product: WpStickyBar

product: wpstickybar

summary: The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

title: A17Lab Wpstickybar security vulnerability


default_status: unaffected

product: aimhubio/aim

vendor: aimhubio

less_than_or_equal: latest

status: affected

version: unspecified

version_type: custom

default_status: unknown

product: aim

ecosystem: software/application

metric_type: Primary

severity: high

metric_type: Secondary

part: a

vendor: aimstack

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections.

title: Aimstack Aim security vulnerability


vendor: Unknown

version_type: semver

archetype: generic

ecosystem: php/wordpress

status: Deferred

summary: The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

title: Notifications For Forms & Wordpress Actions security vulnerability


product: stangirard/quivr

vendor: stangirard

product: quivr

ecosystem: javascript/npm

severity: medium

vendor: quivr

summary: A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.

title: Quivr security vulnerability


default_status: affected

product: پلاگین پرداخت دلخواه

product: pardakht-delkhah

vendor: wp-master

status: Analyzed

summary: The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack

title: Wp-Master Pardakht-Delkhah security vulnerability


product: Request a Quote

vendor: emarketdesign

summary: The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Emarketdesign Request A Quote security vulnerability


product: CPython

vendor: Python Software Foundation

version_type: python

product: cpython

vendor: python

ecosystem: python/pypi

product: python

summary: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.


product: ZoneAlarm Extreme Security

vendor: Check Point

vendor: checkpoint

summary: Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677.


product: NetScaler Console

vendor: NetScaler

version_type: patch

vendor: citrix

severity: critical

summary: Sensitive information disclosure in NetScaler Console


vendor: NetSclaer

product: Agent

product: SDX

vendor: netscaler

summary: Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX


product: Red Hat Directory Server 12.4 for RHEL 9

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Enterprise Linux 9

vendor: redhat

part: o

summary: A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.


product: pgAdmin 4

vendor: pgadmin

summary: pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms.


product: Red Hat Enterprise Linux 8

product: poppler

vendor: freedesktop

summary: A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.


product: Parallels Desktop

vendor: Parallels

vendor: parallels

summary: Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.


product: Pear Admin Boot

vendor: pearadmin

summary: A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375.


product: ControlLogix® 5580 (1756-L8z)

vendor: Rockwell Automation

product: GuardLogix® 5580 (1756-L8zS)

platforms:
Series A/B/C
Series D

platforms:
Series A/B
Series C

summary: A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.

title: Rockwell Automation Controllogix® 5580 (1756-L8Z) security vulnerability


product: HTML Forms

vendor: Unknown

vendor: htmlforms

vendor: linksoftwarellc

summary: The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.

title: Linksoftwarellc Html Forms security vulnerability


product: PZ Frontend Manager

vendor: projectzealous

summary: The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

title: Projectzealous Pz Frontend Manager security vulnerability


product: SmartPlay

vendor: Faurecia Clarion Electronics Co., Ltd.

summary: Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects SmartPlay: 66T0.05.50.

title: Faurecia Clarion Electronics Co., Ltd. Smartplay security vulnerability


product: Cam v3

vendor: Wyze

vendor: wyze

ecosystem: operating-system

summary: Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Realtek Wi-Fi kernel module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel. Was ZDI-CAN-22310.


summary: Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSIDs embedded in scanned QR codes. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22337.


summary: Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run_action_batch endpoint of the cloud infrastructure. The issue results from the use of the device's MAC address as a sole credential for authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22393.


summary: Wyze Cam v3 TCP Traffic Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TUTK P2P library. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22419.


product: parisneo/lollms-webui

vendor: parisneo

ecosystem: windows/system

vendor: lollms

summary: An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.

title: Lollms Lollms Web Ui security vulnerability


product: playSMS

product: playsms

vendor: playsms

severity: low

summary: A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulation of the argument name/email leads to basic cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269418 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: SkyCaiji

vendor: Zorlan

product: skycaiji

vendor: skycaiji

summary: A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Task Handler. The manipulation of the argument onerror leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269419.


product: Online Food Ordering System

vendor: itsourcecode

vendor: kevinwong

summary: A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /purchase.php. The manipulation of the argument customer leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269420.


product: Brizy – Page Builder

vendor: themefusecom

product: brizy

vendor: brizy

summary: The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public use as another user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. On sites where unfiltered_html is enabled, this can lead to the admin unknowingly adding a Stored Cross-Site Scripting payload.


product: gaizhenbiao/chuanhuchatgpt

vendor: gaizhenbiao

product: chuanhuchatgpt

summary: A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

title: Gaizhenbiao Chuanhuchatgpt security vulnerability


vendor: smub

vendor: smashballoon

summary: The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Smashballoon Feeds For Youtube security vulnerability


platforms:
64 bit
32 bit
x86
ARM
MacOS
Windows
Linux

product: Shared library

vendor: HashiCorp

product: go-getter

vendor: hashicorp

summary: HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

title: Hashicorp Go-Getter security vulnerability


product: Zephyr

vendor: zephyrproject-rtos

version_type: git

product: zephyr

vendor: zephyrproject

summary: BT: Missing length checks of net_buf in rfcomm_handle_data


summary: BT: HCI: adv_ext_report Improper discarding in adv_ext_report


product: Anti-Malware

vendor: Malwarebytes

product: antimalware

vendor: malwarebytes

summary: Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22321.


