CVE-2024-8907

Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML XSS via a crafted set of UI gestures. Chromium security severity: Medium...

CVE-2024-8905

Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-8906

Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

libraw:libraw_cr2_fuzzer: Index-out-of-bounds in LibRaw::ppg_interpolate

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=6407144088338432 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

clamav:clamav_dbload_PDB_fuzzer: Heap-buffer-overflow in add_hash

Project: https://github.com/Cisco-Talos/clamav.git Detailed Report: https://oss-fuzz.com/testcase?key=5021048003690496 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavdbloadPDBfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

keycloak:SamlMetadataParserFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

Detailed Report: https://oss-fuzz.com/testcase?key=5444241445158912 Project: keycloak Fuzzing Engine: libFuzzer Fuzz Target: SamlMetadataParserFuzzer Job Type: libfuzzerasankeycloak Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

WordPress Simple Spoiler Plugin <= 1.3 is vulnerable to Broken Access Control

Software Simple Spoiler Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A3: Injection Classification Broken Access Control CVE CVE-2024-8479 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 5815e2232ebe Credits Francesco Carlucci Required privilege...

WordPress WCFM Marketplace Plugin <= 3.6.11 is vulnerable to Cross Site Scripting (XSS)

Software WCFM Marketplace Type Plugin Vulnerable versions = 3.6.11 Fixed in 3.6.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44009 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e15165a2d9e9 Credits Le Ngoc Anh Required privileg...

libjpeg-turbo:decompress_yuv_fuzzer_dev: Use-of-uninitialized-value in decompress_yuv.cc

Detailed Report: https://oss-fuzz.com/testcase?key=6185125941936128 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: decompressyuvfuzzerdev Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: decompressyuv.cc...

WordPress WPFactory Helper Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software WPFactory Helper Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8656 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4015f045635d Credits vgo0 Required...

WordPress WP Test Email Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Test Email Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8664 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea820c9f43d1 Credits vgo0 Required...

WordPress Cron Jobs Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Cron Jobs Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8731 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d8773fd0a372 Credits vgo0 Required privilege...

Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution

GitLab on Wednesday released security updates to address 17 security vulnerabilities, including a critical flaw that allows an attacker to run pipeline jobs as an arbitrary user. The issue, tracked as CVE-2024-6678, carries a CVSS score of 9.9 out of a maximum of 10.0 "An issue was discovered in...

graphicsmagick:coder_AVIF_fuzzer: Use-of-uninitialized-value in HeifContext::has_alpha

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=4820668783329280 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderAVIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

wireshark:fuzzshark_ip_proto-udp: Index-out-of-bounds in DOFObjectID_Create_Unmarshal

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=6277172019396608 Project: wireshark Fuzzing Engine: libFuzzer Fuzz Target: fuzzsharkipproto-udp Job Type: libfuzzerubsanwireshark Platform Id: linux...

NetApp SnapCenter Information Disclosure Vulnerability - Lenovo Support US

No description provided...

WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.7.1 is vulnerable to Sensitive Data Exposure

Software PixelYourSite – Your smart PIXEL TAG Manager Type Plugin Vulnerable versions = 9.7.1 Fixed in 9.7.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-7870 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a10bfb823664...

CVE-2024-6232

A regular expression denial of service ReDos vulnerability was found in Python's tarfile module. Due to excessive backtracking while tarfile parses headers, an attacker may be able to trigger a denial of service via a specially crafted tar archive. Mitigation Mitigation for this issue is either n...

AZL-48552 CVE-2024-6232 affecting package python3 for versions less than 3.12.3-4

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...

CVE-2024-6232 Regular-expression DoS when parsing TarFile headers

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives...