CVE-2024-3275 eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure

The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the searchposts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts...

CVE-2024-3275 eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure

The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the searchposts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts...

CVE-2024-32984 Yamux Memory Exhaustion Vulnerability via Active::pending_frames property

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended ...

PT-2024-25032 · Yamux · Yamux

Name of the Vulnerable Software and Affected Versions: Yamux affected versions not specified Description: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames, which is not bounded...

Yamux 安全漏洞

HashiCorp Yamux is a multiplexer from HashiCorp USA. A security vulnerability exists in versions of Yamux prior to 0.13.2, which stems from a possible Yamux memory exhaustion caused by the Active pendingframes property...

PT-2024-25115 · Thinksaas · Thinksaas

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A stored cross-site scripting XSS vulnerability in the component /pubs/counter.php allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter. This...

CVE-2024-4307 SQL injection vulnerability in HubBank

SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints /accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /accounts/viewcards. php?id=1,...

CVE-2024-4307 SQL injection vulnerability in HubBank

SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints /accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /accounts/viewcards. php?id=1,...

PT-2024-25747 · Totolink · Totolink Cp450

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP450 version 4.1.0cu.747 B20191224 Description: A stack buffer overflow issue was found in the SetPortForwardRules function. Recommendations: For TOTOLINK CP450 version 4.1.0cu.747 B20191224, consider disabling the SetPortForwardRul...

PT-2024-24156 · Unknown · Rg-Rsr10-01G-T(Wa)-S

Name of the Vulnerable Software and Affected Versions: RG-RSR10-01G-TW-S and RG-RSR10-01G-TWA-S routers version RSR10-01G-T-S RSR 3.01B9P2, Release07150910 Description: An issue in the routers allows attackers to execute arbitrary code via the common quick config.lua file. Recommendations: For...

PT-2024-24510 · Totolink · Totolink N300Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RT version V2.1.8-B20201030.1539 Description: The issue is related to a Store Cross-site scripting XSS vulnerability. This vulnerability is located in the Port Forwarding section under the Firewall Page. Recommendations: For...

CVE-2024-26838

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix KASAN issue with tasklet KASAN testing revealed the following issue assocated with freeing an IRQ. 50006.466686 Call Trace: 50006.466691 50006.489538 dumpstack+0x5c/0x80 50006.493475...

PT-2024-21552

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a crash that occurs when an IRQ is pending during the probe of the adv7511 driver in the Linux kernel. Specifically, if an IRQ is already pending during the adv75...

PT-2024-24489 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 1.0 V1.0.1.25633 Description: The issue is a command injection vulnerability in the formexeCommand function via the cmdinput parameter. This allows for potential exploitation. Recommendations: For Tenda W30E version 1.0...

PT-2024-4892 · Oracle · Oracle Complex Maintenance

Name of the Vulnerable Software and Affected Versions: Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13 Description: The issue exists due to insufficient input validation in the LOV component of the Oracle Complex Maintenance, Repair, and Overhaul product within...

PT-2024-24186 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Loan Management System version 1.0 Description: The issue concerns SQL Injection via the password parameter in the "login.php" file. This allows for potential unauthorized access to sensitive data. There is no information...

PT-2024-22929 · Unknown · Summernote

Name of the Vulnerable Software and Affected Versions: Summernote versions 0.8.18 and earlier Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the codeview parameter. This enables the attacker to perform actions such as executing arbitrary code on...

Section 702: The Future of the Biggest US Spy Program Hangs in the Balance

The US Congress will this week decide the fate of Section 702, a major surveillance program that will soon expire if lawmakers do not act. WIRED is tracking the major developments as they unfold...

CVE-2024-28232 Username Enumeration in CasaOS via bypass of CVE-2024-24766

Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that...

PT-2024-23647 · Unknown · Phpgurukul Emergency Ambulance Hiring Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Emergency Ambulance Hiring Portal version 1.0 Description: A critical issue has been found in the Ambulance Tracking Page component, specifically in the file ambulance-tracking.php. The manipulation of the searchdata argument leads...