product: Image Photo Gallery Final Tiles Grid

vendor: wpchill

vendor: machothemes

summary: The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Machothemes Image Photo Gallery Final Tiles Grid security vulnerability


product: Portfolio Filter Gallery

vendor: awordpresslife

summary: The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Awordpresslife Portfolio Filter Gallery security vulnerability


product: WP Lightbox 2

vendor: syedbalkhi

summary: The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Syedbalkhi Wp Lightbox 2 security vulnerability


product: Post Meta Data Manager

vendor: wpexpertplugins

summary: The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Wpexpertplugins Post Meta Data Manager security vulnerability


product: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

vendor: stiofansisland

product: userswp

vendor: ayecode

summary: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Ayecode Userswp security vulnerability


product: Pear Admin Boot

vendor: pearadmin

summary: A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269478 is the identifier assigned to this vulnerability.


product: Service Provider Management System

vendor: SourceCodester

summary: A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file system_info/index.php of the component System Info Page. The manipulation of the argument System Name/System Short Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269479.


product: School Management System

vendor: lahirudanushka

summary: A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknown functionality of the file login.php of the component Login Page. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269480.


product: RG-UAC

vendor: Ruijie

vendor: ruijie

summary: A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/vpn/autovpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument indevice leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269482 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Community Events

vendor: Unknown

summary: The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Community Events Project Community Events security vulnerability


summary: The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack


product: SpiderContacts

vendor: spidercontacts

product: spidercontacts

summary: The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

title: 10Web Spidercontacts security vulnerability


product: Clinic Queuing System

summary: A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as problematic. Affected by this vulnerability is the function save_patient of the file patient_side.php. The manipulation of the argument Full Name/Contact/Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269485 was assigned to this vulnerability.


summary: A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attendancelist.php of the component Attendance Report Page. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269487.


summary: A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file parent.php of the component Parent Page. The manipulation of the argument update leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269488.


summary: A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown processing of the file teacher.php of the component Teacher Page. The manipulation of the argument update leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269489 was assigned to this vulnerability.


summary: A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the file student.php of the component Student Page. The manipulation of the argument update leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269490 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file subject.php of the component Subject Page. The manipulation of the argument update leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269491.


summary: A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file examresults-par.php of the component Exam Results Page. The manipulation of the argument sid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269492.


product: Simple Online Bidding System

summary: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269493 was assigned to this vulnerability.


product: parisneo/lollms

vendor: parisneo

product: lollms

summary: A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.


product: Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits

vendor: master-addons

summary: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.

title: Master-Addons Master Addons security vulnerability


product: DethemeKit for Elementor

vendor: detheme

summary: The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widget in all versions up to and including 2.1.5 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.

title: Detheme Dethemekit For Elementor security vulnerability


vendor: Google

product: nftables

vendor: netfilter

vendor: google

summary: In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses). This issue affects: https://pkg.go.dev/github.com/google/nftables@v0.1.0 The bug was fixed in the next released version: https://pkg.go.dev/github.com/google/nftables@v0.2.0

title: Google Nftables security vulnerability


vendor: Renesas

vendor: renesas

summary: Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware. An integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses.


product: Citrix Workspace app for Windows

vendor: Citrix

version: 2402 LTSR

product: workspace

vendor: citrix

summary: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows


summary: Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.


product: Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels

vendor: tatvic

summary: The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktok_user_id’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Tatvic Conversios: Google Analytics (Ga4), Google Ads, Conversion And A… security vulnerability


product: WPS Hide Login

vendor: wpserveur

summary: The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

title: Wpserveur Wps Hide Login security vulnerability


product: Chrome

ecosystem: browser

product: chrome

product: fedora

vendor: fedoraproject

summary: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


vendor: bfintal

summary: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ parameter in all versions up to, and including, 3.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Bfintal Stackable – Page Builder Gutenberg Blocks security vulnerability


product: Social Sharing Plugin – Social Warfare

vendor: warfareplugins

product: Contact Form 7 Multi-Step Addon

vendor: themerex

product: Simply Show Hooks

vendor: stuartobrien

product: Wrapper Link Elementor

product: BLAZE Retail Widget

vendor: blazeretail

summary: Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.


product: ASPECT-Enterprise

vendor: ABB

product: NEXUS Series

product: MATRIX Series

vendor: abb

summary: Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

title: Abb Aspect-Ent-12 Firmware security vulnerability


product: Conduit

vendor: The Conduit Contributors

product: conduit

vendor: conduit

summary: Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date

title: Conduit security vulnerability


summary: Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction

title: Conduit security vulnerability


summary: Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs


summary: Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same server, given that they are able to send redaction events.

