CVE-2024-8856

CVE-2024-8856: Vulnerabilidad de subida arbitraria de archivos en el plugin WP Time Capsule de WordPress Resumen CVE-2024-8856 es una vulnerabilidad de seguridad encontrada en el plugin WP Time Capsule para WordPress que permite a usuarios no autenticados subir archivos arbitrarios al servidor...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.21...

CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0+. Prior to version 11.6.2 , the method Pay::Webhooks::PaddleBillingController#valid_signature? compares the computed 64-character SHA-256 HMAC against the attacker-controlled h1 token from the Paddle-Signature header using Ruby's String#== (a non-con...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-58059

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption. Mitigation Limit the maximum string...

CVE-2023-36250

CVE-2023-36250 Vulnerabilidad de inyección CSV en el rastreador de tiempo de GNOME versión 3.0.2, que permite a atacantes locales ejecutar código arbitrario a través de un archivo .tsv manipulado al crear un nuevo registro. Tipo de Vulnerabilidad Inyección CSV Descubridor Bruno Teixeira Referenci...

CVE-2021-30809-OOM

...

CVE-2024-3094_xz_check

Script de comprobación de CVE-2024-3094 xz Este repositorio contiene un script Bash y un comando de una sola línea para verificar si un sistema está ejecutando una versión vulnerable de la utilidad "xz", según lo especificado por CVE-2024-3094. Consulte la descripción y la declaración de impacto ...

CVE-2022-24707

PoC para CVE-2022-24707 Vulnerabilidad de inyección SQL en el plugin Puncher. Se puede manipular una solicitud POST para explotar la inyección SQL y filtrar el contenido de la base de datos. Esto está probado en Anuko Time Tracker 1.20.0.5640. root@kitploit: python3 exploit.py --help usage:...

hlf-time-oracle

hlf-time-oracle hlf-time-oracle is a chaincode for blockchain Hyperledger Fabric provides accurate time to other chaincodes. hlf-time-oracle based on ntp pakage pakage and nts pakage. Thus solving the security problem associated with possible transaction time manipulation by the blockchain client...

Astra Linux – Vulnerability in gst-plugins-base1.0

In GStreamer through 1.26.1, the subparse plugin’s parsesubriptime function may write data beyond the bounds of a stack buffer, resulting in a crash...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Regulator: Core – Prevent integer underflow By using a ratio of delay to pollEnabledTime that is not an integer, timeRemaining underflows may occur, causing the loop not to exit as expected. Since delay can be derived from DT, an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fixed use-after-free bugs in otx2synctstamp. The original code relies on canceldelayedwork in otx2ptpDestroy, which does not ensure that the delayed work item synctstampwork has fully completed if it was already...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: imon: fix access to invalid resources for the second interface The imon driver probes two USB interfaces. When probing the second interface, the driver assumes blindly that the first interface was bound to the same imon...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SCTP: The comparison of MACs has been fixed to require constant-time operations. To prevent timing attacks, MACs need to be compared in constant-time. Use the appropriate helper function for this purpose...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible for syzbot to bypass the restriction imposed by the criticized commit in the “Fixes” tag, because the taprio UAPI allows a cycle time that ...

Astra Linux – Vulnerability in Chromium

Before version 149.0.7827.53, using free after in WebRTC in Google Chrome on Linux allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys – fix a sleep while atomic with PREEMPTRT. When PREEMPTRT is enabled, the gpiokeysirqtimer callback runs in the hardirq context. However, the inputevent function takes a spinlock, which is not allowed in that...

Astra Linux – Vulnerability in NTP

The praecisparse function in ntpd/refclockpalisade.c, within NTP 4.2.8p15, contains an out-of-bounds write vulnerability. Any attack method would be complex, for example, using a manipulated GPS receiver...