SUSE CVE-2024-12426

Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remo...

WordPress plugin Shipping via Planzer for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2026-2875

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the VIA watchdog driver where an unnamed resource allocation can lead to a critical boot hang. The driver uses allocate resource to reserve a memory region for the...

UBUNTU-CVE-2024-9101

A reflected cross-site scripting XSS vulnerability in the 'Entry Chooser' of phpLDAPadmin version 1.2.1 through the latest version, 1.2.6.7 allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' functio...

Important: tigervnc

Issue Overview: A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions wher...

kernel: mmc: via-sdmmc: fix return value check of mmc_add_host()

A flaw was found in the VIA SD/MMC host controller driver. When mmcaddhost fails, the error is not checked, leading to memory leaks and potential null pointer dereference during driver removal...

kernel: wireguard: netlink: access device through ctx instead of peer

In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a bug that led to a NULL peer-device being dereferenced. It's actually easier and faster performance-wise to instead get the device from...

CVE-2024-31152

The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP requests can cause a reboot. This could lead to network service interruptions...

PT-2024-33087 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: LyLme Spage versions prior to 1.6.1 Description: The issue allows for SQL Injection via the "/admin/group.php" API endpoint. Recommendations: For versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue...

CVE-2024-45217

creationtimestamp| type| source ---|---|--- 2024-10-16 11:20:44+00:00| seen| https://t.me/cvedetector/8031...

CVE-2024-48902

In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API...

PT-2024-39857 · Unknown · Code-Projects Crud Operation System

Name of the Vulnerable Software and Affected Versions: code-projects Crud Operation System version 1.0 Description: A critical vulnerability was found in the code-projects Crud Operation System. This issue affects the file delete.php and is related to the manipulation of the sid argument, leading...

firefox: thunderbird: External protocol handlers could be enumerated via popups

The Mozilla Foundation's Security Advisory: By checking the result of calls to window.open with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed...

CVE-2024-7491

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woofmessengerremovesubscr AJAX action due to missing validation on the 'key' user controlled key. This makes it...

MAL-2024-12244 Malicious code in coffin-grave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21110452950ae0dced9cfd59dd55627b8634f47f3dd2be36558c338437532fac So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

PT-2024-18158 · WordPress · Ninja Forms - File Uploads

Name of the Vulnerable Software and Affected Versions: Ninja Forms - File Uploads plugin for WordPress versions up to, and including, 3.3.16 Description: The issue is a Stored Cross-Site Scripting vulnerability via an uploaded file, such as an RTX file, due to insufficient input sanitization and...

CVE-2024-7934

A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file execute.php. The manipulation of the argument code leads to sql injection. The attack can be launched remotely...

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, allows an attacker to gain access to the software environment.

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to the software environment by sending specially craft...

OESA-2024-2002 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumera...

CVE-2024-7637

A vulnerability was found in code-projects Online Polling 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file registeracc.php of the component Registration. The manipulation of the argument email leads to sql injection. The attack may be launched...