title: Conduit security vulnerability


summary: Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the #admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the server's key, deactivating users, and more

title: Conduit security vulnerability


product: WordPress

vendor: WordPress Foundation

summary: WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Wordpress Foundation Wordpress security vulnerability


product: Simple Online Hotel Reservation System

vendor: itsourcecode

summary: A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269620.


product: Attachment File Icons (AF Icons)

vendor: praveen-rajan

vendor: praveenrajan

summary: The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afi_overview' function and missing file type validation in the 'upload_icons' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Praveenrajan Attachment File Icons security vulnerability


product: Advanced AJAX Page Loader

summary: The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Advanced Ajax Page Loader Project Advanced Ajax Page Loader security vulnerability


product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free

vendor: funnelforms

summary: The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Funnelforms Funnelforms Free security vulnerability


summary: The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.


product: Gutenberg Forms – WordPress Form Builder Plugin

vendor: nikolaystrikhar

summary: The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Nikolaystrikhar Gutenberg Forms security vulnerability


product: IQ Testimonials

product: iq-testimonials

vendor: rogermacrae

summary: The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_image_upload' function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can only be exploited if the 'gd' php extension is not loaded on the server.

title: Rogermacrae Iq-Testimonials security vulnerability


product: Blox Page Builder

vendor: unitecms

summary: The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Unitecms Blox Page Builder security vulnerability


product: Generate PDF using Contact Form 7

vendor: zealopensource

vendor: zealousweb

summary: The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-37555 is a duplicate of this issue.

title: Zealousweb Generate Pdf Using Contact Form 7 security vulnerability


summary: The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


product: IMGspider –

vendor: wbolt

product: imgspider

summary: The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Wbolt Imgspider security vulnerability


summary: The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Wbolt Imgspider security vulnerability


product: ScrollTo Top

vendor: dwieeb

summary: The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Scroll To Top Project Scroll To Top security vulnerability


product: ScrollTo Bottom

summary: The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.1.1. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

title: Dwieeb Scrollto Bottom security vulnerability


product: Grafana

vendor: Grafana

product: Grafana Enterprise

summary: Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

title: Grafana security vulnerability


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.

title: Gitlab security vulnerability


summary: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics.

title: Gitlab security vulnerability


product: FactoryTalk® System Services (installed via FTPM)

vendor: Rockwell Automation

product: FactoryTalk® Policy Manager (FTPM)

vendor: rockwellautomation

summary: The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html by implementing CIP security and did not update to the versions of the software CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html and CVE-2022-1161. https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html

title: Rockwellautomation Factorytalk Policy Manager security vulnerability


summary: An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.


product: Telerik Report Server

vendor: Progress Software Corporation

vendor: progress

summary: In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.

title: Progress Telerik Report Server security vulnerability


vendor: inspireui

vendor: fluxbuilder

summary: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms_login_v2' functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.

title: Inspireui Mstore Api security vulnerability


summary: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded.

title: Gitlab security vulnerability


product: GEO my WP

vendor: Unknown

vendor: geomywp

summary: The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.

title: Geomywp Geo My Wordpress security vulnerability


product: stitionai/devika

vendor: stitionai

product: devika

summary: stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with `HarmBlockThreshold.BLOCK_NONE` for `HarmCategory.HARM_CATEGORY_HATE_SPEECH` and `HarmCategory.HARM_CATEGORY_HARASSMENT` in `safety_settings` disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like `/etc/passwd`.

title: Stitionai Devika security vulnerability


vendor: ameliabooking

product: Booking for Appointments and Events Calendar – Amelia Pro

vendor: Amelia

product: amelia

vendor: tmsproducts

summary: The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it possible for unauthenticated attackers to access employee calendar details, including Google Calendar OAuth tokens in the premium version.

title: Tmsproducts Amelia security vulnerability


vendor: Xerox

product: Xerox® EC8036 / EC8056

product: Xerox® EC8036 / EC8056 - Common Criteria (June 2022)

product: Xerox® EC8036 / EC8056 - Common Criteria (June 2024)

product: VersaLink® B625 / C625 | B425 / C425 Common Criteria Certified (2024)

product: WorkCentre 3655/3655i

product: WorkCentre 5945/55i

product: WorkCentre 6655/6655i

product: WorkCentre 7220/7225i

product: WorkCentre 7830/7835i

summary: Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.


product: Easy Table of Contents

summary: The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

title: Magazine3 Easy Table Of Contents security vulnerability


product: Tracking Code Manager

summary: The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Data443 Tracking Code Manager security vulnerability


product: GitHub Enterprise Server

vendor: GitHub

vendor: github

summary: A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a dependent repository from private to public. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.

