Fedora 40 : llhttp / python-aiohttp (2023-f2bb9ee617)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-f2bb9ee617 advisory. python-aiohttp 3.8.6 2023-10-07 https://github.com/aio-libs/aiohttp/blob/v3.8.6/CHANGES.rst386-2023-10-07 Security bugfixes - Upgraded llhttp to v9.1.3:...

CVE-2024-33645: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eftakhairul Islam & Sirajus Salayhin Easy Set Favicon allows Reflected XSS.This issue affects Easy Set Favicon: from n/a through 1.1...

WordPress plugin Easy Set Favicon has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

DEBIAN-CVE-2022-48666

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exitcmdpriv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exitcmdpriv is called by...

DEBIAN-CVE-2022-48634

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix BUG: sleeping function called from invalid context errors gmacrtcpageflip was holding the eventlock spinlock while calling crtcfuncs-modesetbase which takes wwmutex. The only reason to hold eventlock is to clear...

CVE-2022-48634 drm/gma500: Fix BUG: sleeping function called from invalid context errors

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix BUG: sleeping function called from invalid context errors gmacrtcpageflip was holding the eventlock spinlock while calling crtcfuncs-modesetbase which takes wwmutex. The only reason to hold eventlock is to clear...

PT-2024-25406 · Unknown · Easy Set Favicon

Name of the Vulnerable Software and Affected Versions: Easy Set Favicon versions through 1.1 Description: The issue affects Easy Set Favicon, allowing Reflected XSS due to improper neutralization of input during web page generation. This is a type of Cross-site Scripting vulnerability...

PT-2024-25738 · Totolink · Totolink Cp450

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP450 version 4.1.0cu.747 B20191224 Description: A stack buffer overflow issue was found in the setLanguageCfg function, which can be exploited. Recommendations: For TOTOLINK CP450 version 4.1.0cu.747 B20191224, consider disabling th...

CVE-2024-4239

A vulnerability was found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be launched remotely. The...

CVE-2024-32881 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

CVE-2024-32881 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

CVE-2024-4238

A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched...

SUSE CVE-2024-26924

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: addelem"00000000" timeout 100 ms ... addelem"0000000X" timeout 100 ms...

WordPress Easy Set Favicon plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Easy Set Favicon versions = 1.1...

DEBIAN-CVE-2024-26924

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: addelem"00000000" timeout 100 ms ... addelem"0000000X" timeout 100 ms...

WordPress Easy Set Favicon Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Set Favicon Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33645 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6c770d55f2af Credits Dimas Maulana Required privilege...

CVE-2024-4114

A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has...

Tenda W15E security vulnerabilities

Shenzhen Jixiang Tenda Technology Co., Ltd W15E is a wireless router from China Tenda Tenda. A buffer overflow vulnerability exists in the W15E version 15.11.0.14, which is caused by the portMappingServer/portMappingProtocol/portMappingWan/porMappingtInternal/portMappingExternal parameter of the...

Tenda W15E security vulnerabilities

Tenda W15E is a 1200M11AC dual-band enterprise-grade wireless router with strong signal and rich features designed for small businesses and large families with multiple users connecting to the Internet. A stack buffer overflow vulnerability exists in the Tenda W15E in version 15.11.0.14. The...

PT-2024-6575 · Tenda · Tenda W15E

Name of the Vulnerable Software and Affected Versions: Tenda W15E version 15.11.0.14 Description: A critical issue was found in the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to a stack-based buffer overflow. It is...