11923 matches found
WordPress AutomatorWP plugin <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value vulnerability
Reflected Cross-Site Scripting via a-0-o-searchfieldvalue vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin AutomatorWP versions = 5.0.9...
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52778: mptcp: deal with large GSO size bsc1224948. CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision...
APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP
The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol RDP configuration files. The activity, which has targeted governments and armed forces, think tanks, academic...
gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush
A flaw was found in the gdk-pixbuf decoder in the GStreamer library. Processing a specially crafted input file can cause a NULL pointer dereference due to an unchecked return value, resulting in an application crash and a denial of service...
IBM MQ 代码问题漏洞
IBM MQ is a messaging middleware product from International Business Machines IBM. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA. A denial of service vulnerability exists in IBM MQ versions 8.1.0 through 8.1.0.25, which stems from...
CVE-2024-52792
LDAP Account Manager LAM is a php webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via mainmanage.php and confmain.php. This allows setting arbitrary config values...
BIT-NODE-MIN-2021-44533
Node.js 12.22.9, 14.18.3, 16.13.2, and 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in...
CBL Mariner 2.0 Security Update: kernel (CVE-2024-49900)
The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49900 advisory. - In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of newea in...
The vulnerability of the pkcs15-init personalization utility and the libopensc library, which are part of the software tools and libraries for working with smart cards in OpenSC, allows a violator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the pkcs15-init personalization utility and the libopensc library related to the OpenSC software suite involves the use of uninitialized variables due to incorrect checks on the return values of functions. Exploiting this vulnerability could allow an attacker to compromise th...
udf: fix uninit-value use in udf_get_fileshortad
...
CVE-2024-12059
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the elioptionvalue shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...
PT-2024-17420 · WordPress · Elementinvader Addons For Elementor
Name of the Vulnerable Software and Affected Versions: ElementInvader Addons for Elementor plugin for WordPress versions up to and including 1.3.1 Description: The issue allows authenticated attackers with Contributor-level access or higher to extract arbitrary options from the wp options table...
SUSE SLES15 Security Update : kernel (Live Patch 47 for SLE 15 SP2) (SUSE-SU-2024:4263-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4263-1 advisory. This update for the Linux Kernel 5.3.18-15020024188 fixes several issues. The following security issues were fixed: - CVE-2024-36904: tcp: Use...
Security Bulletin: IBM® Db2® is vulnerable to denial of service under specific conditions (CVE-2024-45663)
Summary IBM® Db2® is vulnerable to denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-45663 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the...
CVE-2024-53243
In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could see alert search query responses using Splunk...
OSV-2024-1351 Use-of-uninitialized-value in Archive::UnexpEndArcMsg
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=382526743 Crash type: Use-of-uninitialized-value Crash state: Archive::UnexpEndArcMsg Archive::ReadHeader50 Archive::ReadHeader...
PT-2024-40638 · Git +1 · Unrar
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state includes functions such as Archive::UnexpEndArcMsg,...
PT-2024-9875 · Splunk · Splunk Cloud Platform +2
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.2, 9.2.4, and 9.1.7 Splunk Secure Gateway app on Splunk Cloud Platform versions prior to 3.2.462, 3.7.18, and 3.8.5 Description: The issue is related to improper access control in the Splunk Secure...
Splunk Cloud Platform和Splunk Enterprise 安全漏洞
Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. Splunk Cloud Platform and Splunk Enterprise ha...