title: Github Enterprise Server security vulnerability


summary: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access token was not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14 and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.


product: FV Flowplayer Video Player

vendor: foliovision

summary: The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Foliovision Fv Flowplayer Video Player security vulnerability


product: Phlox PRO

vendor: averta

product: phlox

summary: The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Averta Phlox security vulnerability


product: Premium Addons for Elementor – Powerful Elementor Templates & Widgets

summary: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.10.36 and fully patched in version 4.10.37.

title: Leap13 Premium Addons For Elementor security vulnerability


product: NAS326 firmware

vendor: Zyxel

product: NAS542 firmware

vendor: zyxel

summary: **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

title: Zyxel Nas326 Firmware security vulnerability


product: ATP series firmware

version: versions V4.32 through V5.38

product: USG FLEX series firmware

version: versions V4.50 through V5.38

product: USG FLEX 50(W) series firmware

version: versions V4.16 through V5.38

product: USG20(W)-VPN series firmware

product: zld

summary: A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.

title: Zyxel Zld security vulnerability


product: pypa/setuptools

vendor: pypa

product: setuptools

vendor: python

summary: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

title: Python Setuptools security vulnerability


product: Post Grid

vendor: pickplugins

product: comboblocks

summary: The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Countdown widget, in all versions up to, and including, 2.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Pickplugins Comboblocks security vulnerability


vendor: nissan-global

summary: * Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger denial-of-service (DoS) by unauthorized access to the ECU's programming session. * No preconditions implemented for ECU management functionality through UDS session in the Blind Spot Detection Sensor ECU in Nissan Altima (2022) allows attackers to disrupt normal ECU operations by triggering a control command without authentication.

title: Nissan-Global Blind Spot Detection Sensor Ecu Firmware security vulnerability


summary: Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests.

title: Nissan-Global Blind Spot Protection Sensor Ecu Firmware security vulnerability


product: Simplicity SDK

summary: A malformed 802.15.4 packet causes a buffer overflow to occur leading to an assert and a denial of service. A watchdog reset clears the error condition automatically.


product: SiSDK

summary: A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert


summary: A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert


product: Wallet for WooCommerce

vendor: subratamal

product: terawallet

vendor: standalonetech

summary: The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Standalonetech Terawallet security vulnerability


product: Remote Desktop Manager

vendor: Devolutions

vendor: devolutions

summary: Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.

title: Devolutions Remote Desktop Manager security vulnerability


product: Tilgin Fiber Home Gateway HG1522

vendor: Genexis

summary: A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269755. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.

title: Gitlab security vulnerability


product: ArcSight Intelligence

vendor: OpenText

vendor: opentext

summary: Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.


summary: Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.


summary: Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.


product: Vertica

vendor: OpenText™

product: vertica

vendor: microfocus

summary: Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X.

title: Microfocus Vertica security vulnerability


product: ALM Octane.

summary: Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to version 23.4. The vulnerability could cause remote code execution attack.


product: Ultimate Blocks

vendor: Unknown

vendor: dotcamp

summary: The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

title: Dotcamp Ultimate Blocks security vulnerability


product: Stock Ticker

vendor: urkekg

vendor: urosevic

summary: The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Urosevic Stock Ticker security vulnerability


product: Absolute Persistence

vendor: Absolute Security

version_type: Absolute Persistence

product: persistence

vendor: absolute

summary: A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to the device, and full hostile network control, to initiate OS commands on the device. To remediate this vulnerability, update the device firmware to the latest available version. Please contact the device manufacturer for upgrade instructions or contact Absolute Security, see reference below.


product: Product Table for WooCommerce by WBW

vendor: woobewoo

summary: The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server.

title: Woobewoo Product Table By Wbw security vulnerability


product: User Profile Builder

vendor: cozmoslabs

summary: The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.

title: Cozmoslabs Profile Builder security vulnerability


product: LIMS

vendor: LabVantage

vendor: labvantage

summary: A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp of the component POST Request Handler. The manipulation of the argument sdcid/keyid1/keyid2/keyid3 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: labvantage

summary: A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?command=page of the component POST Request Handler. The manipulation of the argument param1 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269801 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid=LV_ReagentLot of the component POST Request Handler. The manipulation of the argument mode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269802 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argument bulletinbody leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269803.


vendor: itsourcecode

vendor: janobe

summary: A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. Affected by this issue is some unknown functionality of the file controller.php. The manipulation of the argument rmtype_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269804.


product: Tailoring Management System

vendor: angeljudesuarez

summary: A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file customeradd.php. The manipulation of the argument fullname/address/phonenumber/sex/email/city/comment leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269805 was assigned to this vulnerability.


product: Online Food Ordering System

vendor: kevinwong

summary: A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269806 is the identifier assigned to this vulnerability.


product: School Management System

vendor: lahirudanushka

summary: A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269807.


product: MongoDB Server

vendor: MongoDB Inc

product: mongodb

vendor: mongodb

summary: A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.


