ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow related to the snippet feature.

...

CVE-2021-47585 btrfs: fix memory leak in __add_inode_ref()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in addinoderef Line 1169 3 allocates a memory chunk for victimname by kmalloc, but when the function returns in line 1184 4 victimname allocated by line 1169 3 is not freed, which will lead to a memory leak...

CVE-2021-47585

CVE-2021-47585 concerns a memory leak in the Linux kernel's btrfs __add_inode_ref path. The issue arises from allocating victim_name with kmalloc at two points (lines 1104 and 1169) and returning from the function without freeing the previously allocated memory when backref_in_log() returns an er...

GHSA-55F3-3QVG-8PV5 Symlink bypasses filesystem sandbox

Summary If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime by creating a symlink pointing outside with pathsymlink and pathopeni...

Malware in cedar-snippet

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in cedar-snippet (npm)

This package is considered malicious because it communicates with a domain associated with malicious activity and the package executes one or more commands associated with malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

MAL-2024-1394 Malicious code in cedar-snippet (npm)

This package is considered malicious because it communicates with a domain associated with malicious activity and the package executes one or more commands associated with malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

CVE-2024-35228

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

CVE-2024-35228 Improper Handling of Insufficient Permissions in Wagtail

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

CVE-2024-35228

CVE-2024-35228 affects Wagtail (Django-based CMS) via an improperly applied permission check in the wagtail.contrib.settings module. A user with access to the Wagtail admin and knowledge of the edit view URL can access and update the setting even without model permissions. The vulnerability is no...

CVE-2024-35228 Improper Handling of Insufficient Permissions in Wagtail

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

GHSA-HR2R-W6WC-25PV Zenario uses Twig filters insecurely in the Twig Snippet plugin

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator...

Zenario uses Twig filters insecurely in the Twig Snippet plugin

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator...

CVE-2024-34461

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator...

CVE-2024-34461

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator...

CVE-2024-34461

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator...

PT-2024-25915 · Unknown +1 · Twig Snippet Plugin +1

Name of the Vulnerable Software and Affected Versions: Zenario versions prior to 9.5.60437 Description: The issue is related to the insecure use of Twig filters in the Twig Snippet plugin and in the site-wide HEAD and BODY elements, allowing code execution by a designer or an administrator...

CVE-2024-34461: Improper Control of Generation of Code

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator...

CVE-2024-32882

Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...

CVE-2024-32882 Permission check bypass when editing a model with per-field restrictions in wagtail

Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more...