kernel: USB: core: Fix access violation during port device removal

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disablestore: usbhubtostructhub can return NULL if the hub that the port belongs to is concurrently removed, but...

ext4: avoid use-after-free in ext4_ext_show_leaf()

...

WordPress Persian Nested Show/Hide Text plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Persian Nested Show/Hide Text versions = 1.5...

WordPress Persian Nested Show/Hide Text Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software Persian Nested Show/Hide Text Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51831 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 841990db88af Credits SOPROBRO Required privilege...

PT-2024-35670

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6+ Description A NULL pointer dereference vulnerability has been resolved in the Linux kernel. The issue occurs in the zram component, specifically in the comp algorithm show function. This vulnerability...

TONGDA Office Anywhere SQL注入漏洞

TONGDA Office Anywhere is a collaborative office OA system from China Tongda TONGDA. TONGDA Office Anywhere suffers from a SQL injection vulnerability, which originates from the ID parameter of the /pda/appcenter/webshow.php page containing a SQL injection vulnerability...

PT-2024-16493 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA versions up to 11.6 Description: A critical issue has been found in Tongda OA, affecting some unknown processing of the file /pda/appcenter/web show.php. The manipulation of the argument ID leads to sql injection. The attack may be...

WordPress Flash Show And Hide Box plugin <= 1.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Flash Show And Hide Box versions = 1.6...

WordPress Flash Show And Hide Box Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Flash Show And Hide Box Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51656 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 61be485fbb22 Credits SOPROBRO Requir...

CVE-2024-9967

The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showmore shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9967 WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode

The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showmore shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9967: Improper Neutralization of Input During Web Page Generation

The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showmore shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-39965 · WordPress · Wp Show More

Name of the Vulnerable Software and Affected Versions: WP show more plugin for WordPress versions up to, and including, 1.0.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's show more shortcode due to insufficient input sanitization and output escaping on...

WordPress WP show more plugin <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin WP show more versions = 1.0.7...

OESA-2024-2294 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix invalid unregister error path The error path of seg6init is wrong in case CONFIGIPV6SEG6LWTUNNEL is not defined. In that case if seg6hmacinit fails...

WordPress WP show more Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software WP show more Type Plugin Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9967 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 29adade124a3 Credits Peter Thaleikis Required...

SUSE CVE-2024-49889

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4extshowleaf In ext4findextent, path may be freed by error or be reallocated, so using a previously saved ppath may have been freed and thus may trigger use-after-free, as follows: ext4splitextent...

PT-2024-33957

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: There is an out-of-bounds read in bpf link show fdinfo for the sockmap link fd. The issue is resolved by adding the missing BPF LINK TYPE invocation for sockmap link. Additionally,...

PT-2024-35562

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.65 Description The issue is related to the Linux kernel, where a newly-added link type that doesn't invoke BPF LINK TYPE can cause an out-of-bounds access when accessing bpf link type strslink-type. To addres...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the proccpusetshow function kernel/cgroup/cpuset.c in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...