1895 matches found
CVE-2024-57546
An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function...
CVE-2024-57546
An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function...
CVE-2024-57546: Insecure Storage of Sensitive Information
An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function...
CVE-2024-57546
The CMSimple content management system (v.5.16) contains a vulnerability in its link validation function that allows a remote attacker to obtain sensitive information via a crafted script. Specifically, the flaw is related to insufficient protection of operational data , which can be exploited to...
kernel security update
5.14.0-503.22.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...
BIT-PHP-MIN-2021-21708 UAF due to php_filter_float() failing
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...
AZL-56121 CVE-2024-47809 affecting package kernel for versions less than 6.6.76.1-1
In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkbresource null dereference This patch fixes a possible null pointer dereference when this function is called from requestlock as lkb-lkbresource is not assigned yet, only after validatelockargs by calling...
CVE-2024-47809 dlm: fix possible lkb_resource null dereference
In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkbresource null dereference This patch fixes a possible null pointer dereference when this function is called from requestlock as lkb-lkbresource is not assigned yet, only after validatelockargs by calling...
PT-2025-2733 · Ctfd · Ctfd
Name of the Vulnerable Software and Affected Versions: CTFd version 3.7.3 Description: The issue is related to the validate email function in CTFd/utils/validators/ init .py, which allows attackers to cause a Regular expression Denial of Service ReDoS by providing a crafted string as an email...
PT-2025-4485 · Optimizely · Episerver.Cms.Core
Name of the Vulnerable Software and Affected Versions: Optimizely EPiServer.CMS.Core versions prior to 12.32.0 Description: A medium-severity issue exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types,...
Google Android security vulnerabilities
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an out-of-bounds write vulnerability, which stems from a lack of boundary checking in the DevmemValidateFlags function of the devicememserver.c file, which can be exploited by an attacker to caus...
Race Condition
Overview PSyclone is a PSyclone - a compiler for Finite Element/Volume/Difference DSLs in Fortran Affected versions of this package are vulnerable to Race Condition due to inadequate checks for pure procedure calls in loop parallelization. This vulnerability derives from the...
Linux RDMA/cma DoS
The vulnerability of RDMA/cma components in Linux operating systems is related to memory leaks in the cmavalidateport function. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2024-36274 · Unknown · Phuc Pham Multiple Admin Emails
Name of the Vulnerable Software and Affected Versions: Phuc Pham Multiple Admin Emails versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This affects the multiple admin emails functionality...
php: Filter bypass in filter_var (FILTER_VALIDATE_URL)
A flaw was found in PHP. An early return in the filtervar FILTERVALIDATEURL function results in invalid user information username + password part of URLs being treated as valid user information. This issue impacts users who expect only completely valid URLs to be returned by filtervar...
WordPress plugin WP User Manager has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-38656 · Special Minds Design · E-Commerce
Name of the Vulnerable Software and Affected Versions: Special Minds Design and Software e-Commerce versions prior to 22.11.2024 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...
Cyber Story Time: The Boy Who Cried "Secure!"
As a relatively new security category, many security operators and executives I've met have asked us "What are these Automated Security Validation ASV tools?" We've covered that pretty extensively in the past, so today, instead of covering the "What is ASV?" I wanted to address the "Why ASV?"...
BIT-HARBOR-2022-31669 Harbor fails to validate the user permissions when updating tag immutability policies
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies...
CVE-2022-31670
Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured...