SUSE CVE-2020-8647

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vcdoresize function in drivers/tty/vt/vt.c...

CVE-2023-0159

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may ...

Design/Logic Flaw

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may ...

CVE-2023-0159 Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may ...

CVE-2023-0159

The CVE-2023-0159 entry affects the WordPress plugin Extensive VC Addons for WPBakery page builder (versions prior to 1.9.1). The vulnerability arises from not validating a parameter passed to PHP’s extract function when loading templates, permitting an unauthenticated attacker to override the te...

WordPress plugin Extensive VC Addons for WPBakery page builder 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress Extensive VC Addons for WPBakery page builder Plugin < 1.9.1 is vulnerable to Local File Inclusion

Software Extensive VC Addons for WPBakery page builder Type Plugin Vulnerable versions 1.9.1 Fixed in 1.9.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-0159 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 335c3e6ccfa2 Credits dc11 Required...

CVE-2022-4501

The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vcsavingdata function in versions up to, and including, 4.2.7. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin'...

PT-2022-27365 · WordPress · Mega Addons

Name of the Vulnerable Software and Affected Versions: Mega Addons plugin for WordPress versions up to, and including, 4.2.7 Description: The issue is related to authorization bypass due to a missing capability check on the vc saving data function. This allows authenticated attackers with...

PT-2022-33682 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.64 Description: A potential security issue exists due to improper reversion of changes when the vc resize function fails. The actual impact and attack plausibility have not yet been proven. Recommendations...

OESA-2022-1748 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Using the ioctl function to modify the vcfont.height value through PIOFONT can cause the KASAN: vmalloc-out-of-bounds in sysimageblit problem. Requires tty group permissions to access the device file /dev/tty1.CVE-2021-33656...

GSD-2022-1003599 x86/sev: Annotate stack change in the #VC handler

x86/sev: Annotate stack change in the VC handler This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit...

GSD-2022-1003094 x86/sev: Annotate stack change in the #VC handler

x86/sev: Annotate stack change in the VC handler This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

Malicious code in vc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344ae9bee9bad22c2b63fdce8d433c063e9e7ad75ab98aa0bb3164230ab4846a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6898 Malicious code in vc-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344ae9bee9bad22c2b63fdce8d433c063e9e7ad75ab98aa0bb3164230ab4846a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6895 Malicious code in vc-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eea55cfb0e38848d2ccef07e0339459a2218639b62c13cc296b6179d39696fa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vc-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eea55cfb0e38848d2ccef07e0339459a2218639b62c13cc296b6179d39696fa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vc-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e43172fb253330392351dc3f66a6cc9263fc963e180e628d56596e60bd25aa18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6896 Malicious code in vc-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e43172fb253330392351dc3f66a6cc9263fc963e180e628d56596e60bd25aa18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vc-push-receiver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50bdb9564abfb7a869e4f497f2f86f6def5718f05a91105c4cdde6a86a7665cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...