product: MongoDB Compass

product: compass

summary: MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

title: Mongodb Compass security vulnerability


vendor: Dassault Systèmes

less_than_or_equal: Release 3DEXPERIENCE R2022x.FP.CFA.2424

version: Release 3DEXPERIENCE R2022x Golden

less_than_or_equal: Release 3DEXPERIENCE R2023x.FP.CFA.2419

version: Release 3DEXPERIENCE R2023x Golden

less_than_or_equal: Release 3DEXPERIENCE R2024x.FP.CFA.2424

version: Release 3DEXPERIENCE R2024x Golden

vendor: dassault

summary: An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.

title: 3Ds 3Dexperience security vulnerability


product: ENOVIA Collaborative Industry Innovator

vendor: enovia

summary: A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

title: 3Ds 3Dexperience security vulnerability


version: R2022x Golden

version: R2023x Golden

version: R2024x Golden

summary: A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

title: 3Ds 3Dexperience security vulnerability


less_than_or_equal: Release 3DEXPERIENCE R2023x.FP.CFA.2428

less_than_or_equal: Release 3DEXPERIENCE R2024x.FP.CFA.2432

vendor: dassult

version: Release 3DEXPERIENCE R2023x Golden <= Release

version: 3DEXPERIENCE R2024x Golden

title: 3Ds 3Dexperience Enovia security vulnerability


product: libbson

summary: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2

title: Mongodb Libbson security vulnerability


product: MongoDB Rust Driver

summary: Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2


summary: The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1

title: Mongodb Inc Libbson security vulnerability


summary: "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.

title: Gitlab security vulnerability


product: WPML

vendor: WPML

product: wpml

vendor: wpml

summary: The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

title: Wpml security vulnerability


product: Red Hat Enterprise Linux 9

vendor: Red Hat

product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.2 Extended Update Support

product: Red Hat OpenShift Container Platform 4.13

product: Red Hat OpenShift Container Platform 4.14

product: Red Hat OpenShift Container Platform 4.15

product: Red Hat OpenShift Container Platform 4.16

product: Industrial Edge Management OS (IEM-OS)

vendor: Siemens

product: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

product: SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

product: SINAMICS IIoT module

product: SINEMA Remote Connect Server

author: Stephen M Abbott

content_markdown:
A race condition in OpenSSH's `sshd` signal handler — a regression of
CVE-2006-5051 — re-enabled unauthenticated remote code execution as root on
affected glibc-based Linux servers. The bug is reached through the
`LoginGraceTime` SIGALRM handler. The
[OpenSSH 9.8 release notes](https://www.openssh.com/txt/release-9.8) classify it
as critical, and the
[Qualys regreSSHion advisory](https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt)
documents successful exploitation in lab conditions.

CISA's official Known Exploited Vulnerabilities JSON feed
(`catalogVersion` 2026.08.21, released 2026-08-21) does **not** list
CVE-2024-6387. Secondary articles that claim a 2026-02-25 KEV addition are
not authoritative unless they match that live feed. This recipe keeps
`kev: false` until CISA publishes an entry. Rechecked against the OpenSSH 9.8
release notes, the Qualys advisory, NVD, and the CISA KEV JSON on 2026-08-21.
Live GHAD `GHSA-2x8c-95vh-gfv4` has **vulnerabilities empty**. NVD
OpenSSH CPE last-affects **including 9.8** from **8.6**, plus exact
**4.4 / 8.5 / 8.6**. Vendor and Qualys name **9.8p1**. **9.8p1 is not
an NVD exclude.** Do not invent a later 9.9p1 floor.

## Affected versions

- **OpenSSH** versions earlier than 4.4p1 — vulnerable to the
  original 2006 issue (and to this one if other patches
  weren't backported).
- **OpenSSH** 4.4p1 through versions earlier than 8.5p1 — *not* vulnerable
  to this signal-handler race (the 2006 fix held).
- **OpenSSH** 8.5p1 through 9.7p1 — vulnerable (regression
  reintroduced) in vendor and Qualys prose.
- **OpenSSH** 9.8p1+ — patched in vendor and Qualys prose.
- **Vulnerable / NVD CPE:** OpenSSH exact **4.4 / 8.5 / 8.6** and
  `>= 8.6` last-affects **including 9.8**. There is no GHAD
  first_patched and **no 9.8p1 exclude**.
- **Do not invent:** flatten leftover **9.8p1** onto NVD including
  **9.8**, or invent **9.9p1**.

OpenBSD is not vulnerable. Qualys demonstrated unauthenticated root RCE on
glibc-based Linux and explicitly did not investigate every other libc or
operating system, so a non-glibc platform alone is not proof of safety. Linux
distributions also backport fixes under their own package versions; use the
vendor or distribution advisory as the authoritative package-status check.

