6478 matches found
kernel: media: bttv: fix use after free error due to btv->timeout timer
In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv-timeout timer There may be some a race condition between timer function bttvirqtimeout and bttvremove. The timer is setup in probe and there is no timerdelete operation in remove...
com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.642.2)
org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...
SUSE CVE-2024-41051
In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemandobjectworker to finish when dropping object When queuing ondemandobjectworker to re-open the object, cachefilesobject is not pinned. The cachefilesobject may be freed when the pending read request is...
dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
...
WordPress Sync Post With Other Site plugin <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update vulnerability
Missing Authorization to Authenticated Subscriber+ Post Creation and Update vulnerability discovered by Lucio Sá in WordPress Plugin Sync Post With Other Site versions = 1.6...
WordPress Sync Post With Other Site Plugin <= 1.6 is vulnerable to Broken Access Control
Software Sync Post With Other Site Type Plugin Vulnerable versions = 1.6 Fixed in 1.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6709 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 159a5eca941a Credits Lucio Sá Required...
CVE-2024-6709
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'spsaddupdatepost' function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2024-6709: Missing Authorization
The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'spsaddupdatepost' function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access an...
GHSA-9FPW-C9X7-CV3J Mattermost allows remote actor to set arbitrary RemoteId values for synced users
Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...
Mattermost failed to properly validate synced reactions
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts...
CVE-2024-41926
Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...
CVE-2024-41144
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels...
CVE-2024-41926
Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...
CVE-2024-41926
Mattermost server (github.com/mattermost/mattermost-server) is affected by CVE-2024-41926. Versions 9.9.x up to 9.9.0 and 9.5.x up to 9.5.6 fail to validate the source of sync messages, allowing a malicious remote to set arbitrary RemoteId values for synced users and thus claim a user was synced ...
CVE-2024-41926 Malicious remote can claim that a user was synced from another remote
Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...
CVE-2024-41926 Malicious remote can claim that a user was synced from another remote
Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...
CVE-2024-41926 Malicious remote can claim that a user was synced from another remote
Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...
CVE-2024-41144
Mattermost vulnerability CVE-2024-41144 affects Mattermost server versions: 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, and 9.8.x
CVE-2024-41144 Malicious remote can create/update/delete arbitrary posts in arbitrary channels
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels...
PT-2024-29638 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.6 Mattermost versions 9.9.x through 9.9.0 Description: The issue allows a malicious remote to set arbitrary RemoteId values for synced users, which can lead to claiming that a user was synced from another...