CVE-2024-7022

CVE-2024-7022 describes an uninitialized use in V8 of Google Chrome before 123.0.6312.58, permitting a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Affected component: V8 JavaScript engine within Chrome/Chromium. Root cause: uninitialized use leading to memory a...

CVE-2024-7019

CVE-2024-7019 describes an insecure UI implementation in Google Chrome (Chromium-based) before 124.0.6367.60, where a remote attacker could induce UI spoofing via a crafted HTML page if the user performs specific UI gestures. The evidence across connected sources consistently references the same ...

CVE-2024-8907

Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML XSS via a crafted set of UI gestures. Chromium security severity: Medium...

CVE-2024-8906

Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-8905

Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. Chromium security severity: Medium...

BIT-PYTHON-2024-6232 Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

WordPress Simple Spoiler Plugin <= 1.3 is vulnerable to Broken Access Control

Software Simple Spoiler Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A3: Injection Classification Broken Access Control CVE CVE-2024-8479 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 5815e2232ebe Credits Francesco Carlucci Required privilege...

WordPress WCFM Marketplace Plugin <= 3.6.11 is vulnerable to Cross Site Scripting (XSS)

Software WCFM Marketplace Type Plugin Vulnerable versions = 3.6.11 Fixed in 3.6.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44009 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e15165a2d9e9 Credits Le Ngoc Anh Required privileg...

WordPress WP Test Email Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Test Email Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8664 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea820c9f43d1 Credits vgo0 Required...

WordPress WPFactory Helper Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software WPFactory Helper Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8656 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4015f045635d Credits vgo0 Required...

WordPress Cron Jobs Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Cron Jobs Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8731 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d8773fd0a372 Credits vgo0 Required privilege...

Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution

GitLab on Wednesday released security updates to address 17 security vulnerabilities, including a critical flaw that allows an attacker to run pipeline jobs as an arbitrary user. The issue, tracked as CVE-2024-6678, carries a CVSS score of 9.9 out of a maximum of 10.0 "An issue was discovered in...

NetApp SnapCenter Information Disclosure Vulnerability - Lenovo Support US

No description provided...

WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.7.1 is vulnerable to Sensitive Data Exposure

Software PixelYourSite – Your smart PIXEL TAG Manager Type Plugin Vulnerable versions = 9.7.1 Fixed in 9.7.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-7870 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a10bfb823664...

CVE-2024-6232

A regular expression denial of service ReDos vulnerability was found in Python's tarfile module. Due to excessive backtracking while tarfile parses headers, an attacker may be able to trigger a denial of service via a specially crafted tar archive. Mitigation Mitigation for this issue is either n...

AZL-48552 CVE-2024-6232 affecting package python3 for versions less than 3.12.3-4

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

CVE-2024-6232 Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

CVE-2024-6232 Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

WordPress Attire Theme <= 2.0.6 is vulnerable to PHP Object Injection

Software Attire Type Theme Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7435 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 834924dbc4f2 Credits Francesco Carlucci Required privilege Contribut...

WordPress Blogpoet Theme <= 1.0.3 is vulnerable to Broken Access Control

Software Blogpoet Type Theme Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43998 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 863978478910 Credits Fariq Fadillah Gusti Insani...