AZL-43050 CVE-2024-3567 affecting package qemu for versions less than 8.2.0-16

A flaw was found in QEMU. An assertion failure was present in the updatesctpchecksum function in hw/net/nettxpkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition...

WordPress Smash Balloon Social Post Feed plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Smash Balloon Social Post Feed versions = 4.2.1...

WordPress Captcha by BestWebSoft plugin <= 5.2.0 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by qilin99 Patchstack Alliance in WordPress Plugin Captcha by BestWebSoft versions = 5.2.0...

AZL-39004 CVE-2023-45288 affecting package helm for versions less than 3.15.2-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

PT-2024-22876 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: projeqtor versions up to 11.2.0 Description: The issue is related to a remote code execution RCE vulnerability via the component /view/print.php. This allows for potential exploitation, but specific details about the number of affected device...

InstantCMS 安全漏洞

InstantCMS is a free open source CMS from instantSoft open source. A security vulnerability exists in InstantCMS version v2.16.2, which stems from a SQL injection vulnerability in indexchartdata...

CVE-2024-30429

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forecast: from n/a through 9.2...

Couchbase Server 安全漏洞

Couchbase Server is a distributed open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions 6.6.x through 7.2.0 and 7.1.5 through versions prior to...

PT-2024-13136 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions 6.6.x through 7.2.0 Description: An issue was discovered in Couchbase Server where unauthenticated users may cause memcached to run out of memory via large commands. Recommendations: For Couchbase Server versions 6.6...

Sentrifugo business_id Parameter Cross-Site Scripting Vulnerability

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A cross-site scripting vulnerability exists in Sentrifugo version 3.2, which stems from the lack of effective filteri...

Zscaler Client Connector 安全漏洞

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...

Sentrifugo bunitname parameter SQL injection vulnerability

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which originates from the lack of validation of...

UBUNTU-CVE-2024-1742

Invocation of the sqlplus command with sensitive information in the command line in the mkoracle Checkmk agent plugin before Checkmk 2.3.0b4 beta, 2.2.0p24, 2.1.0p41 and 2.0.0 EOL allows the extraction of this information from the process list...

SUSE CVE-2023-41038

Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long CHAR length, which causes the...

CVE-2024-29871

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the da...

Sentrifugo SQL注入漏洞

Sentrifugo is a human resource management system. The system includes features such as human resource management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which originates from a SQL injection vulnerability...

CVE-2023-45177

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD is vulnerable to a denial-of-service attack due to an error within the MQ clustering logic. IBM X-Force ID: 268066...

PT-2024-18845 · WordPress · Weglot

Name of the Vulnerable Software and Affected Versions: Translate WordPress and go Multilingual – Weglot plugin for WordPress versions up to, and including, 4.2.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's widget/block due to insufficient input sanitization a...

FusionPBX Security Vulnerabilities

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conferencing server and voice application server. A security vulnerability exists in FusionPBX versions prior to 5.2.0 that stems from the...

CVE-2024-27959

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop...