CVE-2024-21515

CVE-2024-21515 affects opencart/opencart 4.0.0.0+. A reflected XSS in the filename parameter of the admin tool/log route could enable an attacker to trick an admin user into exposing a token, prompting login, and executing a payload after authentication. If the attacker has admin privileges, this...

SUSE CVE-2024-38589

In the Linux kernel, the following vulnerability has been resolved: netrom: fix possible dead-lock in nrrtioctl syzbot loves netrom, and found a possible deadlock in nrrtioctl 1 Make sure we always acquire nrnodelistlock before nrnodelocknrnode 1 WARNING: possible circular locking dependency...

Linux Kernel ICMPv6 Router Advertisement Race Condition Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Route Information options. The issue results from the lack of...

PT-2024-18930 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: opencart/opencart version 4.0.0.0 Description: A reflected XSS issue was identified in the redirect parameter of the "customer account/login" route. An attacker can inject arbitrary HTML and Javascript into the page response. This issue is...

PT-2024-18929 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: opencart/opencart versions 4.0.0.0 through 4.1.0.0 Description: A reflected XSS issue was identified in the directory parameter of the admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click ...

PT-2024-18928 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: opencart/opencart version 4.0.0.0 Description: A reflected XSS issue was identified in the filename parameter of the "admin tool/log" route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. T...

CVE-2024-5522

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2024-5522

Summary: CVE-2024-5522 affects the WordPress HTML5 Video Player plugin (

CVE-2024-5522 HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

UBUNTU-CVE-2024-38589

In the Linux kernel, the following vulnerability has been resolved: netrom: fix possible dead-lock in nrrtioctl syzbot loves netrom, and found a possible deadlock in nrrtioctl 1 Make sure we always acquire nrnodelistlock before nrnodelocknrnode 1 WARNING: possible circular locking dependency...

PT-2024-26903 · Unknown · Reposilite

Name of the Vulnerable Software and Affected Versions: Reposilite versions 3.5.10 through 3.5.11 Description: The issue is related to an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. This occurs because the GET /javadoc/repository//raw/ route uses the...

The vulnerability of the bgpd/bgp_packet.c file in the networking routing implementation software for Unix-like systems, related to out-of-memory reading, allows attackers to disclose protected information or cause service failures.

The vulnerability of the bgpd/bgppacket.c file in the networking routing implementation software for Unix-like systems in FRRouting is related to reading the initial byte of the ORF header during a race condition. Exploiting this vulnerability can allow a malicious actor to disclose sensitive...

Updated libndp packages fix security vulnerabilities

A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information...

CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...

CVE-2024-36419

SuiteCRM Core hosts a Host Header Injection vulnerability affecting versions prior to 8.6.1 via direct access to the /legacy route. The issue is addressed in version 8.6.1. The CVE indicates network-level exposure with low impact on confidentiality and integrity and requires no privileges but use...

SuiteCRM Security Breach

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions prior to 8.6.1 that stems from a host header injection when accessing the /legacy route directly...

PT-2024-26986 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 8.6.1 Description: A vulnerability in SuiteCRM allows for Host Header Injection when directly accessing the "/legacy" route. This issue affects versions prior to 8.6.1. Recommendations: For versions prior to 8.6.1,...

GHSA-JQ87-2WXP-8349 ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`

In Zend Framework 2, Zend\Mvc\Router\Http\Query is used primarily to allow appending query strings to URLs when assembled. However, due to the fact that it captures any query parameters into the RouteMatch, and the fact that RouteMatch parameters are merged with any parent routes, this can lead t...

ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`

In Zend Framework 2, Zend\Mvc\Router\Http\Query is used primarily to allow appending query strings to URLs when assembled. However, due to the fact that it captures any query parameters into the RouteMatch, and the fact that RouteMatch parameters are merged with any parent routes, this can lead t...