BIT-HANDLEBARS-2021-32817 File disclosure in express-hbs

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

Jenkins Delphix Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A security vulnerability...

AZL-35657 CVE-2024-24786 affecting package influxdb for versions less than 2.7.3-7

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-1731

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arspoptions post meta option. This makes it possible for authenticated attackers, with contributor-level access and...

PT-2024-3764

Name of the Vulnerable Software and Affected Versions golang-google-protobuf affected versions not specified Description The issue is related to the protojson.Unmarshal function in the golang-google-protobuf package, which can enter an infinite loop when unmarshaling certain forms of invalid JSON...

WordPress Plugin Auto Refresh Single Page Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

March 5, 2024, update for Office 2016 (KB5002466)

None None...

openSUSE: Security Advisory for lighttpd (openSUSE-SU-2022:10132-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the `hso_serial_tty_unregister` function in the USB HSO (High Speed Options) driver of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the hsoserialttyunregister function in the USB HSO High Speed Options driver of the Linux operating system is related to a pointer swapping error. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...

PT-2024-18259 · WordPress · Auto Refresh Single Page

Name of the Vulnerable Software and Affected Versions: Auto Refresh Single Page plugin for WordPress versions up to, and including, 1.1 Description: The issue allows authenticated attackers with contributor-level access and above to inject a PHP Object via deserialization of untrusted input from...

CVE-2024-1468

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaximportoptions function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with...

CVE-2024-1468

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaximportoptions function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with...

Exploit for OS Command Injection in Cacti

Command injection vulnerability in Cacti CVE-2023-39362 - Po...

Cross site request forgery (csrf)

The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the resetcustomizeroptions function. This makes it possible for unauthenticated attackers to reset the themes settings via ...

Avada | Website Builder For WordPress & WooCommerce < 7.11.5 - Authenticated (Contributor+) Arbitrary File Upload

Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaximportoptions function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers,...

PT-2024-18072 · WordPress · Avada

Name of the Vulnerable Software and Affected Versions: Avada | Website Builder For WordPress & WooCommerce theme for WordPress versions up to, and including, 7.11.4 Description: The issue is related to arbitrary file uploads due to missing file type validation in the ajax import options function...

CVE-2021-46945

In the Linux kernel, the following vulnerability has been resolved: ext4: always panic when errors=panic is specified Before commit 014c9caa29d3 "ext4: make ext4abort use ext4error", the following series of commands would trigger a panic: 1. mount /dev/sda -o ro,errors=panic test 2. mount...

PT-2024-18000 · WordPress · Yuki Theme

Name of the Vulnerable Software and Affected Versions: Yuki theme for WordPress versions up to, and including, 1.3.13 Description: The issue allows authenticated attackers with subscriber-level access and above to reset the theme's settings due to a missing capability check on the reset customize...

PT-2024-18439 · WordPress · Yuki Theme

Name of the Vulnerable Software and Affected Versions: Yuki theme for WordPress versions up to, and including 1.3.14 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the reset customizer options function. This allows unauthenticated...