2721 matches found
CVE-2024-47370
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through = 2.1.21...
CVE-2024-47379 WordPress Web Directory Free plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through = 1.7.3...
kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check nssids before accessing the ssids In some versions of cfg80211, the ssids poinet might be a valid one even though nssids is 0. Accessing the pointer in this case will cuase an out-of-bound access. Fix th...
CVE-2024-43970
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SureCart allows Reflected XSS.This issue affects SureCart: from n/a through 2.29.3...
CVE-2024-45451
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cryout-creations Roseta roseta allows Stored XSS.This issue affects Roseta: from n/a through = 1.3.0...
CVE-2024-45457
CVE-2024-45457 affects Spiffy Calendar plugin for WordPress (versions through 4.9.13). The vulnerability is a Stored XSS due to improper input neutralization during web page generation. Public records from Patchstack and Red Hat confirm this, listing the affected range as up to 4.9.13 and noting ...
PT-2024-34016
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A race condition issue has been resolved in the Linux kernel, specifically in the scsi: lpfc component. The problem occurred when deleting an NPIV instance, as it required all fabric...
openSUSE Security Advisory (SUSE-SU-2024:3095-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE CVE-2024-45000
In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscachecookie: add missing "naccesses" check This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor read access ...
UBUNTU-CVE-2024-45000
In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscachecookie: add missing "naccesses" check This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor read access ...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ucode-intel (SUSE-SU-2024:3095-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3095-1 advisory. - Intel CPU Microcode was updated to the 20240813 release bsc1229129 - CVE-2024-24853: Security...
CVE-2024-8234
UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the functions formSysCmd, formUpgradeCert, and formDelcert in the Zyxel NWA1100-N firmware version 1.00AACE.1C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device...
CVE-2024-8234
UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the functions formSysCmd, formUpgradeCert, and formDelcert in the Zyxel NWA1100-N firmware version 1.00AACE.1C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device...
CVE-2024-8234
UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the functions formSysCmd, formUpgradeCert, and formDelcert in the Zyxel NWA1100-N firmware version 1.00AACE.1C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device...
CVE-2024-8234
The CVE-2024-8234 entry describes a command injection vulnerability in Zyxel NWA1100-N firmware 1.00(AACE.1)C0 affecting the functions formSysCmd(), formUpgradeCert(), and formDelcert(). The underlying issue allows an unauthenticated attacker to run OS commands and access system files, with CVSS ...
CVE-2024-8234
UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the functions formSysCmd, formUpgradeCert, and formDelcert in the Zyxel NWA1100-N firmware version 1.00AACE.1C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device...
CVE-2024-43961 WordPress azurecurve Toggle Show/Hide plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stored XSS.This issue affects azurecurve Toggle Show/Hide: from n/a through 2.1.3...
Russian Hackers Exploit Safari and Chrome Flaws in High-Profile Cyberattack
Cybersecurity researchers have flagged multiple in-the-wild exploit campaigns that leveraged now-patched flaws in Apple Safari and Google Chrome browsers to infect mobile users with information-stealing malware. "These campaigns delivered n-day exploits for which patches were available, but would...