libultrahdr:ultrahdr_enc_fuzzer: Use-of-uninitialized-value in ultrahdr::uhdr_gainmap_metadata_frac::encodeGainmapMetadata

Project: https://github.com/google/libultrahdr.git Detailed Report: https://oss-fuzz.com/testcase?key=4823210674159616 Project: libultrahdr Fuzzing Engine: libFuzzer Fuzz Target: ultrahdrencfuzzer Job Type: libfuzzermsanlibultrahdr Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

WordPress WP Mail Catcher Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)

Software WP Mail Catcher Type Plugin Vulnerable versions = 2.1.9 Fixed in 2.1.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47339 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c286bdf972a5 Credits Le Ngoc Anh Required privilege...

WordPress Chartify Plugin <= 2.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Chartify Type Plugin Vulnerable versions = 2.7.6 Fixed in 2.7.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47347 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 53b94498a517 Credits Le Ngoc Anh Required privilege...

SUSE CVE-2024-7018

Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Chromium security severity: Medium...

SUSE CVE-2024-7019

Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

WordPress SmartSearch WP Plugin < 2.4.6 is vulnerable to Sensitive Data Exposure

Software SmartSearch WP Type Plugin Vulnerable versions 2.4.6 Fixed in 2.4.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6845 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID e581162ffbea Credits Kieran Burge Required...

WordPress CP Polls Plugin <= 1.0.74 is vulnerable to Cross Site Scripting (XSS)

Software CP Polls Type Plugin Vulnerable versions = 1.0.74 Fixed in 1.0.75 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47297 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bd0fc6118ee8 Credits Muhamad Agil Fachrian Required...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.13.10 is vulnerable to Cross Site Scripting (XSS)

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.13.10 Fixed in 2.13.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47301 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8aad81d86091 Credits Manab Jyoti...

WordPress Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Plugin <= 3.8.0 is vulnerable to Broken Access Control

Software Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Type Plugin Vulnerable versions = 3.8.0 Fixed in 3.8.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6590 Patch priority Medium CVSS severi...

WordPress XT Ajax Add To Cart for WooCommerce Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software XT Ajax Add To Cart for WooCommerce Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8716 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID eca37d7857f2 Credit...

WordPress Pixel Cat Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Pixel Cat Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8544 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4e86320ad402 Credits vgo0 Required privilege...

WordPress CubeWP Forms – All-in-One Form Builder Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software CubeWP Forms – All-in-One Form Builder Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47300 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 126f1788c7ef Credits hunter85...

WordPress Koko Analytics Plugin <= 1.3.12 is vulnerable to Cross Site Scripting (XSS)

Software Koko Analytics Type Plugin Vulnerable versions = 1.3.12 Fixed in 1.3.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8662 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4c60e9c99099 Credits vgo0 Required...

WordPress Google Calendar Events Plugin <= 3.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Google Calendar Events Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9f01a635ec08 Credits vgo0 Requir...

CVE-2024-7023

Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file. Chromium security severity: Medium...

CVE-2023-7281

Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-7019

Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-7022

Google Chrome versions prior to 123.0.6312.58 are vulnerable to an uninitialized use in the V8 engine . A remote attacker can exploit this via a crafted HTML page to perform out-of-bounds memory access or execute arbitrary code . Affected packages include chromium on various distributions. Exploi...

CVE-2024-7019

CVE-2024-7019 describes an insecure UI implementation in Google Chrome (Chromium-based) before 124.0.6367.60, where a remote attacker could induce UI spoofing via a crafted HTML page if the user performs specific UI gestures. The evidence across connected sources consistently references the same ...

libavc:mvc_dec_fuzzer: Heap-buffer-overflow in ih264d_read_coeff4x4_cabac

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=6236538583711744 Project: libavc Fuzzing Engine: libFuzzer Fuzz Target: mvcdecfuzzer Job Type: libfuzzerasanlibavc Platform Id: linux...