CVE-2023-52456

CVE-2023-52456 affects the Linux kernel, specifically the imx serial driver used for RS-485 when the TX state machine can deadlock if the TTY is closed mid-transmission. In that scenario, imx_uart_shutdown disables the interface and the Transmission Complete interrupt, causing imx_uart_stop_tx to...

CVE-2023-52457

CVE-2023-52457 relates to the Linux kernel serial8250/omap path. The issue occurred when remove() returned an error, causing the driver core to log a non-zero removal error and potentially leaking resources if serial8250_unregister_port() was skipped, leaving UART resources around and enabling a ...

CVE-2023-52453

CVE-2023-52453 affects the Linux kernel; the issue is in the hisi_acc_vfio_pci code during PRE_COPY migration, where saving/resume data pointers were not updated correctly based on the fd offset. This can cause migration data corruption and, when the device boots on the destination, errors such a...

CVE-2023-52454

CVE-2023-52454 affects the Linux kernel nvmet-tcp path. A host sending an H2CData command with an invalid DATAL can cause a kernel panic or a NULL pointer dereference in nvmet_tcp_build_pdu_iovec(), as evidenced by the crash trace in nvmet_tcp_io_work. The fix raises a fatal error when DATAL is n...

Authentication flaw

A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDMload.php of the component Cookie Handler. The manipulation of the argument isadmin with the input y...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid...

Path traversal

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...

CVE-2024-25928

CVE-2024-25928 refers to an SQL injection in Sitepact's Contact Form 7 Extension For Klaviyo for WordPress. Affected versions are up to 1.0.5; the issue is an unauthenticated SQL injection (improper neutralization of input) that allows database interaction. Public records indicate a fix is availa...

CVE-2023-24416

CVE-2023-24416 affects WordPress plugin All In One Favicon (versions

CVE-2024-1360

CVE-2024-1360 affects the Colibri WP Theme for WordPress. The issue is a Cross-Site Request Forgery due to missing or incorrect nonce validation in the colibriwp_install_plugin() function, permitting unauthenticated attackers to cause a site admin to install requested plugins by tricking them int...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once...

CVE-2024-1590

CVE-2024-1590 affects the WordPress Page Builder Pagelayer plugin (versions up to and including 1.8.2). The vulnerability is a Stored XSS in the Button Widget due to insufficient input sanitization and output escaping on user-supplied attributes. With contributor-level (or higher) authentication,...

CVE-2024-26593

CVE-2024-26593: In the Linux kernel, i2c: i801: Fix block process call transactions. The issue was that the driver did not reset the block buffer index a second time before reading the incoming data, per Intel datasheets, causing reading the wrong portion of the block buffer. The advisory notes t...

CVE-2024-0563

CVE-2024-0563 affects M-Files Server before version 24.2 (excluding 23.2 SR7 and 23.8 SR5). A DoS condition allows an anonymous user to cause denial of service against other anonymous users. Remediation provided in sources indicates upgrading to version 24.2 or later; versions 23.2 SR7 and 23.8 S...

Design/Logic Flaw

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2024-1776

The CVE-2024-1776 entry concerns the Admin side data storage for the WordPress plugin Contact Form 7. Affected versions are all up to 1.1.1. Root cause: insufficient escaping of the user-supplied form-id parameter and inadequate preparation in the existing SQL query, enabling an authenticated att...

CVE-2024-22243

CVE-2024-22243 involves Spring Framework's UriComponentsBuilder: when parsing an externally provided URL (e.g., from a query parameter) and performing host validation, it may allow an open redirect or SSRF if the URL is used after validation. The provided documents corroborate the vulnerability c...

Sql injection

A vulnerability classified as problematic was found in Limbas 5.2.14. Affected by this vulnerability is an unknown functionality of the file mainadmin.php. The manipulation of the argument tabgroup leads to sql injection. The complexity of an attack is rather high. The exploitation appears to be...

CVE-2024-1786

The CVE-2024-1786 issue affects D-Link DIR-600M C1 with firmware 3.08, where the Telnet Service is vulnerable to a buffer overflow triggered by manipulating the username argument. The vulnerability is remote (attack vector: NETWORK) and described as high severity, with exploitation possible witho...

CVE-2024-1781

CVE-2024-1781 affects Totolink X6000R AX3000 (firmware 9.4.0cu.852_20230719). The vulnerability is in the shttpd component’s setWizardCfg function (/cgi-bin/cstecgi.cgi) and allows command injection due to insufficient input validation. Public exploit guidance exists, and vendors were reportedly ...