CVE-2024-5843

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. Chromium security severity: Medium...

CVE-2024-5839

Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5840

Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-5840

Summary of CVE-2024-5840: Google Chrome/Chromium prior to 126.0.6478.54 is affected by a CORS policy bypass vulnerability that can let remote attackers bypass discretionary access control via a crafted HTML page. The vulnerability target is the browser’s CORS handling (Chromium component). Report...

CVE-2024-5843

Google Chrome versions prior to 126.0.6478.54 are vulnerable to a vulnerability in the Downloads component. Due to an inappropriate implementation, a remote attacker can use a malicious file to obfuscate security UI . The security severity for Chromium is classified as Medium , though some metric...

CVE-2024-5813 SSH Private Key Leak in BeyondInsight PasswordSafe

A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response...

miniz:zip_fuzzer: Heap-buffer-overflow in mz_zip_mem_read_func

Project: https://github.com/richgel999/miniz.git Detailed Report: https://oss-fuzz.com/testcase?key=5362290995036160 Project: miniz Fuzzing Engine: libFuzzer Fuzz Target: zipfuzzer Job Type: libfuzzerasanminiz Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x507000000144...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::SomeIpLayer::parseSomeIpLayer

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6639796737867776 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

WordPress Photo Gallery by 10Web Plugin <= 1.8.23 is vulnerable to Path Traversal

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.23 Fixed in 1.8.24 OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2024-5481 Patch priority Medium CVSS severity Medium 6.8 Developer Claim ownership PSID f9ab0048fc76 Credits Tobias Weißhaar kun19 Required...

WordPress Minimal Coming Soon & Maintenance Mode – Coming Soon Page Plugin <= 2.38 is vulnerable to Broken Access Control

Software Minimal Coming Soon & Maintenance Mode – Coming Soon Page Type Plugin Vulnerable versions = 2.38 Fixed in 2.39 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5087 Patch priority Medium CVSS severity Medium 6.3 Developer WebFactory Ltd. PSID...

WordPress CF7 Google Sheets Connector Plugin <= 5.0.9 is vulnerable to Broken Access Control

Software CF7 Google Sheets Connector Type Plugin Vulnerable versions = 5.0.9 Fixed in 5.0.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5654 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 90b82cd51794 Credits 1337Wannabe...

WordPress Formula Theme <= 0.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Formula Type Theme Vulnerable versions = 0.5.1 Fixed in 0.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5638 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3a71d72e8ae6 Credits blackmoon Required privileg...

wireshark:fuzzshark_ip_proto-udp: Stack-buffer-overflow in dissect_wlan_radio_phdr

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=6713100001673216 Project: wireshark Fuzzing Engine: honggfuzz Fuzz Target: fuzzsharkipproto-udp Job Type: honggfuzzasanwireshark Platform Id: linux...

WordPress WP Docs Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Docs Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35696 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0c51b0b8b213 Credits LVT-tholv2k Required privilege...

WordPress Widget Options Plugin <= 4.0.1 is vulnerable to Sensitive Data Exposure

Software Widget Options Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-35690 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d20ab85a5efb Credits Dave Jong Patchstack...

WordPress GiveWP Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS)

Software GiveWP Type Plugin Vulnerable versions = 3.12.0 Fixed in 3.12.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35679 Patch priority Medium CVSS severity Medium 7.1 Developer Liquid Web / StellarWP PSID f4b075a69f03 Credits Dimas Maulana Required privilege...

WordPress Copymatic – AI Content Writer & Generator Plugin <= 1.9 is vulnerable to Broken Access Control

Software Copymatic – AI Content Writer & Generator Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35716 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID acafd07bdb00 Credits...

WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5317 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a76e0f4cc75c Credits Arkadiusz Hydzik Requir...

WordPress Event Tickets with Ticket Scanner Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Event Tickets with Ticket Scanner Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35652 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a8b7482ae90c Credits Le Ngoc Anh...

ecdsa-python:fuzz_private_key: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4752394549264384 Project: ecdsa-python Fuzzing Engine: libFuzzer Fuzz Target: fuzzprivatekey Job Type: libfuzzerasanecdsa-python Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x515041923cf1 Crash State: NULL Sanitizer: address ASAN...