DEBIAN-CVE-2024-26741

In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after checkestalblished. syzkaller reported a warning 0 in inetcskdestroysock with no repro. WARNONinetsksk-inetnum && !inetcsksk-icskbindhash; However, the syzkaller's log...

UBUNTU-CVE-2024-26741

In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after checkestalblished. syzkaller reported a warning 0 in inetcskdestroysock with no repro. WARNONinetsksk-inetnum && !inetcsksk-icskbindhash; However, the syzkaller's log...

Cross-Origin Resource Sharing (CORS) Bypass

@kindspells/astro-shield is vulnerable to Cross-Origin Resource Sharing CORS Bypass. This vulnerability due to the introduction of valid integrity attributes to injected code and SRI hash added to the generated Content Security Policy CSP header, fooling the browser into believing that the inject...

In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists

Impact Versions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believ...

CVE-2024-30426

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...

CVE-2024-30426

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...

CVE-2024-30426 WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...

CVE-2024-30426 WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...

WordPress Plugin Hash Elements 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2024-23353 · Unknown · Hash Elements

Name of the Vulnerable Software and Affected Versions: Hash Elements versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

GHSA-R75M-26CQ-MJXC Serverpod improved security for stored password hashes

Description Improved security for stored password hashes Serverpod now uses the OWASP, source, recommended Argon2Id password hash algorithm to store password hashes for the email authentication module. Starting from Serverpod 1.2.6 all users that either creates an account or authenticates with th...

CVE-2024-27775

SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery SSRF may allow exposing the local OS user's NTLMv2 hash...

CVE-2024-27775 SysAid - CWE-918: Server-Side Request Forgery (SSRF)

SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery SSRF may allow exposing the local OS user's NTLMv2 hash...

CVE-2024-27775

CVE-2024-27775 affects SysAid prior to version 23.2.14 b18. The vulnerability is a Server-Side Request Forgery (SSRF) issue that may expose the local operating system user’s NTLMv2 hash. The PT-security and other sources specify that versions before 23.2.14 b18 are impacted; remediation is to upg...

CVE-2024-27775 SysAid - CWE-918: Server-Side Request Forgery (SSRF)

SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery SSRF may allow exposing the local OS user's NTLMv2 hash...

WordPress Hash Elements Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Hash Elements Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30426 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e463e127c50 Credits Khalid Yusuf Required privilege...

PT-2024-22030 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: SysAid versions prior to 23.2.14 b18 Description: The issue allows for Server-Side Request Forgery SSRF, which may expose the local OS user's NTLMv2 hash. Recommendations: For versions prior to 23.2.14 b18, update to version 23.2.14 b18 or...

Sysaid Technologies SysAid 代码问题漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. A code issue vulnerability exists in Sysaid Technologies SysAid versions prior to 23.2.14 b18, which stems from the presence of server-side request forgery SSRF, which could allow exposing t...

CVE-2024-29886

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6...

CVE-2024-29886 Improved security for stored password hashes

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6...