1298 matches found
PT-2024-39068 · WordPress · Themesflat Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.2.1 Description: The issue allows authenticated attackers with Contributor-level access and above to extract limited post information from draft and future...
Linux i915 PTE Use-After-Free
I found a bug in the i915 code that allows a process with access to a render node /dev/dri/renderD128 to corrupt kernel memory. This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will becom...
Exploit for Cross-site Scripting in Martinbarker Rendertune
RenderTune RCE A Proof-Of-Concept for CVE-2024-25292 vulnerab...
OESA-2024-2041 xorg-x11-server-xwayland security update
Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n...
OESA-2024-2042 xorg-x11-server-xwayland security update
Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n...
Spring Security Missing Authorization vulnerability
Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective...
PT-2024-40862 · Git +1 · Ghostscript
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as chunk free object, pdfi interpret content stream, and pd...
PT-2024-38052 · WordPress · Elementskit Pro
Name of the Vulnerable Software and Affected Versions: ElementsKit Pro plugin for WordPress versions up to, and including, 3.6.6 Description: The issue allows authenticated attackers with Contributor-level permissions and above to extract sensitive data, including private, future, and draft posts...
PT-2024-30602 · WordPress · Element Pack Elementor Addons
Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.7.2 Description: The issue allows authenticated attackers with contributor-level access and above to read the contents of arbitrary files on the server,...
CVE-2024-6329
CVE-2024-6329 affects GitLab CE/EE, with GitLab versions 8.16–17.0.5, 17.1–17.1.3, and 17.2–17.2.1 vulnerable to a web UI diff rendering issue when the path is encoded. Root cause: improper encoding/escaping of output in the web interface, leading to incorrect diff rendering. Impact is described ...
Malicious code in render-sample-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 531acbb1583ee41c2b1d689b07228870c585ff764c2fc902a93854b566181af0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-7097 Malicious code in render-sample-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 531acbb1583ee41c2b1d689b07228870c585ff764c2fc902a93854b566181af0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
RLSA-2024:3999 Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: OPVP device arbitrary code execution via custom Driver library...
CVE-2024-0845
The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
PT-2024-15862 · WordPress · Pdf Viewer For Elementor
Name of the Vulnerable Software and Affected Versions: PDF Viewer for Elementor plugin for WordPress versions up to, and including, 2.9.3 Description: The issue is related to Stored Cross-Site Scripting via the render function due to insufficient input sanitization and output escaping. This allow...
CVE-2024-4404
The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'renderraw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originating...
PT-2024-30907 · WordPress · Elementskit Pro
Name of the Vulnerable Software and Affected Versions: ElementsKit PRO plugin for WordPress versions up to, and including, 3.6.2 Description: The issue allows authenticated attackers with contributor-level permissions and above to conduct Server-Side Request Forgery via the render raw function...
ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...
GHSA-HX3M-959F-V849 ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...