UBUNTU-CVE-2024-27003

In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clksummary Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clksummary through debugfs. Failure to do so would result in a...

SUSE CVE-2024-26879

In the Linux kernel, the following vulnerability has been resolved: clk: meson: Add missing clocks to axgclkregmaps Some clocks were missing from axgclkregmaps, which caused kernel panic during cat /sys/kernel/debug/clk/clksummary 57.349402 Unable to handle kernel NULL pointer dereference at...

DEBIAN-CVE-2024-26879

In the Linux kernel, the following vulnerability has been resolved: clk: meson: Add missing clocks to axgclkregmaps Some clocks were missing from axgclkregmaps, which caused kernel panic during cat /sys/kernel/debug/clk/clksummary 57.349402 Unable to handle kernel NULL pointer dereference at...

UBUNTU-CVE-2024-26879

In the Linux kernel, the following vulnerability has been resolved: clk: meson: Add missing clocks to axgclkregmaps Some clocks were missing from axgclkregmaps, which caused kernel panic during cat /sys/kernel/debug/clk/clksummary 57.349402 Unable to handle kernel NULL pointer dereference at...

CVE-2024-2804

The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-2804 Network Summary <= 2.0.11 - Unauthenticated SQL Injection

The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-2804 Network Summary <= 2.0.11 - Unauthenticated SQL Injection

The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2024-22229 · WordPress · Network Summary Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Network Summary plugin for WordPress versions up to and including 2.0.11 Description: The issue allows for SQL Injection via the category parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation...

WordPress Plugin Network Summary 安全漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers. A security vulnerability exists i...

CVE-2024-26685

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in endbufferasyncwrite According to a syzbot report, endbufferasyncwrite, which handles the completion of block device writes, may detect abnormal condition of the buffer asyncwrite flag and cause a BUGO...

CVE-2024-26685 nilfs2: fix potential bug in end_buffer_async_write

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in endbufferasyncwrite According to a syzbot report, endbufferasyncwrite, which handles the completion of block device writes, may detect abnormal condition of the buffer asyncwrite flag and cause a BUGO...

The vulnerability of the Application Summary component of the GitOps continuous delivery tool for Kubernetes Argo CD allows attackers to perform XSS attacks.

The vulnerability of the Application Summary component of the GitOps continuous delivery tool for Kubernetes Argo CD exists because measures to protect the website structure have not been taken. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a specially...

XZ Utils Backdoor — Everything You Need to Know, and What You Can Do

...

FreeBSD : mediawiki -- multiple vulnerabilities (d58726ff-ef5e-11ee-8d8e-080027a5b8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d58726ff-ef5e-11ee-8d8e-080027a5b8e9 advisory. - Mediawiki reports: T355538, CVE-2024-PENDING SECURITY: XSS in edit summary parser. T357760,...

HackerOne: Attachment disclosure via summary report

A critical vulnerability was discovered in the HackerOne platform that allowed an attacker to gain unauthorized access to attachments belonging to other users through the report summary editing functionality. By manipulating attachment IDs in the request, an attacker could view sensitive files th...

GO-2024-2646 Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v2

Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. A malicious user to inject a javascript: link in the UI. When clicked by a victim...

WordPress Network Summary Plugin <= 2.0.11 is vulnerable to SQL Injection

Software Network Summary Type Plugin Vulnerable versions = 2.0.11 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2804 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3fb16073a3aa Credits Dan Collins Required privilege Unauthenticated...

Network Summary <= 2.0.11 - Unauthenticated SQL Injection

Description The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Cross-site Scripting (XSS)

Argo CD is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper filtering of URL protocols in the application summary component, allowing a remote attacker with privileges to edit the application to execute Cross-Site Scripting...

mediawiki -- multiple vulnerabilities

Mediawiki reports: T355538, CVE-2024-PENDING SECURITY: XSS in edit summary parser. T357760, CVE-2024-PENDING SECURITY: Denial of service vector via GET request to Special:MovePage on pages with thousands of subpages...