CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

CVE-2024-37312

The CVE concerns Nextcloud’s user_oidc OpenID Connect backend, where the ID4me endpoint lacks access control, enabling account registration and potential access to data available to all registered users. Publicly documented details come from Nextcloud advisories and HackerOne report, which confir...

PT-2024-32264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified where the DMCUB can intermittently take longer than expected to process commands, leading to a potential race condition. This issu...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

PT-2024-27105

Name of the Vulnerable Software and Affected Versions Church CRM version 5.8.0 Description A stored cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

ChurchCRM Security Breach

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version v5.8.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload into the Family Name parameter under the Register a New...

CVE-2024-36647

Church CRM version 5.8.0 is susceptible to a stored cross-site scripting (XSS) vulnerability. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Family Name parameter on the Register a New Family page. To remediate this, users should update to a version ...

PT-2024-4768

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The vulnerability is related to a register invariant violation in the Linux kernel's eBPF verifier. Specifically, it occurs when the verifier analyzes a branch instruction and splits t...

CVE-2024-36647: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

SUSE CVE-2024-26920

In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix registersnapshottrigger to return error code if it failed to allocate a snapshot instead of 0 success. Unless that, it will register snapshot trigger without an...

PT-2024-37109

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Discussion Forum version 1.0 Description: A critical issue affects the processing of the file register me.php. The manipulation of the eaddress argument leads to sql injection. The attack may be initiated remotely...

Online Discussion Forum SQL Injection Vulnerability

Online Discussion Forum is a forum website. A SQL injection vulnerability exists in Online Discussion Forum version 1.0, which originates from registerme.php containing some unknown processing that leads to SQL injection via the parameter eaddress...

Telerik Report Server Register Method Access

The vulnerability of the Register method in the Telerik Report Server reporting framework relates to bypassing authentication processes through spoofing. Exploiting this vulnerability can allow unauthorized users to gain access to limited features of the system...

ROS-20240606-01

A vulnerability in QEMU's USB EHCI controller emulation is related to the lack of checks if the buffer pointer overlaps with the MMIO register when transmitting USB packets. the buffer pointer overlaps with the MMIO region when transmitting USB packets. Exploitation of the vulnerability could all...

kernel: wifi: iwlwifi: fix double-free bug

A vulnerability was found in the Linux kernel's iwlwifi driver, where the TLV PC register data being freed is not properly marked as NULL afterwards, resulting in a double-free issue. This could lead to memory corruption or crashes...

kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg

In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in smsc75xxreadreg The Linux kernel CVE team has assigned CVE-2023-52528 to this issue. Upstream advisory:...