Google Chrome Code Execution Vulnerability (CNVD-2024-26521)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in versions prior to Google Chrome 125.0.6422.141, which can be exploited by remote attackers to cause heap corruption via specially crafted HTML pages...

Google Chrome Code Execution Vulnerability (CNVD-2024-26520)

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in versions prior to Google Chrome 125.0.6422.141, which can be exploited by remote attackers to cause heap corruption via specially crafted HTML pages...

WordPress Social Link Pages Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Social Link Pages Type Plugin Vulnerable versions = 1.6.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3555 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0d1f020a1aca Credits Lucio Sá Required...

WordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Visual Composer Website Builder versions = 45.8.0...

PT-2024-32144

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to overmapping the identity VRAM mapping in the Linux kernel, which triggers hardware bugs on certain platforms. To resolve this, 2M pages are used for the last...

WPUpper Share Buttons <= 3.43 - Missing Authorization

Description The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected...

PT-2024-26535

Name of the Vulnerable Software and Affected Versions The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress versions up to, and including, 1.6.9 Description The issue is related to a missing capability check on the import link pages function, allowin...

Social Link Pages: link-in-bio landing pages for your social media profiles <= 1.6.9 - Missing Authorization to Arbitrary Page Creation and Cross-Site Scripting

Description The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the importlinkpages function in all versions up to, and including, 1.6.9. This makes it possible for...

SUSE CVE-2024-36913

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if setmemoryencrypted fails In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is...

UBUNTU-CVE-2024-34009

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized...

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BIP...

GHSA-VG6X-PCHQ-98MG OpenCMS Cross-Site Scripting vulnerability

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user: with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the title field...

CVE-2024-36913

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if setmemoryencrypted fails In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is...

CVE-2024-36882 mm: use memalloc_nofs_save() in page_cache_ra_order()

In the Linux kernel, the following vulnerability has been resolved: mm: use memallocnofssave in pagecacheraorder See commit f2c817bed58d "mm: use memallocnofssave in readahead path", ensure that pagecacheraorder do not attempt to reclaim file-backed pages too, or it leads to a deadlock, found iss...

CVE-2022-43841

IBM Aspera Console 3.4.0 through 3.4.2 PL9 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 239078...

CVE-2022-43841 IBM Aspera Console information disclosure

IBM Aspera Console 3.4.0 through 3.4.2 PL9 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 239078...

CVE-2024-5520 Cross-Site Scripting stored in Alkacon OpenCMS

Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to create and modify web pages through the admin panel, can execute malicious JavaScript code, after inserting code in the “title” field...

CVE-2024-5520

OpenCMS 16 by Alkacon has two stored Cross-Site Scripting vulnerabilities affecting the title field that let users with sufficient privileges create/modify pages and execute malicious JavaScript when pages are viewed. The issue arises from insufficient input validation in the title field. Several...

PT-2024-11662

Name of the Vulnerable Software and Affected Versions IBM Aspera Console versions 3.4.0 through 3.4.2 PL9 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM Aspera Console versions 3.4.0 through 3.4.2 PL9,...

IBM Aspera security vulnerabilities

IBM Aspera is a suite of fast file transfer and streaming solutions from International Business Machines IBM built on the IBM FASP protocol. A security vulnerability exists in IBM Aspera Console versions 3.4.0 through 3.4.2 PL9, which originated from allowing web pages to be stored locally and re...