CVE-2024-4784 Authentication Bypass by Primary Weakness in GitLab

An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy...

CVE-2024-4784

Removed by vendor...

CVE-2024-42256

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifspreparewrite which will make cifs repick the server for the op before renegotiating credits; it then calls...

CVE-2024-42256

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifspreparewrite which will make cifs repick the server for the op before renegotiating credits; it then calls...

CVE-2024-42256 cifs: Fix server re-repick on subrequest retry

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifspreparewrite which will make cifs repick the server for the op before renegotiating credits; it then calls...

WordPress Filter & Grids Plugin <= 2.8.33 is vulnerable to Broken Authentication

Software Filter & Grids Type Plugin Vulnerable versions = 2.8.33 Fixed in 2.8.34 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-39664 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID bac0e0da8bce Credits RE-ALTER Required privileg...

CVE-2024-6895

Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as passwor...

CVE-2024-6895 Insecure Account Profile Management

Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as passwor...

CVE-2024-6895

CVE-2024-6895 affects Yugabyte Platform: Insufficient authentication in user account management could allow a local-network attacker with a compromised session to change critical security settings (e.g., password, email) without re-authenticating, enabling account takeover. Exploitation details a...

WordPress Cooked Plugin <= 1.7.15.4 - Authenticated (Contributor+) HTML Injection via Recipe Excerpt vulnerability

Authenticated Contributor+ HTML Injection via Recipe Excerpt vulnerability discovered by RE-ALTER in WordPress Plugin Cooked versions = 1.7.15.4...

WordPress Cooked plugin <= 1.7.15.4 - Multiple Cross Site Request Forgery (CSRF) vulnerability

Multiple Cross Site Request Forgery CSRF vulnerability discovered by RE-ALTER in WordPress Plugin Cooked versions = 1.7.15.4...

CVE-2024-39559

An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unauthenticated attacker to crash the device vmcore by sending a specific TCP packet over an established TCP session with MD5 authentication...

CVE-2024-39559

Junos OS Evolved vulnerability CVE-2024-39559 affects dual RE systems with NSR enabled. An unauthenticated network attacker can crash the device (vmcore) by sending a specific TCP packet over an established session using MD5 authentication (e.g., BGP with MD5). The issue stems from an improper ch...

CVE-2024-39559 Junos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabled

An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unauthenticated attacker to crash the device vmcore by sending a specific TCP packet over an established TCP session with MD5 authentication...

kernel: mptcp: fix data re-injection from stale subflow

A flaw was found in the Linux kernel. A logical error in the Multipath TCP packet manager causes some packets intended for retransmission to be lost, resulting in a potential denial of service...

CVE-2024-39485 media: v4l: async: Properly re-initialise notifier entry in unregister

In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Properly re-initialise notifier entry in unregister The notifierentry of a notifier is not re-initialised after unregistering the notifier. This leads to dangling pointers being left there so use listdelinit to...

WordPress One Click Order Re-Order Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software One Click Order Re-Order Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5641 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a046b0fddb6b Credits Lucio Sá...

kernel: mptcp: fix data re-injection from stale subflow

A flaw was found in the Linux kernel. A logical error in the Multipath TCP packet manager causes some packets intended for retransmission to be lost, resulting in a potential denial of service...

WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by RE-ALTER Patchstack Alliance in WordPress Theme Blocksy versions = 2.0.22...

WordPress Goya theme <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters vulnerability

Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters vulnerability discovered by RE-ALTER in WordPress Theme Goya versions = 1.0.8.7...