CVE-2024-0757

The Insert or Embed Articulate Content into WordPress plugin (versions up to and including 4.3000000023 ) is vulnerable to unrestricted file upload due to insufficient filtering of file extensions during zip archive imports. This allows unauthenticated attackers to upload malicious phar files to ...

CVE-2024-4462

CVE-2024-4462 concerns the Nafeza Prayer Time WordPress plugin. The description indicates a Stored Cross‑Site Scripting vulnerability in admin settings for all versions up to 1.2.9, caused by insufficient input sanitization and output escaping. The issue affects multisite installations and sites ...

CVE-2024-4870

CVE-2024-4870 affects the WordPress plugin Frontend Registration – Contact Form 7. The vulnerability arises from insufficient restriction on the cf7frr post meta, in versions up to and including 5.1, enabling authenticated attackers with editor-level access and higher to modify the default user r...

CVE-2024-29972

CVE-2024-29972 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

Exploit for OS Command Injection in Proscend M330-W_Firmware

CVE-2022-36779 exploit code for Unauthenticated OS...

CVE-2023-24373

The CVE-2023-24373 entry concerns the WordPress Booking calendar, Appointment Booking System plugin. Affected versions are ≤ 3.2.3, and the root cause is an External Control of Assumed-Immutable Web Parameter that allows bypass by manipulating hidden fields. The vulnerability is categorized as a ...

CVE-2024-31682

The application Phone Cleaner: Boost & Clean v2.2.0 is vulnerable to an incorrect access control flaw in its fingerprint authentication mechanism. This vulnerability is caused by the use of a deprecated API , which allows attackers to bypass fingerprint authentication . To mitigate this risk, use...

CVE-2021-3899

CVE-2021-3899 involves a race condition in Apport's replaced-executable detection that, with specific local configuration, could allow a local attacker to run arbitrary code as root. This vulnerability is referenced in multiple advisories (Ubuntu USN-6894-1, RH Red Hat CVE notes, and Nessus/OSV e...

CVE-2024-36889

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure sndnxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snduna: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 mptcpcleanuna+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules...

CVE-2024-23360

CVE-2024-23360 involves a memory corruption issue in LPAC-related components when creating an LPAC client, where the LPAC engine is allowed to access GPU registers. Affected scope is described across multiple sources (NVD, Red Hat, CVE lists) as memory corruption with HIGH impact on confidentiali...

CVE-2023-43556

CVE-2023-43556 describes memory corruption in the Hypervisor when platform information is not aligned. The available connected documents corroborate this vulnerability across multiple sources (NVD, Red Hat CVE entry, CVE list, Vuln Enrichment) with the same description. The materials do not speci...

Advisory ROSA-SA-2024-2430

Software: libvirt 6.0.0 OS: ROSA Virtualization 2.1 packageevrstring: libvirt-6.0.0-28.module+el8.3.0+7827+5e65edd7.src.rpm CVE-ID: CVE-2021-3631 BDU-ID: 2024-02428 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Libvirt virtualization management library is related to the creation of SELinux M...

RHEL 5 : firefox (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows CVE-2020-6823 - Mozilla Firef...

[SECURITY] Fedora 39 Update: rust-docopt-1.1.1-13.fc39

Command line argument parsing...

CVE-2024-2506

The Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin’s Custom JS functionality in all versions up to 4.2.7, due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least Contributor-level ...

CVE-2024-35357

A SQL injection vulnerability exists in Diño Physics School Assistant version 2.3 . The flaw stems from unrecognized code within the /classes/Master.php?f=delete_item file, where manipulating the id argument allows for unauthorized database interaction. As a temporary workaround, users should avo...

CVE-2024-36933 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().

In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb-protocol,data,macheader for outer header in nshgsosegment. syzbot triggered various splats see 0 and links by a crafted GSO packet of VIRTIONETHDRGSOUDP layering the following protocols: ETHP8021AD + ETHPNSH +...

CVE-2024-36112

CVE-2024-36112 affects Nautobot: in 1.3.0–1.6.22 and 2.0.0–2.2.4, listing members of Dynamic Groups via the UI or API does not enforce member-object permissions, enabling a user with extras.view_dynamicgroup to see all Group members regardless of dcim.view_device. Fixed in Nautobot 1.6.23 and 2.2...

CVE-2024-5433

The CVE-2024-5433 vulnerability affects Campbell Scientific CSI Web Server (and RTMC Pro) and is caused by a path traversal flaw in a command that returns the most recent file matching a given expression. Versions 1.6 and earlier of the CSI Web Server (and RTMC Pro 5.x/4.x) are affected. An attac...

CVE-2024-33801

The campcodes Complete Web-Based School Management System version 1.0 is susceptible to a SQL injection vulnerability located in the /model/get_subject_routing.php API endpoint. An attacker can exploit this flaw by providing malicious input via the id parameter to execute arbitrary SQL commands ....