CVE-2024-6999

Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-6996

Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-6995

Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-6994

Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-6995

Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-6994

Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-6923

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

WordPress Blox Page Builder Plugin <= 1.0.65 is vulnerable to Arbitrary File Upload

Software Blox Page Builder Type Plugin Vulnerable versions = 1.0.65 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6315 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID ffdf8c3e90d1 Credits István Márton Required privilege...

WordPress WordPress File Upload Plugin < 4.24.8 is vulnerable to Cross Site Scripting (XSS)

Software WordPress File Upload Type Plugin Vulnerable versions 4.24.8 Fixed in 4.24.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6651 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f705fe24e0ac Credits Đức Tài...

edk2:TestFileName: Heap-buffer-overflow in MangleFileName

Project: https://github.com/tianocore/edk2.git Detailed Report: https://oss-fuzz.com/testcase?key=5524458830364672 Project: edk2 Fuzzing Engine: libFuzzer Fuzz Target: TestFileName Job Type: libfuzzerasanedk2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x5210000028fe...

ffmpeg:ffmpeg_dem_WTV_fuzzer: Use-of-uninitialized-value in ff_parse_mpeg2_descriptor

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6286909377150976 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemWTVfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

mpv:fuzzer_protocol_memory: Use-of-uninitialized-value in mcc_read_header

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=5939605805793280 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerprotocolmemory Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

ffmpeg:ffmpeg_DEMUXER_fuzzer: Use-of-uninitialized-value in jpegxl_parse

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5947940055613440 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegDEMUXERfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer: Use-of-uninitialized-value in get_ur_golomb_jpegls

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5533480570650624 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSHORTENfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

CVE-2024-6923

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CVE-2024-6923

The CPython email module is vulnerable to header injection because it fails to properly quote newlines within email headers during message serialization. This flaw allows an attacker to inject additional headers into a serialized email message. The issue has been addressed in Rocky Linux distribu...

CVE-2024-6923 Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

ffmpeg:ffmpeg_AV_CODEC_ID_MVHA_fuzzer: Use-of-uninitialized-value in add_left_pred_c

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4878509466517504 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDMVHAfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

ffmpeg:ffmpeg_dem_JPEGXL_ANIM_fuzzer: Use-of-uninitialized-value in ff_jpegxl_parse_codestream_header

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5089407768526848 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemJPEGXLANIMfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

WordPress VForm Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software VForm Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6770 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 84552ffa98ca Credits Artem Polynko Artem Polynko...