Archive
31 August 2024
Vulnerabilities first published on this day (UTC), newest first.
5 results · Clear filters · Feed
-
High 7.8CVE-2024-44946 Public exploit
kcm: Serialise kcm_sendmsg() for the same socket.
In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release(). [0] The scenario is 1. Thread A builds a skb with MSG_MORE and sets kcm->seq_skb. 2. Thread A resume…
-
High 8.8
WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e…
-
High 7.1
netfilter: nfnetlink: Initialise extack before use in ACKs
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink: Initialise extack before use in ACKs Add missing extack initialisation when ACKing BATCH_BEGIN and BATCH_END.
-
High 8.8
Attire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection
The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a P…
-
High 8.1
IBM Sterling Connect:Direct Web Services information disclosure
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical functionality.