Archive
5 September 2024
Vulnerabilities first published on this day (UTC), newest first.
68 results · Feed
-
Medium 6.4
Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all versions up to, and including, 2.02 due to insufficient input sanitization and output escaping on user supplied attributes. Th…
-
Medium 5.4
Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_…
-
Medium 5.3
Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_load_posts function. This makes it possible for unauthenticated attackers to extract text data from …
-
Medium 5.3CVE-2024-6846 Scanner template
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
-
Critical 9.8
umtx Kernel panic or Use-After-Free
Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A mali…
-
High 8.2
bhyve(8) privileged guest escape via USB controller
An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privileged software running in a guest VM can exploit the vulnerability to achieve code execution on the hos…
-
Critical 9.8
Multiple issues in ctl(4) CAM Target Layer
The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on t…
-
High 8.4
Multiple issues in ctl(4) CAM Target Layer
The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace proce…
-
High 8.4
Multiple issues in ctl(4) CAM Target Layer
The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vul…
-
Critical 9.3
Multiple issues in ctl(4) CAM Target Layer
The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host i…
-
High 8.4
bhyve(8) privileged guest escape via TPM device passthrough
Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the ca…
-
High 8.4
Multiple vulnerabilities in libnv
A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.
-
Critical 9.1
Multiple vulnerabilities in libnv
A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data.
-
High 8.1CVE-2024-7627 Public exploit
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes …
-
Medium 4.7
An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem…
-
Critical 9.8
An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of th…
-
Critical 9.8
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls…
-
High 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning…
-
High 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is po…
-
Medium 5.1
An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not use…
-
Medium 6.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web…
-
High 8.8
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. I…
-
Medium 6.5CVE-2024-45589 Public exploit
RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts a…
-
High 7.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is po…
-
High 8.8
itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter.
-
High 7.4
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/l…
-
High 7.6
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email,…
-
Critical 9.1
SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id para…