CVE-2023-47818

CVE-2023-47818 affects LWS Hide Login (WordPress plugin) up to version 2.1.8. The issue is a protection mechanism bypass that could allow an unauthenticated actor to access login functionality by visiting install.php, effectively bypassing the hidden login protection. Patch/mitigation: upgrade to...

CVE-2023-47663

CVE-2023-47663 affects the WordPress plugin Foyer (WordPress plugin: Foyer – Digital Signage for WordPress). The issue is Improper Neutralization of Script-Related HTML Tags, resulting in Content Injection (basic XSS). Affected versions are Foyer up to 1.7.5. The vulnerability requires at least C...

CVE-2023-45635

CVE-2023-45635 affects the WordPress plugin WP Darko Responsive Tabs (Responsive Tabs) prior to version 4.0.6. The vulnerability is Improper Neutralization of Script-Related HTML Tags, effectively enabling HTML content injection/XSS in the tab content. Root cause is lack of proper sanitization of...

CVE-2023-45053

CVE-2023-45053 affects the WP Content Pilot – Autoblogging & Affiliate Marketing Plugin for WordPress (versions

CVE-2023-41134

CVE-2023-41134 applies to the WordPress plugin Antispam Bee (versions

CVE-2024-31330

CVE-2024-31330 is listed in the 2024-11-01 Wear OS security bulletin under the System component with a local escalation-of-privilege (EoP) vulnerability (High severity). Affected software is Wear OS (System), with the issue mapped to AOSP version 13. The bulletin indicates exploitation could occu...

CVE-2024-31329

CVE-2024-31329 is documented in the Wear OS June 2024 security bulletin as a System-component elevation of privilege (EoP) with High severity. The bulletin notes it could lead to local EoP with no additional execution privileges. Affected devices should apply the 2024-06-01 patch level (or later)...

PT-2024-29253

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises when too many commands are issued by the nvme command at the same time by user tasks, potentially exhausting all tags of admin q. If a reset or IO timeout occurs before...

CVE-2024-4407

CVE-2024-4407 is a privilege-escalation vulnerability in TIBCO Managed File Transfer Platform Server for Unix and z/Linux. Affected versions are Unix: 8.0.0–8.1.1 and z/Linux: 8.0.0–8.1.1. The issue allows a Platform Server client to bypass authentication and transfer files as root or execute com...

CVE-2024-5027

CVE-2024-5027 affects Citrix Workspace app for Mac (pre-2402.10). Elevation of privilege from a local authenticated user to root is possible. Remedy: upgrade to Citrix Workspace app for Mac 2402.10 or later (per CTX675851). If details on root-cause are not provided, note that explicit root-cause ...

PT-2024-27249

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the GuC context scheduling queue, which is 2 entries deep. If a migration job is stuck behind a fault and the migration exec queue shares engines with user jobs, ...

CVE-2021-47228

In the Linux kernel, the following vulnerability has been resolved: x86/ioremap: Map EFI-reserved memory as encrypted for SEV Some drivers require memory that is marked as EFI boot services data. In order for this memory to not be re-used by the kernel after ExitBootServices, efimemreserve is use...

CVE-2024-35197 gix refs and paths with reserved Windows device names access the devices

gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the...

gix refs and paths with reserved Windows device names access the devices

Summary On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that...

Refs and paths with reserved Windows device names access the devices

Summary On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that...

CVE-2021-47228

In the Linux kernel, the following vulnerability has been resolved: x86/ioremap: Map EFI-reserved memory as encrypted for SEV Some drivers require memory that is marked as EFI boot services data. In order for this memory to not be re-used by the kernel after ExitBootServices, efimemreserve is use...

CVE-2021-47228 x86/ioremap: Map EFI-reserved memory as encrypted for SEV

In the Linux kernel, the following vulnerability has been resolved: x86/ioremap: Map EFI-reserved memory as encrypted for SEV Some drivers require memory that is marked as EFI boot services data. In order for this memory to not be re-used by the kernel after ExitBootServices, efimemreserve is use...

CVE-2021-47228

The Linux kernel contains a vulnerability in the x86/ioremap component where memory marked with the EFI_MEMORY_RUNTIME attribute is not properly mapped as encrypted for SEV guests. This occurs because some drivers require memory marked as EFI boot services data , which is preserved using efi_mem_...

SUSE CVE-2024-27435

In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, adminq reconnect failed forever while remote target and network is ok. After dig into it, we found ...

CVE-2024-27435

In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, adminq reconnect failed forever while remote target and network is ok. After dig into it, we found ...