## Indicator-of-exposure

Detection:

```bash
ssh -V    # Reports the OpenSSH version
sshd -V 2>&1 | head -1   # Sometimes more accurate

# Also verify against the distro advisory
apt-cache policy openssh-server
dnf info openssh-server
```

Sufficient exposure conditions:

- glibc-based Linux, where unauthenticated root RCE was demonstrated. For other
  platforms, require a vendor or distribution affectedness statement rather
  than assuming they are safe.
- OpenSSH version in the 8.5p1–9.7p1 window.
- `sshd` reachable by an attacker.
- Default `LoginGraceTime` (120 seconds). The mitigation
  setting is `LoginGraceTime 0`, which closes the race window
  by removing the alarm.

A network-isolated `sshd` (only reachable from a bastion or
internal-only) is a smaller exposure surface but still
vulnerable to anyone who reaches the bastion.

## Remediation strategy

- **Upgrade** OpenSSH to 9.8p1+ via the distro's package
  manager.
- **Mitigate** with `LoginGraceTime 0` in
  `/etc/ssh/sshd_config` until the upgrade lands. This
  removes the alarm-based race entirely; the cost is that a
  client hanging the auth handshake holds an `sshd` slot
  forever (a `MaxStartups` setting becomes load-bearing).
- **Restart** `sshd` after either action.
- **Audit** authentication logs for unusual volumes or patterns of pre-auth
  timeouts and failed connections. A `Timeout before authentication` line is
  not, by itself, proof of exploitation.
- **Escalate for incident-response assessment** when affected `sshd` was
  reachable from untrusted networks or telemetry is suspicious. Version and
  reachability prove exposure, not compromise; the incident owner decides
  whether host-key or secret rotation and host rebuilds are required.

## When to use it

Use this recipe when a Linux host, container image, appliance, VM base image,
or infrastructure repository may run affected OpenSSH `sshd`. Remote root RCE
was demonstrated on glibc-based Linux; other platforms still require an
authoritative vendor or distribution affectedness decision.
It is most important for public or bastion-reachable servers, management
containers, CI images, golden images, or fleets where `sshd` exposure and
restart ownership are split across teams.

Use it to distinguish package remediation from incident response: upgrade or
mitigate, identify the restart owner, classify exposure, and produce host-key
rotation and log-review actions when the service was reachable. Do not use it
to bundle unrelated SSH hardening or firewall redesign into the same change.

## Inputs

- Host inventories, image manifests, SBOMs, package locks, distro advisories,
  Terraform/Ansible/cloud-init/Packer config, container Dockerfiles, SSHD
  config, systemd units, and operational runbooks.
- OpenSSH server version evidence from `sshd -V`, package managers, image
  scans, distro backport advisories, custom build metadata, and runtime
  inventory.
- Platform and exposure evidence: operating system, libc, vendor or distro
  advisory status, listening interfaces, firewall/bastion controls,
  `LoginGraceTime`, `MaxStartups`, public internet reachability, auth logs, and
  exposure-window timing.
- Operator-owned secrets and trust anchors reachable by `sshd`: host keys,
  host certificates, PAM/AuthorizedKeysCommand outputs, deploy credentials,
  CI credentials, and artifacts produced on the host.
- Change-control constraints for package upgrades, config mitigation, reload or
  restart timing, session impact, auth-log retention, key rotation, and host
  rebuilds.

## The prompt

~~~markdown
You are remediating CVE-2024-6387 (regreSSHion) on this host
or in this system image. Output exactly one of:

- A PR / change request upgrading OpenSSH and (optionally)
  applying the `LoginGraceTime 0` mitigation, plus an IR
  checklist for the operator.
- A TRIAGE.md if the host has been running affected `sshd`
  on the public internet for an extended period.

This recipe is **not** auto-merge. The agent produces the PR;
the operator restarts `sshd` and decides on IR scope.

## Step 0 — Detect

1. Read OpenSSH server version: `sshd -V 2>&1 | head -1`.
2. Record the operating system, libc, and vendor or distro advisory status;
   `ldd --version | head -1` can help identify glibc but does not decide
   affectedness on its own.
3. Read `/etc/ssh/sshd_config` for the current
   `LoginGraceTime` value.
4. Determine network exposure: is `sshd` listening on a
   public interface? Is it firewalled to a bastion?

## Step 1 — Classify

- **Vendor or distro confirms the installed build is fixed or not affected:**
  document the advisory and package evidence, then stop.
- **Affected, not network-reachable from untrusted nets:**
  upgrade + restart, no IR escalation.
- **Affected, network-reachable from the public internet for
  an extended window:** write a triage note for operator-led incident-response
  assessment; do not claim compromise or auto-rotate keys.

## Step 2 — Upgrade

1. `apt upgrade openssh-server` /
   `dnf upgrade openssh-server` to the distro's patched
   version.
2. Verify the new version: `sshd -V`.
3. The PR body lists `systemctl restart sshd` as an
   operator action. The agent does not restart the service.

## Step 3 — Mitigate (interim)

If the upgrade cannot ship immediately, propose a config
change:

