PT-2024-35221 · Unknown · Ai Auto Tool Content Writing Assistant

Name of the Vulnerable Software and Affected Versions: KCT Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions n/a through 2.1.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control...

Harbor 授权问题漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control, ensuring that images are scanned and are not vulnerable, and signing images as trusted. Harbor suffers from an authorization issue vulnerability that stems from not...

PT-2024-39715 · WordPress · Learnpress Export Import

Name of the Vulnerable Software and Affected Versions: LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress versions up to, and including, 4.0.4 Description: The issue is related to Reflected Cross-Site Scripting via the learnpress import form server parameter due to...

WordPress Disable Admin Notices individually plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Disable Admin Notices individually versions = 1.4.0...

WordPress Gallerio plugin <= 1.01 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by CTRL - Chance Patchstack Alliance in WordPress Plugin Gallerio versions = 1.01...

WordPress Kognetiks Chatbot for WordPress plugin <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Assistant Deletion vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Kognetiks Chatbot for WordPress versions = 2.1.7...

The vulnerability of DRM/VKMS components in Linux kernel allows a perpetrator to trigger a service failure.

The vulnerability of DRM/VKMS components in Linux operating systems is related to improper input validation in the function applyluttochannelvalue. Exploiting this vulnerability can allow an attacker to trigger a service failure...

WordPress Product Delivery Date for WooCommerce - Lite plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerability

WordPress Product Delivery Date for WooCommerce - Lite plugin = 2.8.0 - Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Product Delivery Date for WooCommerce – Lite versions = 2.8.0...

SUSE-SU-2024:3979-1 Security update for xen

This update for xen fixes the following issues: Security issues fixed: - CVE-2024-45818: xen: Deadlock in x86 HVM standard VGA handling bsc1232622 - CVE-2024-45819: xen: libxl leaks data to PVH guests via ACPI tables bsc1232624 Non-security issue fixed: - Xen host hung at boot up with repeated 'X...

kernel: HID: i2c-hid-of: fix NULL-deref on failed power up

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures...

kernel: s390/qeth: Fix kernel panic after setting hsuid

A flaw was found in the Linux kernel's s390/qeth component. A local attacker with privileges to manage network devices could trigger a kernel panic by setting the hsuid attribute on an IQD Layer3 device while its network interface is active. This occurs because the kernel attempts to execute a nu...

kernel: firmware: cs_dsp: Return error if block header overflows file

A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...

WordPress WOLF plugin <= 1.0.8.3 - CSV Limited Path Traversal vulnerability

CSV Limited Path Traversal vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin WOLF versions = 1.0.8.3...

WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael in WordPress Plugin Master Addons for Elementor versions = 2.0.9.9.4...

WordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Classified Listing versions = 3.1.16...

WordPress ZIJ KART plugin <= 1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin ZIJ KART versions = 1.1...

WordPress DigiPass plugin <= 0.3.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin DigiPass versions = 0.3.0...

WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin <= 1.5.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Instant Image Generator versions = 1.5.2...

WordPress Do That Task plugin <= 1.5.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Do That Task versions = 1.5.5...

PT-2024-34947 · Unknown · L Squared Hub Wp

Name of the Vulnerable Software and Affected Versions: L Squared Hub WP versions n/a through 1.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially leading to cyb...