CLSA-2024-1727287657 Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371

SECURITY UPDATE: fix GSS vulnerabilities - debian/patches/CVE-2021-37370.patch: prevent modification of Extra Count field in GSS krb5 wrap CFX wrap token to avoid appearing truncated to application header - debian/patches/CVE-2021-37371.patch: fix invalid memory reads during GSS message token...

CLSA-2024-1726840907 krb5: Fix of 2 CVEs

CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...

CLSA-2024-1726769396 krb5: Fix of 2 CVEs

CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...

CLSA-2024-1726769331 krb5: Fix of 2 CVEs

CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...

CLSA-2024-1726769233 krb5: Fix of 2 CVEs

CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...

The vulnerability of the _nc_wrap_entry() component in the terminal input/output control library allows a attacker to trigger a service denial.

The vulnerability of the ncwrapentry component in the terminal input/output control library is related to the operation of writing data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2024-8044

The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8044

The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8044

CVE-2024-8044 affects the WordPress plugin infolinks Ad Wrap (versions up to 1.0.2). The issue is a missing CSRF check when updating plugin settings, allowing a logged-in administrator to have settings changed via CSRF. Public docs identify versions 1.0.0–1.0.2 as vulnerable and provide no public...

CVE-2024-8044 infolinks Ad Wrap <= 1.0.2 - Settings Update via CSRF

The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin infolinks Ad Wrap 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-38770 · Infolinks · Infolinks Ad Wrap Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: infolinks Ad Wrap WordPress plugin versions 1.0.0 through 1.0.2 Description: The issue is related to the lack of CSRF protection when updating settings in the infolinks Ad Wrap WordPress plugin. This could allow attackers to make a logged-in...

EulerOS 2.0 SP10 : krb5 (EulerOS-SA-2024-2419)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens wit...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2024-2419)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : krb5 (EulerOS-SA-2024-2395)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2024-2442)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

krb5: GSS message token handling

A vulnerability was found in the MIT Kerberos 5 GSS krb5 wrap token, where an attacker can modify the plaintext Extra Count field, causing the unwrapped token to appear truncated to the application, occurs when the attacker alters the token data during transmission which can lead to improper...

krb5: GSS message token handling

A vulnerability was found in the MIT Kerberos 5 GSS krb5 wrap token, where an attacker can modify the plaintext Extra Count field, causing the unwrapped token to appear truncated to the application, occurs when the attacker alters the token data during transmission which can lead to improper...

WordPress infolinks Ad Wrap plugin <= 1.0.2 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Daniel Ruf in WordPress Plugin infolinks Ad Wrap versions = 1.0.2...

WordPress infolinks Ad Wrap Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software infolinks Ad Wrap Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8044 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 904aefb1e00b Credits Daniel Ruf Required...