CVE-2024-27409

CVE-2024-27409 concerns the Linux kernel’s dmaengine: dw-edma HDMA. The linked list element and pointer may not be stored with the HDMA controller register; if the doorbell is toggled before the full write of the linked list, a race condition can occur. In remote setup, only a memory read (readl)...

CVE-2024-27407

CVE-2024-27407 : In the Linux kernel, a vulnerability in the NTFS3 file system was fixed by adding an overflow check in mi_enum_attr() within fs/ntfs3. The issue was identified as a local, high-severity impact and is addressed by applying the patch described in the Ubuntu USN-7726-1 advisory, whi...

CVE-2024-27405

A vulnerability in the Linux kernel 's usb gadget NCM component can cause all datagrams in the rx_list to be dropped. This occurs when tethering over NCM with Windows 11 as the host; the gadget_giveback function may append a single extra byte to a properly parsed NTB . When the unwrap call identi...

CVE-2024-27403

CVE-2024-27403 affects the Linux kernel and is described in connected Astra Linux advisory as: netfilter nft_flow_offload: reset dst in the route object after setting up a flow. The dst is moved to the flow object; the route object no longer owns it. If flow_offload_add() fails, the error path ma...

CVE-2024-27402

A vulnerability exists in the Linux kernel within the phonet/pep component due to a racy use of skb_queue_empty() . Because receive queues are protected by their respective spin-locks rather than the socket lock, skb_peek() may unexpectedly return NULL or a pointer to a socket buffer that has alr...

CVE-2024-35174

CVE-2024-35174 is a Missing Authorization vulnerability in the Flo Forms plugin for WordPress, affecting Flo Forms versions up to 1.0.42. The root cause, per sources, is broken access control that permits unauthorized access to Flo Forms data; exploitation details are not provided in the document...

CVE-2024-34755

CVE-2024-34755 is a CSRF vulnerability reported in the Integration for Salesforce and Contact Form 7 plugin family. The CVE description indicates the flaw affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms variants up to version 1.3.9, with the ...

CVE-2024-34756

CVE-2024-34756 is a Cross-Site Request Forgery (CSRF) vulnerability in the CRM Perks Integration for Contact Form 7 HubSpot, affecting Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms up to version 1.3.1. Root cause: CSRF flaw in the HubSpot integration; impact and prec...

CVE-2024-34806

CVE-2024-34806 describes a Cross-Site Request Forgery in the WordPress Clearfy Cache plugin up to version 2.2.1 (per CVE entry). The vulnerability arises from missing or incorrect nonce validation, enabling unauthenticated attackers to trigger actions via forged requests if a site admin is tricke...

CVE-2024-34807

CVE-2024-34807 represents a CSRF vulnerability in the WordPress plugin Fast Custom Social Share by CodeBard. The CVE description notes the issue affects the plugin up to version 1.1.2 (no details on affected environments beyond this plugin scope). Connected Red Hat advisories reiterate the same C...

CVE-2024-34809

CVE-2024-34809 is a CSRF vulnerability in EmpowerWP (Extend Themes EmpowerWP) affecting EmpowerWP versions up to 1.0.21. The related Red Hat and Wordfence entries confirm Cross-Site Request Forgery enabling notice dismissal. Patch status in the vulnerability record indicates EmpowerWP

CVE-2024-32959

The Sirv CDN and Image Hosting WordPress plugin (versions

CVE-2024-32827

CVE-2024-32827 describes an Authentication Bypass by Spoofing in the WordPress plugin Giveaways and Contests by RafflePress (affected: Giveaways and Contests

CVE-2024-32809

CVE-2024-32809: WordPress ActiveDEMAND plugin (ActiveDEMAND) ≤ 0.2.41 suffers Unrestricted Upload of File with Dangerous Type, allowing unauthenticated file uploads and potential full compromise. CVSSv3.1 base score 10.0 (NETWORK, HIGH impact). Patch status indicates this was patched; upgrade to ...

CVE-2024-32720

CVE-2024-32720 corresponds to a CAPTCHA bypass vulnerability in the WordPress plugin Appointment Hour Booking (versions

CVE-2024-32692

CVE-2024-32692 affects Chauffeur Taxi Booking System for WordPress (plugin) up to version 6.9. Root cause: Missing authorization controls leading to an authentication/authorization bypass that allows accessing constrained functionality. Impact: as described, enables accessing functionality not pr...

CVE-2024-32685

CVE-2024-32685 targets the WP Ultimate Review WordPress plugin (

CVE-2024-32523

CVE-2024-32523 is an unauthenticated Path Traversal leading to PHP Local File Inclusion in Mailster WordPress plugin

CVE-2024-32521

CVE-2024-32521 affects the WordPress plugin Zero Spam by Highfivery (versions

CVE-2024-32512

The CVE-2024-32512 entry concerns the WordPress weForms plugin (versions up to and including 1.6.20) with a Form Submission Restriction Bypass issue caused by Client-Side Enforcement of Server-Side Security. Affected component: weForms form submission logic; root cause: client-side enforcement al...