CVE-2022-49667

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c "bonding: fix 802.3ad aggregator reselection", resolve case, when there is several aggregation groups in the same bond. bond3adunbindslave will...

CVE-2022-49667 net: bonding: fix use-after-free after 802.3ad slave unbind

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c "bonding: fix 802.3ad aggregator reselection", resolve case, when there is several aggregation groups in the same bond. bond3adunbindslave will...

CVE-2022-49667

The CVE-2022-49667 issue is a Linux kernel net bonding use-after-free bug triggered by 802.3ad slave unbind. The flaw occurs when bond_3ad_unbind_slave clears an aggregator while there are still ports referencing freed memory, due to ad_clear_agg being invoked even when the port count in a group ...

CVE-2022-49204 bpf, sockmap: Fix more uncharged while msg has more_data

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2025-22495

creationtimestamp| type| source ---|---|--- 2025-02-24 17:33:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114060062653263406 2025-02-24 19:32:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lix3n5wnzw2s 2025-02-24 19:48:27+00:00| seen|...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

Moodle 安全漏洞

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle. The vulnerability stems from a cross-site scripting risk where...

WordPress SMTP for Amazon SES plugin <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability

Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability discovered by Cristian Bejan cbejan in WordPress Plugin SMTP for Amazon SES versions = 1.7.1...

WordPress YaySMTP plugin <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability

Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability discovered by Cristian Bejan cbejan in WordPress Plugin YaySMTP versions = 1.1.1...

WordPress YaySMTP plugin <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability

Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability discovered by Cristian Bejan cbejan in WordPress Plugin SMTP for SendGrid – YaySMTP versions = 1.3.1...

CVE-2024-49355

CVE-2024-49355 affects IBM OpenPages with Watson 8.3 and 9.0. The vulnerability stems from the System Tracing feature writing improperly neutralized data to server log files when tracing is enabled, exposing potential sensitive information in logs. IBM's bulletin confirms the issue (CWE-117) with...

CVE-2025-0916

The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.4.9 to 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2025-0916

The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.4.9 to 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

WordPress plugin YaySMTP and Email Logs 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Checkmk 安全漏洞

Checkmk is an IT monitoring platform from Checkmk, Inc. A security vulnerability exists in Checkmk versions prior to 2.3.0p27, prior to 2.2.0p40, and 2.1.0p51, which stems from LDAP credentials being written to an Apache error log file...

AWS VDP: Non-Production API Endpoints for the Device Farm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The Device Farm service was found to have two non-production API endpoints that could be accessed using standard IAM credentials without generating CloudTrail logs. This allowed silent permission enumeration, where an adversary could test the permissions of compromised credentials without...

CVE-2024-57056

WombatDialer prior to 25.02 mishandles cookie sessions, causing the full session identity to be logged in system logs and enabling a malicious actor to impersonate an existing user session. This CVE (CVE-2024-57056) is documented across multiple sources; the impact is described as exposure of ses...

The vulnerability of the Log View component of the FortiAnalyzer security event monitoring and analysis software allows a malicious actor to read the event logs from another domain.

The vulnerability of the Log View component of the FortiAnalyzer security event monitoring and analysis software is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to read the event logs from another domain...