```
# In /etc/ssh/sshd_config
LoginGraceTime 0
MaxStartups 10:30:100
```

`LoginGraceTime 0` removes the alarm entirely. Tighten
`MaxStartups` to keep an attacker from holding open many
slots. Recommend a `systemctl reload sshd` after the change.

## Step 4 — IR checklist (compromised classification)

The TRIAGE.md must include:

- Decide whether the exposure and telemetry warrant rotating SSH host keys.
- Audit `auth.log` / `journalctl -u ssh` for
  `Timeout before authentication` lines and unusual login
  patterns during the exposure window.
- If compromise is suspected or confirmed, rotate secrets in scope for the
  affected host, including host certificates and credentials exposed through
  PAM or `AuthorizedKeysCommand` integrations.
- Audit any deploy / CI workflows that authenticated to this
  host during the window.
- Rebuild any artifact produced on the host while it was
  affected and reachable.

## Stop conditions

- The vendor or distribution advisory confirms that the installed platform and
  package build are fixed or not affected.
- The host's distro has no patched OpenSSH packaged yet.
  Apply the `LoginGraceTime 0` mitigation; triage with a
  note about the missing package.
- The host's exposure window is unclear or the auth log
  rotation has lost evidence.

## Scope

- Do not modify SSH client configuration.
- Do not modify firewall rules — mention them in the PR body
  as a reviewer-considered defence-in-depth.
- Do not bundle unrelated CVEs.
- Do not run `systemctl restart sshd`. Restarting `sshd` is
  the operator's call (severs in-flight sessions).
~~~

## Verification — what the reviewer looks for

- The package version after upgrade matches the distro's
  patched version.
- If the mitigation was applied: `LoginGraceTime 0` is
  present and `MaxStartups` is sane.
- The PR body's IR scope matches the host's exposure
  classification — the reviewer doesn't accept "it was
  internal" without seeing how that was confirmed.
- For compromised classification, confirm the IR actions
  were carried out before merge.

## Watch for

- **Distro version strings.** Some distros backport patches
  without bumping the upstream version string. The
  authoritative check is the distro advisory, not
  `sshd -V`.
- **Custom-compiled OpenSSH.** Hosts running OpenSSH built
  from source do not get the distro patch. Treat as a
  separate remediation; rebuild from a clean tree.
- **`MaxStartups` interactions.** Setting `LoginGraceTime 0`
  without raising `MaxStartups` can become an availability
  bug — clients failing-to-authenticate hold slots forever.
  Tune both together.
- **Bastion-only exposure isn't no exposure.** A bastion that
  itself is reachable becomes the same target. The IR scope
  should follow the chain.
- **Containerised sshd.** Some images run `sshd` for
  management. Image bumps follow the
  [base-image workflow]({{< relref "/security-remediation/base-images" >}});
  this recipe applies to the package inside the container.

## Output contract

Return one of:

- A reviewer-ready PR/change request that upgrades the controlled OpenSSH
  package or image, optionally applies `LoginGraceTime 0` with sane
  `MaxStartups` as an interim mitigation, identifies restart/reload actions,
  verifies the distro-patched status, and attaches an operator IR checklist.
- `TRIAGE.md` when public or unclear exposure requires incident handling, no
  patched distro package is available, custom-compiled OpenSSH must be rebuilt
  outside this repository, or restart/host-key rotation ownership is external.

The output must list OpenSSH version evidence, distro advisory status, glibc
status, exposure path, `LoginGraceTime` and `MaxStartups`, restart owner,
auth-log review commands, host keys or secrets requiring rotation, and
validation commands. It must not restart production `sshd`, modify SSH client
config, silently change firewall rules, or bundle unrelated CVEs.

## Rollback

Do not roll back into NVD-listed OpenSSH **8.5 / 8.6 through 9.8** or
into vendor 8.5p1–9.7p1. Do not flatten leftover **9.8p1** onto the
NVD including-**9.8** row and do not invent a first_patched from the
empty GHAD vulnerabilities list.

## References

- OpenSSH 9.8 release notes: <https://www.openssh.com/txt/release-9.8>
- Qualys regreSSHion security advisory: <https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2024-6387>
- CVE record: <https://www.cve.org/CVERecord?id=CVE-2024-6387>
- CISA KEV JSON feed (authoritative KEV source; this CVE is not listed as of 2026-08-21): <https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json>

## Related recipes

- [Vulnerable Dependency Remediation]({{< relref "/security-remediation/vulnerable-dependencies" >}})
  — generic CVE workflow.
- [Base Image & Container Layer Remediation]({{< relref "/security-remediation/base-images" >}})
  — for OpenSSH inside container bases.

description: Remediate CVE-2024-6387 (regreSSHion), an OpenSSH sshd signal-handler race enabling unauthenticated root RCE. NVD last-affects including 9.8. Vendor names 9.8p1.

