CVE-2024-1548

CVE-2024-1548 describes a spoofing risk where a fullscreen notification could be obscured by a dropdown select input, potentially confusing users. Affected: Firefox <123, Firefox ESR <115.8, Thunderbird

CVE-2024-26268

The CVE-2024-26268 issue is a user enumeration vulnerability in Liferay Portal (7.2.0–7.4.3.26) and older unsupported versions, and in Liferay DXP 7.4 before update 27, 7.3 before update 8, and 7.2 before fix pack 20. The root cause is that an attacker can infer whether an account exists by measu...

Hardcoded credentials

A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity ...

Design/Logic Flaw

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, whic...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active...

CVE-2023-40325

CVE-2023-40325 is connected to multiple Moodle vulnerabilities reported by Nessus plugins. The affected self‑reported Moodle ranges are: < 3.9.23, < 3.11.16 for 3.11.x, < 4.0.10 for 4.0.x, < 4.1.5 for 4.1.x, and

CVE-2023-40321

Technical details for CVE-2023-40321 are not provided in the supplied documents. No confirmed affected products, impact, or fixes are disclosed here. Monitor connected sources (Ubuntu/CVE references) for updates.

CVE-2023-40322

CVE-2023-40322 relates to Moodle and involves an insufficient access check that can allow access to other users’ message data. Connected sources indicate Moodle versions affected include pre-3.9.23, pre-3.11.16 for 3.11.x, pre-4.0.10 for 4.0.x, pre-4.1.5 for 4.1.x, and pre-4.2.2 for 4.2.x. Some N...

CVE-2023-40318

CVE-2023-40318 is documented in connected Nessus and Ubuntu records as an unpatched vulnerability affecting Linux/Ubuntu packages, with no vendor patch available at the time of assessment. Ubuntu reference shows an entry for CVE-2023-40318; Nessus plugin UNPATCHED_CVE_2023_40318.NASL states Ubunt...

CVE-2023-40320

CVE-2023-40320 pertains to Moodle and is characterized by a self-XSS vulnerability that can lead to account takeover. Multiple third-party sources describe a stored/self-XSS risk in Moodle but do not provide concrete details on affected versions or a published patch in the supplied documents. Exp...

CVE-2023-40319

CVE-2023-40319 is reflected in connected data as an unpatched Linux/Ubuntu issue: Nessus notes Ubuntu packages affected with no vendor patch available; no formal CVE technical details (affected package names, versions, or root cause) are provided in the documents. OSS data (OSV/UBUNTU records) sh...

CVE-2023-40324

CVE-2023-40324 is linked to unpatched Linux distributions per Nessus data. The connected UNPATCHED_CVE_2023_40324.NASL plugin indicates one or more packages on Linux/Ubuntu are affected with no vendor-provided patch available, referencing an Ubuntu entry for CVE-2023-40324. The information does n...

CVE-2023-40323

Nessus plugin UNPATCHED_CVE_2023_40323.NASL reports an unpatched vulnerability for CVE-2023-40323 on Ubuntu Linux packages; no vendor patch is available per the plugin. The document does not specify affected Ubuntu package names or versions.

CVE-2024-26267

CVE-2024-26267 affects Liferay Portal 7.2.0–7.4.3.25 and older unsupported versions, plus Liferay DXP 7.4 before update 26, 7.3 before update 5, and 7.2 before fix pack 19. The root cause is the portal property http.header.version.verbosity defaulting to full, enabling remote attackers to identif...

CVE-2024-26581

CVE-2024-26581 affects the Linux kernel netfilter nft_set_rbtree end-interval GC logic, where rbtree lazy GC on insert could skip an end-interval element just added in the same transaction, potentially enabling privilege/escalation impact for local attackers. Affected: Linux kernel versions with ...

CVE-2023-52433

CVE-2023-52433: Linux kernel netfilter nft_set_rbtree vulnerability. New elements in a single transaction may expire before the transaction ends; skip sync GC during the transaction to avoid the commit path traversing an already released object. Async GC will collect expired elements after the tr...

CVE-2024-25610

CVE-2024-25610 affects Liferay Portal 7.2.0–7.4.3.12 and Liferay DXP 7.2–7.4 with specific updates. The root cause is a default configuration that does not sanitize JavaScript in blog content, allowing remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload i...

CVE-2024-1661

CVE-2024-1661 affects Totolink X6000R (v9.4.0cu.852_B20230719). A vulnerability in the file "/etc/shadow" allows hard-coded credentials, enabling a local-attack with high attack complexity and public disclosure of the exploit. No patch/version with a fix is provided in the sources. Connected PT-2...

CVE-2023-7245

OpenVPN Connect contains a local arbitrary-code execution vulnerability (CVE-2023-7245) in the nodejs/Electron runtime context. Affected: OpenVPN Connect 3.0–3.4.3 on Windows and 3.0–3.4.7 on macOS. Root cause: improper configuration of the nodejs environment, enabling ELECTRON_RUN_AS_NODE to exe...

CVE-2024-24793

Imaging Data Commons libdicom 1.0.5 is affected by a Use-After-Free in the File Meta Information parsing (parse_meta_element_create and related paths), tracked as CVE-2024-24793. The flaw allows memory to be freed prematurely and then used, potentially leading to memory corruption and arbitrary c...