PT-2023-35155 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.91 Description: The issue is related to race conditions in the l2tp tunnel register function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.6.0 is vulnerable to Arbitrary Content Deletion

Software WordPress Social Login and Register Discord, Google, Twitter, LinkedIn Type Plugin Vulnerable versions = 7.6.0 Fixed in 7.6.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-25455 Patch priority Low CVSS severity Low 5.3 Developer Claim...

PT-2023-34995 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: The issue is related to a call to put device before device register fails, which may have potential security implications. The actual impact and attack plausibility have not yet been proven...

CVE-2023-24690

ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting XSS vulnerability at /api/public/register/family...

PT-2023-19742

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 4.5.3 and below Description A stored cross-site scripting XSS issue was found in the /api/public/register/family API endpoint. This could potentially allow attackers to inject malicious scripts into the application...

CVE-2023-24690: Improper Neutralization of Input During Web Page Generation

ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting XSS vulnerability at /api/public/register/family...

ChurchCRM 跨站脚本漏洞

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM v4.5.3 and earlier versions that stems from a stored cross-site scripting XSS vulnerability in /api/public/register/family...

Cross site scripting

A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function overridecontentwidth/registersettings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotel...

Custom Content Width 跨站脚本漏洞

Custom Content Width is an application by George Stephanis Personal Developer. Add custom content width settings to settings to allow users to override the content width of their theme. A cross-site scripting vulnerability exists in Custom Content Width version 1.0, which stems from a problem wit...

PT-2023-10254 · Unknown · Custom-Content-Width

Name of the Vulnerable Software and Affected Versions: Custom-Content-Width version 1.0 Description: A vulnerability was found in Custom-Content-Width, affecting the function override content width/register settings of the file custom-content-width.php. This issue leads to cross-site scripting an...

Pie Register < 3.8.2.3 - Open Redirect

The plugin does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability Log In: 1. Visit /login?redirectto=//example.com 2. Log in as a user with lower privileges than Administrator. 3. See that the browser is redirected to example.com Lo...

Pie Register < 3.8.2.3 - Open Redirect

The plugin does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability PoC Log In: 1. Visit /login?redirectto=//example.com 2. Log in as a user with lower privileges than Administrator. 3. See that the browser is redirected to...

PT-2025-43101

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the max9286 v4l2 register function within the media subsystem. This leak occurs when testing the media/i2c/max9286.c file with a bpf mock devic...

kernel: powerpc/rtas: Keep MSR[RI] set when calling RTAS

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Keep MSRRI set when calling RTAS RTAS runs in real mode MSRDR and MSRIR unset and in 32-bit big endian mode MSRSF,LE unset. The change in MSR is done in enterrtas in a relatively complex way, since the MSR value cou...

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Broken Access Control

Software WordPress Social Login and Register Discord, Google, Twitter, LinkedIn Type Plugin Vulnerable versions = 7.5.14 Fixed in 7.6.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-24375 Patch priority Low CVSS severity Low 3.5 Developer Claim ownership...

PT-2023-36760

Уязвимость функции dmi sysfs register handle модуля drivers/firmware/dmi-sysfs.c драйвера прошивок ядра операционной системы Linux связана с доступом к неинициализированному указателю. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

GSD-2023-1001420 crypto: ccree - Remove debugfs when platform_driver_register failed

crypto: ccree - Remove debugfs when platformdriverregister failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001400 usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()

usb: typec: tcpci: fix of node refcount leak in tcpciregisterport This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001399 serial: amba-pl011: avoid SBSA UART accessing DMACR register

serial: amba-pl011: avoid SBSA UART accessing DMACR register This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001116 net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path

net: dsa: tag8021q: avoid leaking ctx on dsatag8021qregister error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...