CVE-2024-26655 Fix memory leak in posix_clock_open()

In the Linux kernel, the following vulnerability has been resolved: Fix memory leak in posixclockopen If the clk ops.open function returns an error, we don't release the pccontext we allocated for this clock. Re-organize the code slightly to make it all more obvious...

Security Posture Management for GitHub: spotting and fixing risks in your GitHub organization just got a lot easier

Wiz SPM for version control systems helps you find and fix risks in your GitHub instance...

Authorization Bypass

Grafana vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to insufficient validation of organization IDs in the DeleteDashboardSnapshot within dashboardsnapshot.go. This allows an attacker to bypass authorization and delete a snapshot by sending a DELETE...

CVE-2023-50960

IBM QRadar SIEM is vulnerable to CVE-2023-50960, a stored cross-site scripting flaw in the Web UI. The IBM bulletin specifies affected product: IBM QRadar SIEM 7.5.0 UP7, with fix in 7.5.0 UP8; exploitation details are not provided beyond the stored XSS description, and the impact is potential cr...

UBUNTU-CVE-2024-1313

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

CVE-2024-1313 Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

Mozilla Drops Onerep After CEO Admits to Running People-Search Networks

The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep, an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by...

CVE-2024-24883

CVE-2024-24883 affects BdThemes Prime Slider – Addons For Elementor (WordPress). Affected versions: up to 3.11.10. Root cause: missing authorization check in bdt_duplicate_as_draft() allows authenticated users with contributor-level access and above to duplicate private/password-protected posts. ...

CVE-2024-25907

CVE-2024-25907 affects WP Media Folder plugin for WordPress (versions

CVE-2024-24850

CVE-2024-24850: Quicksand Post Filter jQuery Plugin (WordPress) <= 3.1.1 has a Missing Authorization vulnerability via quicksand_admin_ajax, allowing unauthenticated access to delete arbitrary site options (Broken Access Control). The CVE is listed with a high risk in WordPress vulnerability f...

CVE-2024-25912

CVE-2024-25912 concerns the WordPress Moveto (MoveTo) plugin by Skymoonlabs, affecting MoveTo versions from n/a through 6.2. The root issue is Missing Authorization, allowing an unauthenticated attacker to perform an Unauthenticated Settings Change. The CVSS 3.1 base score is 9.8 (Network attack ...

CVE-2024-25922

The CVE-2024-25922 entry describes a Missing Authorization vulnerability in the Peach Payments Gateway WordPress plugin (Peach Payments Gateway) affecting versions up to 3.1.9. The root cause is broken access control via peach_core_version_rollback(), allowing unauthorized actions by subscribers ...

CVE-2023-51672

CVE-2023-51672 affects FunnelKit Checkout (WordPress plugin). The issue is Unauthenticated Arbitrary Content Deletion (arbitrary post/page deletion) due to missing authorization, affecting FunnelKit Checkout versions up to and including 3.10.3. The CVSS 3.1 base score is 7.5 (HIGH) with network a...

CVE-2024-29019

CVE-2024-29019 affects ESPHome’s dashboard API (version 2023.12.9 and prior) and is due to a CSRF flaw that lets a logged-in user’s session perform operations on configuration files if the victim visits a weaponized page. The issue enables bypassing authentication for API calls that manipulate co...

CVE-2024-27966

CVE-2024-27966 is a stored XSS in the WordPress plugin “Quiz And Survey Master” (ExpressTech) affecting versions up to 8.2.2. The root cause is improper neutralization of input during web page generation, enabling stored cross-site scripting when used by authenticated users. Wordfence/RedHat/NVD ...

CVE-2024-27969

CVE-2024-27969 affects the Free Downloads WooCommerce WordPress plugin (Free Downloads WooCommerce) and is a Stored XSS vulnerability. It impacts Free Downloads WooCommerce versions up to 3.5.8.2 and arises from improper input neutralization during web page generation. Public sources in the Conne...

CVE-2024-27988

CVE-2024-27988 affects the WordPress plugin WEN Responsive Columns (

CVE-2024-27991

CVE-2024-27991 affects the WordPress plugin SupportCandy (up to version 3.2.3). The issue is a Stored XSS caused by improper input neutralization during web page generation. Impact is stored XSS on affected pages; patch is available in 3.2.3 (upgrade to 3.2.3 or later). Other sources (Red Hat, NV...

CVE-2024-27992

CVE-2024-27992 is a Reflected XSS in the WordPress plugin Link Whisper Free . Public disclosures indicate the vulnerability affects versions from some unspecified start up to and including 0.6.8, with the issue present in the Free edition and not in Pro as described in sources. Multiple CVE recor...