libxml2:api: Heap-use-after-free in dropNode

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5078336398229504 Project: libxml2 Fuzzing Engine: afl Fuzz Target: api Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60c0000007e8 Crash Stat...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin <= 5.1 is vulnerable to Broken Access Control

Software MP3 Audio Player for Music, Radio & Podcast by Sonaar Type Plugin Vulnerable versions = 5.1 Fixed in 5.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30487 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 3890d24d42c5...

WordPress ProfileGrid Plugin <= 5.7.8 is vulnerable to SQL Injection

Software ProfileGrid Type Plugin Vulnerable versions = 5.7.8 Fixed in 5.7.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30490 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a6e8b49df611 Credits LVT-tholv2k Required privilege Unauthenticated...

CVE-2024-2886

Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

CVE-2024-2887

Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2024-2886

Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

CVE-2024-2886

Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

CVE-2024-2887

Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

lua:luaL_loadbuffer_proto_test: Heap-use-after-free in luaV_finishget

Detailed Report: https://oss-fuzz.com/testcase?key=5350818532360192 Project: lua Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferprototest Job Type: libfuzzerasanlua Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x61b000004338 Crash State: luaVfinishget luaVexecute...

nodejs:18 security update

nodejs 1:18.19.1-1 - Rebase to version 18.19.1 - Fixes: CVE-2024-21892 CVE-2024-22019 high - Fixes: CVE-2023-46809 medium nodejs-nodemon nodejs-packaging...

WordPress Radio Player Plugin <= 2.0.73 is vulnerable to Broken Access Control

Software Radio Player Type Plugin Vulnerable versions = 2.0.73 Fixed in 2.0.74 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2906 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 925ae43e1043 Credits Elliot Required privilege...

GHSA-9XVF-CJVF-FF5Q WP Crontrol vulnerable to possible RCE when combined with a pre-condition

Impact WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron system that store and execute PHP code subject to the restrictive security permissions documented here. While there is no known vulnerability in this feature on its own, there exists potential f...

libxml2:api: Heap-use-after-free in xmlDOMWrapNSNormAcquireNormalizedNs

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5491171101048832 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: api Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60400000016...

KLA65278 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Out of bounds read vulnerability in...

KLA65276 OSI vulnerability in Microsoft Developer Tools

An information disclosure vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2024-29059 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-.NET-Framework...

WordPress Network Summary Plugin <= 2.0.11 is vulnerable to SQL Injection

Software Network Summary Type Plugin Vulnerable versions = 2.0.11 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2804 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3fb16073a3aa Credits Dan Collins Required privilege Unauthenticated...

CVE-2024-2625

Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium security severity: High...

Attacks, Vulnerabilities and Actors 11 to 17 March 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, HiveForce Labs discovered eight executed attacks, uncovered ten vulnerabilities, and identified two active...

CVE-2024-21677

CVE-2024-21677 affects Atlassian Confluence Data Center and Server, introduced in version 6.13.0 as a High-severity path traversal vulnerability. The CVSS data indicate unauthenticated network access with low attack complexity, no privileges required, but user interaction is needed, and impacts t...

Cisco IOS XR Flaws Enable Privilege Elevation and DoS Attacks

Summary: Three high-severity vulnerabilities have been discovered in the Cisco IOS XR software, posing risks of denial-of-service DoS attacks and elevation of privilege. These vulnerabilities are tracked as CVE-2024-20320, CVE-2024-20318, and CVE-2024-20327. Threat Level - Amber | Vulnerability...