c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_decompressMultiFrame

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5194340354818048 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...

GHSA-39J2-4P9J-5W4J Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...

CVE-2024-4949

Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-4949

A use after free vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 125.0.6422.60 . This flaw allows a remote attacker to trigger heap corruption by navigating to a crafted HTML page . The vulnerability is associated with memory usage after it has been freed, which...

Grafana API IDOR

Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5....

GHSA-63G3-9JQ3-MCCV Grafana API IDOR

Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5....

Grafana proxy Cross-site Scripting

Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5.15 -...

Intel Chipset Device Software Advisory - Lenovo Support US

No description provided...

Intel Ethernet Controller Administrative Tools Installer Software Advisory - Lenovo Support US

No description provided...

WordPress Simple Basic Contact Form Plugin <= 20240502 is vulnerable to Broken Access Control

Software Simple Basic Contact Form Type Plugin Vulnerable versions = 20240502 Fixed in 20240511 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4144 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e272f8f841f7 Credits...

WordPress WP Compress – Image Optimizer [All-In-One] Plugin <= 6.20.01 is vulnerable to Broken Access Control

Software WP Compress – Image Optimizer All-In-One Type Plugin Vulnerable versions = 6.20.01 Fixed in 6.20.02 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4445 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fbb504f543bf...

WordPress Landing Page Builder Plugin <= 1.5.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Landing Page Builder Type Plugin Vulnerable versions = 1.5.1.8 Fixed in 1.5.1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34752 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d84e812a046a Credits Dimas Maulana Required...

hdf5:h5_extended_fuzzer: Heap-buffer-overflow in H5FS__sect_link

Detailed Report: https://oss-fuzz.com/testcase?key=5325951624871936 Project: hdf5 Fuzzing Engine: afl Fuzz Target: h5extendedfuzzer Job Type: aflasanhdf5 Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x61d000003080 Crash State: H5FSsectlink H5FSsectadd H5MFaddsect...

imagemagick:encoder_tiff_fuzzer: Use-of-uninitialized-value in CompositeOverImage

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6522766407827456 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodertifffuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

ffmpeg:ffmpeg_AV_CODEC_ID_SMC_fuzzer: Heap-buffer-overflow in smc_encode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5878041048842240 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSMCfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address...

ngolo-fuzzing-x:fuzz_ngo_x_net_dict: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5041427120717824 Project: ngolo-fuzzing-x Fuzzing Engine: libFuzzer Fuzz Target: fuzzngoxnetdict Job Type: libfuzzerasanngolo-fuzzing-x Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: NULL Sanitizer:...

gogo-protobuf:FuzzProtoUnmarshal: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4856280039620608 Project: gogo-protobuf Fuzzing Engine: libFuzzer Fuzz Target: FuzzProtoUnmarshal Job Type: libfuzzerasangogo-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: NULL Sanitizer:...

WordPress Orders Tracking for WooCommerce Plugin <= 1.2.10 is vulnerable to Broken Access Control

Software Orders Tracking for WooCommerce Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4039 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID da05ab03734d Credits...

WordPress LearnPress Plugin <= 4.2.6.5 is vulnerable to Arbitrary File Upload

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.5 Fixed in 4.2.6.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-4397 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID e486f6c14d9b Credits JoanClarke2 Required privilege...