CVE-2024-7423: Cross-Site Request Forgery (CSRF)

The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the networkoptionsaction function. This makes it possible for unauthenticated attackers to update arbitrary options that...

PT-2024-38337 · WordPress · Stream

Name of the Vulnerable Software and Affected Versions: The Stream plugin for WordPress versions up to, and including, 4.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the network options action function. This allows...

WordPress plugin Stream has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2024-20390 Cisco IOS XR Software Dedicated XML Agent TCP Denial of Service Vulnerability

A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could explo...

An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.

...

[SECURITY] Fedora 40 Update: wireshark-4.2.7-1.fc40

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful...

CVE-2024-45407

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the incorrect PIN, b...

DEBIAN-CVE-2024-43799

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect which executes untrusted code. This issue is patched in send 0.19.0...

CVE-2024-45407

Sunshine is a self-hosted game stream host for Moonlight. The CVE describes a failure in pairing state management where a MITM during pairing causes the attacker’s certificate to be incorrectly persisted before the pairing completes, potentially enabling access to the attacker’s certificate and a...

CVE-2024-45407 Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the incorrect PIN, b...

[SECURITY] Fedora 40 Update: expat-2.6.3-1.fc40

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

PT-2024-32249

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition vulnerability has been resolved in the Linux kernel's DRM/AMD display module. The issue occurs between the dcn10 set drr and dc state destruct functions. When dc state...

Fedora: Security Advisory (FEDORA-2024-638f25a317)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6995-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

PT-2024-32758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue has been identified in the Linux kernel, specifically in the af unix module. The problem arises when the manage oob function returns an out-of-band OOB socket buff...

openSUSE Security Advisory (SUSE-SU-2024:3108-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: thunderbird

Issue Overview: Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird...

OpenTelemetry Collector < 0.108.0 Authentication Bypass

The OpenTelemetry Collector running on the remote host is prior to 0.108.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

PT-2024-31323

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue occurs when a monitor connected after an MST hub is unplugged, resulting in a null pointer dereference. This happens because dc sink is released immediately in early unregister...

libproxy: uncontrolled recursion via an infinite stream response leading to stack exhaustion

A flaw was found in libproxy in versions 0.4 through 0.4.15. A remote HTTP server can trigger an uncontrolled recursion via a response composed of an infinite stream that lacks a newline character leading to a stack exhaustion. The highest threat from this vulnerability is to system availability...