linux kernel. The issue occurs when the page's mapping can be nullified while gup is running, for example, by reclaim or...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

CVE-2021-24364

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting XSS vulnerability...

PT-2021-15900

Name of the Vulnerable Software and Affected Versions Jannah WordPress theme versions prior to 5.4.4 Description The issue arises from the improper sanitization of the options JSON parameter in the tie get user weather AJAX action, leading to a Reflected Cross-Site Scripting XSS issue. This occur...

PT-2021-20642

Name of the Vulnerable Software and Affected Versions: E-document System version 3.0 Description: A remote attacker can exploit the issue to obtain the contact information, including names and e-mail addresses, of all users within an organization. This can be achieved through the...

DEBIAN-CVE-2021-0342

In tungetuser of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. User interaction is not required for exploitation. Product: Android; Versions: Android kernel; Android ID: A-146554327...

The vulnerability of the get_user_pages() function allows a hacker to trigger a service failure.

The vulnerability of the getuserpages function is related to errors during multi-threaded operations race conditions. Exploiting this vulnerability could allow a hacker to cause service failures...

DEBIAN-CVE-2020-29374

An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/hugememory.c. The getuserpages aka gup implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka...

UBUNTU-CVE-2020-29374

An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/hugememory.c. The getuserpages aka gup implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka...

Linux kernel 竞争条件问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in versions of Linux kernel prior to 5.7.3, which stems from the presence of an issue related to mm/gup.c and mm/hugememory.c. The getuserpages...

CVE-2020-27620

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups...

PT-2020-14377 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get user id and key" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access...

PT-2020-1258 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.7.3 Description: The issue is related to the get user pages aka gup implementation in mm/gup.c and mm/huge memory.c, which does not properly consider the semantics of read operations when used for a...

PT-2020-5519

Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to a component of the Android operating system, specifically a problem with memory usage after it has been freed. This could potentially allow an attacker to escalate their privileges. The...

DEBIAN-CVE-2019-11749

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification. This allows for the potential fingerprinting of users. This...

Mozilla: Camera information available without prompting using getUserMedia

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification. This allows for the potential fingerprinting of users. This...

UBUNTU-CVE-2019-11749

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification. This allows for the potential fingerprinting of users. This...

Linux Kernel CVE-2019-9213 NULL Dereferences

By following the codepath that Andrea Arcangeli pointed out in his mails regarding the last bug I reported, I noticed that it is possible for userspace on a normal distro to map virtual address 0, which on an X86 system without SMAP enables the exploitation of kernel NULL pointer dereferences. Th...