PT-2024-4071

Name of the Vulnerable Software and Affected Versions: ip package versions through 2.0.1 for Node.js Description: The issue is related to the improper categorization of certain IP addresses as globally routable via the isPublic function, which might allow Server-Side Request Forgery SSRF attacks...

PT-2024-17962 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.15.5 Description: The issue is related to Stored Cross-Site Scripting via the custom JS parameter due to insufficient input sanitization and...

libxmljs 安全漏洞

libxmljs is the LibXML binding for node.js. A security vulnerability exists in libxmljs2 that stems from the presence of a type confusion vulnerability...

CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

UBUNTU-CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

CVE-2024-33260

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

CVE-2024-33260

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

CVE-2024-33260

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

nodejs: code injection and privilege escalation through Linux capabilities

A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if an unprivileged user has set them while the process is running with elevated privileges, except for CAPNETBINDSERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this...

Keenetic KN-1010 信息泄露漏洞

Keenetic KN is a series of routers from Keenetic. An information disclosure vulnerability exists in Keenetic KN-1010, which stems from an information disclosure vulnerability in file/version.js. Affected products and versions: Keenetic KN-1010, KN-1410, KN-1711, KN-1810, and KN-1910 4.1.2.15 and...

Add Custom CSS and JS <= 1.20 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack Make an author or above role open the following HTML: alert"frontendjs"' /...

GHSA-8M45-2RJM-J347 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...

CVE-2022-47151

CVE-2022-47151 affects WordPress JS Help Desk – Best Help Desk & Support Plugin up to version 2.7.1. The vulnerability is an unauthenticated SQL Injection due to improper neutralization of SQL elements in the plugin, enabling potentially dangerous SQL execution without authentication. Impact is h...

web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in solana/web3.js that stems from allowing an attacker to cause an out-of-memory OOM using specific input...

PT-2024-23300 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions prior to 1.0.1 @solana/web3.js versions prior to 1.10.2 @solana/web3.js versions prior to 1.11.1 @solana/web3.js versions prior to 1.12.1 @solana/web3.js versions prior to 1.1.2 @solana/web3.js versions prior to 1.13....