PT-2025-9979

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the handling of PCIe ports during system suspend. The issue occurs when the system is suspended and certain root ports a...

WordPress plugin WOOEXIM SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

Malicious code in old-mpl-token-metadata (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6603cd004d4fbdaf7a066de7f7057ad66c4108e0bd8d961201d12f326fc1d7bf Any computer that has this package install...

CVE-2024-12595: Improper Neutralization of Input During Web Page Generation

The AHAthat Plugin WordPress plugin through 1.6 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

Hey, Maybe It's Time to Delete Some Old Chat Histories

Your messages going back years are likely still lurking online, potentially exposing sensitive information you forgot existed. But there's no time like the present to do some digital decluttering...

AZL-54738 CVE-2024-56650 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: fix LED ID check in ledtgcheck Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call...

LinkAce 安全漏洞

LinkAce is a self-hosted archive of links to your favorite websites by Kevin Woblick Personal Developer. A security vulnerability exists in LinkAce versions prior to 1.15.6. An attacker exploiting this vulnerability could upload a malicious HTML file containing a JavaScript payload...

Malicious code in old-celo-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1842e08f1ce198d27488ce0f57a12762160650f8c130e49d19053af3f86147 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12116 Malicious code in old-celo-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1842e08f1ce198d27488ce0f57a12762160650f8c130e49d19053af3f86147 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in old-package-name (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11410 Malicious code in old-package-name (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-12151

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets...

Cisco Urges Immediate Patch for Decade-Old WebVPN Vulnerability

The vulnerability was first identified in 2014...

PT-2024-28393 · Aginode · Aginode Gigaswitch V5

Name of the Vulnerable Software and Affected Versions: Aginode GigaSwitch V5 versions prior to 7.06G Description: The issue allows authenticated attackers with Administrator privileges to upload an earlier firmware version, exposing the device to previously patched vulnerabilities. This can be do...

Devolutions Server 产品安全漏洞

Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2024.3.8.0 and prior versions, which stems from an incorrect assignment of privileges in...

AZL-54595 CVE-2024-53099 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Check validity of link-type in bpflinkshowfdinfo If a newly-added link type doesn't invoke BPFLINKTYPE, accessing bpflinktypestrslink-type may result in an out-of-bounds access. To spot such missed invocations early in the...

WordPress WooCommerce Price Alert plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WooCommerce Price Alert versions = 1.0.4...

Chatwoot 授权问题漏洞

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. An authorization issue vulnerability exists in versions prior to Chatwoot 2.4.0 that stems from the presence of a session fixation...

ZhongBangKeJi CRMEB 安全漏洞

ZhongBangKeJi CRMEB is an open source e-commerce management system from ZhongBangKeJi China. A security vulnerability exists in ZhongBangKeJi CRMEB version 5.4.0 and earlier versions, which stems from an access control error...

PT-2024-34830 · Ciprian Popescu · W3P Seo

Name of the Vulnerable Software and Affected Versions: W3P SEO versions prior to 1.8.6 Description: A Cross-Site Request Forgery CSRF issue is present in Ciprian Popescu W3P SEO, leading to Stored Cross Site Scripting XSS. Recommendations: For versions prior to 1.8.6, update to version 1.8.6 or...