CVE-2024-36020

The CVE-2024-36020 issue in the Linux kernel relates to the i40e driver: a VF pointer could be used uninitialized due to interchangeability of variables (v vs vf) introduced by a regression. A fix was implemented to remove redundant v, and to iterate using a single VF pointer across the affected ...

CVE-2024-3924

The CVE-2024-3924 issue affects hugggingface/text-generation-inference across versions up to 2.0.0 and was fixed in 2.0.0. It stems from insecure handling of github.head_ref in the autodocs.yml workflow, where user input is used to dynamically build a command to install software. An attacker coul...

CVE-2024-36019

CVE-2024-36019 has concrete Linux kernel details in the connected document set: the issue is in the Linux kernel regmap maple driver, where cache corruption occurred due to indexing regcache_maple_entry[] by the register address instead of the required offset when preserving the upper end of a ca...

CVE-2024-36018

CVE-2024-36018: Linux kernel fix for nouveau/uvmm remap calculations. The issue involved incorrect addr/range calculations during remap operations, causing an unmap of 0x3fffed0000+0xF0000 that could corrupt page tables and trigger an oops. The patch corrects the computation by using explicit sta...

CVE-2024-5517

CVE-2024-5517 affects itsourcecode Online Blood Bank Management System 1.0. The vulnerability is an SQL injection in the changepwd.php functionality triggered by the useremail parameter, reported to be exploitable remotely. Multiple connected sources corroborate: the issue is tied to changepwd.ph...

CVE-2024-1100

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5...

CVE-2024-1100

The CVE-2024-1100 entry concerns a SQL injection vulnerability in Vadi Corporate Information Systems DIGIKENT GIS, affecting DIGIKENT GIS versions up to 2.23.5. The issue arises from improper neutralization of special elements in SQL commands (SQL Injection). Documented impact is severe, with hig...

CVE-2022-43841

CVE-2022-43841 affects IBM Aspera Console versions 3.4.0–3.4.2 PL9. The issue allows stored web pages to be read by another user on the same system (information disclosure), caused by local access to cached/stored content. IBM’s bulletin summarizes the vulnerability and lists the affected product...

CVE-2022-43575

IBM Aspera Console is affected by CVE-2022-43575: cross-site scripting in the Web UI for versions 3.4.0–3.4.2 PL5, potentially enabling an attacker to embed arbitrary JavaScript and cause credentials disclosure within a trusted session. The issue is documented across multiple sources, including I...

CVE-2022-43384

CVE-2022-43384 affects IBM Aspera Console versions 3.4.0–3.4.2 PL5 and is a cross-site scripting vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials in a trusted session. The vulnerability is documented across multiple sources (NVD/IBM/Re...

CVE-2024-3583

The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-5521

The CVE-2024-5521 entry describes stored Cross-Site Scripting in Alkacon OpenCMS 16 via SVG file uploads. The root cause is improper validation of .svg images, which, when uploaded by users with gallery editor or VFS resource manager roles, allows JavaScript in the SVG to execute when another use...

CVE-2024-4668

The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Price Table and Post Slider widgets in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4355

The CVE-2024-4355 entry concerns the WordPress plugin Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection. The root cause is a missing capability check in the stopbadbots_get_ajax_data() function affecting all versions up to 10.24, enabling authenticated users with subs...

CVE-2024-5327

The PowerPack Addons for Elementor Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘ppanimatedgradientbgcolor’ parameter in all versions up to, and including, 2.7.19 due to insufficient input sanitization and output...

CVE-2024-5073

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input sanitization and output...

CVE-2024-5341

CVE-2024-5341 affects The Plus Addons for Elementor Page Builder (WordPress). The vulnerability is a Stored XSS via the 'size' attribute of the Heading Title widget, allowing authenticated users with contributor-level access or higher to inject scripts that execute when pages are viewed. Affected...

CVE-2024-4356

The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3945

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodomanage function. This makes it possible for unauthenticated attackers to add new todo items via a forged...

CVE-2024-3947

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodosettings function. This makes it possible for unauthenticated attackers to modify the plugin's settings via ...