231584 matches found
Spoofing
In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted NMI for perf sampling, this call sequence can occur most recent at top:...
CVE-2024-25093
The CVE-2024-25093 is a stored XSS in the WordPress GD Rating System plugin
CVE-2023-52482
CVE-2023-52482 is a Linux kernel issue where x86 SRSO mitigation was added to address speculative return stack overflow on Hygon processors. The connected Nessus entry for MiracleLinux 9 references kernel commits that implement x86 srso mitigation for Hygon and notes this CVE’s resolution, aligni...
CVE-2023-52483
CVE-2023-52483 affects the Linux kernel where mctp_route_lookup/mctp_route_lookup_null traverse net->mctp.routes without an RCU read lock, allowing a potential race that could lead to a use-after-free due to a grace period expiry and a kfree while a route pointer is in use. The security adviso...
CVE-2023-52481
CVE-2023-52481 affects ARM64 Linux kernels with Cortex‑A520 erratum 2966298. A speculatively executed unprivileged load could leak data from a privileged load via a cache side channel when returning to EL0, limited to loads in the same translation regime (same ASID/VMID). Mitigation implemented a...
CVE-2023-52476
CVE-2023-52476 refers to a Linux kernel vulnerability in the perf/x86/lbr path where a panic can occur if a vsyscall is made while LBR sampling is active. The issue arises when a vsyscall interrupt (NMI) leads to a decode path that dereferences next_byte pointing to the vsyscall address (e.g., ge...
CVE-2023-52475
CVE-2023-52475 : Linux kernel powermate driver has a use-after-free when the device is disconnected. The issue occurs when an asynchronous control message completes after the powermate_device is freed, leaving a dead lock reference. The recommended fix is to cancel in-progress requests on disconn...
CVE-2024-1976
CVE-2024-1976 : Marketing Optimizer (WordPress plugin) is vulnerable to Cross-Site Request Forgery that can lead to Stored Cross-Site Scripting via admin/main-settings-page.php. The issue arises from missing or incorrect nonce validation, allowing unauthenticated attackers to update plugin settin...
CVE-2023-47874
CVE-2023-47874 affects the WordPress Perfmatters plugin up to version 2.1.6, describing a Missing/Broken Authorization vulnerability. Patchstack and related sources indicate fixed in 2.1.7; remediation is to update to a version later than 2.1.6. Public exploit details are not provided in the avai...
CVE-2024-21752
CVE-2024-21752 affects the WordPress plugin Ajax Search Lite (versions ≤ 4.11.4). The issue is a Cross-Site Scripting (XSS) vulnerability that arises via Cross-Site Request Forgery, exploitable by unauthenticated users to trigger reflected XSS. Patch available: upgrade to 4.11.5 which fixes the f...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Mega – Absolute Addons For Elementor.This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.3...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.12...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in ?leanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Automator.This issue affects Thrive Automator: from n/a through 1.17...
CVE-2024-1437
CVE-2024-1437 is a Reflected XSS in Adsmonetizer (WordPress plugin) affecting up to version 3.1.2. The connected documents list it as Unpatched; no exploit details or patch version are provided.
CVE-2024-1434
CVE-2024-1434 affects the WordPress plugin Media Alt Renamer, with a stored XSS in _wp_attachment_image_alt postmeta that impacts version 0.0.1 (and earlier unspecified in the initial entry). Public details in connected documents confirm the vulnerability type (Stored XSS) and the affected softwa...
CVE-2024-1435
CVE-2024-1435 affects the WordPress Tainacan Plugin,
CVE-2023-51696
CVE-2023-51696 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “CleanTalk – Anti-Spam Protection Spam protection, Anti-Spam, FireWall.” Affected versions are up to and including 6.20 (range listed as n/a through 6.20). Root cause is CSRF; impacts involve unauthorized ...
Input validation
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaximportoptions function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with...