maturity: stable

model: Opus 4.7

title: CVE-2024-6387: OpenSSH regreSSHion RCE Remediation

vendor: sonicwall

product: eos

vendor: arista

vendor: canonical

product: almalinux

vendor: almalinux

vendor: netapp

quality: curated

recipe_kind: markdown-override

summary: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.


product: Ubuntu Advantage Desktop Pro

vendor: Canonical Ltd.

summary: Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.

title: Canonical Ubuntu Advantage Desktop Daemon security vulnerability


product: GitLab

product: gitlab

summary: An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.


product: Quiz and Survey Master (QSM)

vendor: Unknown

vendor: expresstech

summary: The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks

title: Expresstech Quiz And Survey Master security vulnerability


product: oik

vendor: bobbingwide

summary: The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Bobbingwide Oik security vulnerability


product: Image Optimizer, Resizer and CDN – Sirv

vendor: sirv

product: sirv

summary: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.

title: Sirv security vulnerability


product: Photo Gallery, Sliders, Proofing and Themes

vendor: imagely

summary: The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Imagely Nextgen Gallery security vulnerability


product: parisneo/lollms-webui

vendor: parisneo

product: lollms-webui

vendor: lollms

summary: A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `serve_js` function in `app.py`, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files on the server, potentially exposing sensitive information such as private SSH keys, configuration files, and source code.


product: GitHub Enterprise Server

vendor: GitHub

vendor: github

summary: An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.

title: Github Enterprise Server security vulnerability


product: aimhubio/aim

vendor: aimhubio

product: aim

vendor: aimstack

summary: A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

title: Aimstack Aim security vulnerability


vendor: instawp

summary: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.

title: Instawp Instawp Connect security vulnerability


product: Secure Web Gateway

vendor: Skyhigh

version: SWG 12.x prior to 12.2.10 SWG 11.x prior to 11.2.24

vendor: skyhighsecurity

summary: An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk is low, because other recommended default security policies such as URL categorization and GTI are in place in most policies to block access to uncategorized/high risk websites. Any information disclosed depends on how the customers have customized the block pages.

title: Skyhighsecurity Secure Web Gateway security vulnerability


product: finrota

vendor: finrota

summary: Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11 and 1.24.03.

title: Finrota security vulnerability


product: InsureE GL

vendor: SFS Consulting

vendor: sfs

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection. This issue affects InsureE GL: before 4.6.2.

title: Sfs Insuree Gl security vulnerability


vendor: Tenda

vendor: tenda

vendor: tendacn

summary: A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269947. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifiBasicSet of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269948. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Floating Social Buttons

vendor: varniinfotech

summary: The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floating_social_buttons_option() function. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


product: Mobile Library Application

vendor: Yordam Information Technology

summary: Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve Embedded Sensitive Data. This issue affects Mobile Library Application: before 5.0.

title: Yordam Information Technology Mobile Library Application security vulnerability


product: Wiser Home Controller WHC-5918A

vendor: Schneider Electric

version: All Versions of Wiser Home Controller WHC-5918A

vendor: schneider-electric

summary: CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device.

title: Schneider-Electric Whc-5918A Firmware security vulnerability


product: Slider by 10Web

vendor: Unknown

product: slider

summary: The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

title: 10Web Slider security vulnerability


product: Red Hat Enterprise Linux 9

vendor: Red Hat

product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.2 Extended Update Support

product: Red Hat OpenShift Container Platform 4.13

product: Red Hat OpenShift Container Platform 4.14

product: Red Hat OpenShift Container Platform 4.15

product: Red Hat OpenShift Container Platform 4.16

part: redhat

summary: A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.


vendor: metagauss

product: profilegrid

summary: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user.

title: Metagauss Profilegrid security vulnerability


summary: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their user capabilities to Administrator.


product: HTML Forms

vendor: htmlforms

vendor: linksoftwarellc

summary: The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

title: Linksoftwarellc Html Forms security vulnerability


product: TrakSYS

vendor: Parsec Automation

product: tracksys

summary: A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Export Page. The manipulation of the argument ID leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270000. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Estate Manager

vendor: Ingenico

summary: A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/PREF_HOME_PAGE/sponsor/3/ of the component New Widget Handler. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: SeaCMS

product: seacms

vendor: seacms

summary: A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270007.


product: Simple Online Bidding System

vendor: SourceCodester

summary: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_user. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270008.


product: Medicine Tracker System

summary: A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270009 was assigned to this vulnerability.


summary: A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Master.php?f=save_medicine. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270010 is the identifier assigned to this vulnerability.


product: Hide My WP Ghost

vendor: wpplugins

summary: The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

title: Wpplugins Hide My Wp Ghost security vulnerability


vendor: Pepperl+Fuchs

vendor: pepperl-fuchs

summary: An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service.


summary: An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data.