231584 matches found
CVE-2023-52485
CVE-2023-52485 affects the Linux kernel; the issue stems from wake DMCUB before issuing DMUB commands in the AMD display path, which could deadlock if the DMCUB is not powered. The description indicates a fix to rework command submission to exit idle power optimizations and reenable them after su...
CVE-2024-2001
Cockpit CMS CVE-2024-2001 is a documented XSS in Cockpit CMS 2.7.0 where an authenticated user can upload a PDF containing a malicious JavaScript payload, stored and executed on upload. The issue affects the file upload handling and input validation as described in multiple sources (NVD entry, GH...
Input validation
Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution RCE attack via an improper input validation in a fileupload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned...
CVE-2024-27906
CVE-2024-27906 affects Apache Airflow versions before 2.8.2. The published docs describe a vulnerability where authenticated users can view DAG code and import errors for DAGs they should not be allowed to view via the API and the UI. The primary impact is information disclosure of DAG contents a...
CVE-2024-1953
CVE-2024-1953 affects Mattermost: 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2. An authenticated attacker can exhaust server memory by sending an unusually large request to the API that lists role names, causing a crash. The documented impact is availability loss (CVSS 3....
CVE-2024-1619
CVE-2024-1619 affects Kaspersky Security 8.0 for Linux Mail Server. The vulnerability allows an attacker to coerce an administrator into clicking a malicious link, enabling unauthorized actions. Affected component/process: Kaspersky Security 8.0 for Linux Mail Server; root cause details are not p...
Code injection
Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server...
Design/Logic Flaw
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export...
CVE-2024-23488
Mattermost CVE-2024-23488 concerns a file-access control bug in archived channels. Connected advisory GO-2024-2595 describes a vulnerability in github.com/mattermost/mattermost/server/v8 prior to v8.1.9 where attachments in posts could be accessed despite channel archives settings. Affected compo...
Code injection
Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin...
Sql injection
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the getrestoreprogress and restore functions in all versions up to, and including, 0.9.68. This makes it possible for unauthenticated attackers to exploit a SQL...
CVE-2024-1981
CVE-2024-1981 —WPvivid’s Migration, Backup, Staging plugin for WordPress is vulnerable to unauthenticated SQL Injection via the table_prefix parameter in version 0.9.68 due to insufficient escaping and poor query preparation. This allows an attacker to append additional SQL to existing queries an...
CVE-2024-1978
CVE-2024-1978 concerns the WordPress Friends plugin (versions
CVE-2024-25594
CVE-2024-25594 is a stored XSS vulnerability in the WordPress plugin MyWaze . The issue affects versions up to and including 1.6 and arises from improper input handling in the plugin’s shortcode attributes, allowing injected scripts to execute when pages are viewed. Public details confirm the vul...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul Jura & Nicolas Montigny PJ News Ticker allows Stored XSS.This issue affects PJ News Ticker: from n/a through 1.9.5...
Stack overflow
In the Linux kernel, the following vulnerability has been resolved: x86/srso: Add SRSO mitigation for Hygon processors Add mitigation for the speculative return stack overflow vulnerability which exists on Hygon processors too...
Unrestricted file upload
Unrestricted Upload of File with Dangerous Type vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: from n/a through 7.3.11...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shopfiles Ltd Ebook Store allows Stored XSS.This issue affects Ebook Store: from n/a through 5.788...