default_status: unknown

product: Online Book System

vendor: code-projects

status: affected

ecosystem: software/application

metric_type: Primary

severity: critical

metric_type: Secondary

severity: high

part: a

vendor: anisha

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument username/password/login_username/login_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability.


severity: medium

summary: A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the file /Product.php. The manipulation of the argument value leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258203.


summary: A vulnerability, which was classified as critical, was found in code-projects Online Book System 1.0. Affected is an unknown function of the file /description.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258204.


summary: A vulnerability has been found in code-projects Online Book System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cart.php. The manipulation of the argument quantity/remove leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258205 was assigned to this vulnerability.


severity: low

summary: A vulnerability was found in code-projects Online Book System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Product.php. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258206 is the identifier assigned to this vulnerability.


default_status: unaffected

product: LA-Studio Element Kit for Elementor

vendor: choijun

version_type: semver

ecosystem: php/wordpress

status: Deferred

summary: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in all versions up to, and including, 1.3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Choijun La-Studio Element Kit For Elementor security vulnerability


vendor: Tenda

vendor: tenda

ecosystem: operating-system

part: o

summary: A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258292. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7(775). This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258293 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258294 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258297 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258298 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


vendor: Teledyne FLIR

status: unaffected

vendor: flir

status: Modified

summary: A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."


product: Simple Subscription Website

vendor: SourceCodester

summary: A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258300.


summary: A vulnerability classified as critical was found in SourceCodester Simple Subscription Website 1.0. Affected by this vulnerability is an unknown functionality of the file manage_plan.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258301 was assigned to this vulnerability.


product: ITK-6DGS-1(BK) TEL

vendor: NEC Platforms, Ltd

version_type: custom

product: ITK-32LCGS-1(BK) TEL

product: ITK-32TCGS-1(BK) TEL

product: ITK-6DGS-1A(BK) TEL

product: ITK-32LCGS-1A(BK) TEL

product: ITK-32TCGS-1A(BK) TEL

product: ITK-6DGS-1P(BK) TEL

product: ITK-32LCGS-1P(BK) TEL

archetype: generic

summary: NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.

title: Nec Platforms, Ltd Itk-6Dgs-1(Bk) Tel security vulnerability


default_status: affected

product: SiSDK

product: sisdk

vendor: silabs

summary: In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (RCP) causes the OpenThread Border Router(OTBR) application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service.

title: Silabs Sisdk security vulnerability


product: Essential Addons for Elementor – Popular Elementor Templates & Widgets

vendor: wpdevteam

vendor: wpdeveloper

summary: The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

title: Wpdeveloper Essential Addons For Elementor security vulnerability


product: Red Hat Enterprise Linux 8

vendor: Red Hat

version_type: rpm

product: Red Hat Enterprise Linux 8.2 Advanced Update Support

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.6 Extended Update Support

product: Red Hat Enterprise Linux 8.8 Extended Update Support

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.0 Extended Update Support

product: Red Hat Enterprise Linux 9.2 Extended Update Support

part: redhat

summary: A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.

title: A flaw was found in PCP


product: Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel

vendor: shapedplugin

summary: The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

title: Shapedplugin Product Slider For Woocommerce security vulnerability


product: Mhr Post Ticker

vendor: mdhadid

summary: The Mhr Post Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Header Title value in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Mdhadid Mhr Post Ticker security vulnerability


product: Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress

vendor: reputeinfosystems

product: bookingpress

summary: The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_process_upload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to upload arbitrary files on the affected site's server, enabling remote code execution.

title: Reputeinfosystems Bookingpress security vulnerability


product: AnnounceKit

vendor: restpack

summary: The AnnounceKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Restpack Announcekit security vulnerability


product: tcpreplay

vendor: appneta

vendor: broadcom

summary: A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the file /tcpreplay/src/common/get.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-258333 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: mintplex-labs/anything-llm

vendor: mintplex-labs

version: unspecified

product: anythingllm

vendor: mintplexlabs

summary: mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can lead to unauthorized reading or deletion of files by utilizing the `/api/system/upload-logo` and `/api/system/logo` endpoints. The issue stems from the lack of filtering or validation on the logo filename, allowing attackers to target sensitive files such as the application's database.

title: Mintplexlabs Anythingllm security vulnerability


product: WordPress Button Plugin MaxButtons

vendor: Unknown

product: maxbuttons

vendor: maxfoundry

summary: The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks

title: Maxfoundry Maxbuttons security vulnerability


product: Smart Slider 3

vendor: nextendweb

summary: The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.

title: Nextendweb Smart Slider 3 security vulnerability


summary: mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.


summary: In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.


product: Announce from the Dashboard

summary: The Announce from the Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Gqevu6Bsiz Announce From The Dashboard security vulnerability


product: Fluid Notification Bar

vendor: shrinitech

summary: The Fluid Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Shrinitech Fluid Notification Bar security vulnerability


product: Themify Builder

product: builder

vendor: themify

summary: Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue

title: Themify Builder security vulnerability


summary: An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.

title: Gitlab security vulnerability


product: 800xA Base

vendor: ABB

vendor: abb

summary: Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending specifically crafted messages. This issue affects 800xA Base: from 6.0.0 through 6.1.1-2.


product: PaperCut NG, PaperCut MF

vendor: PaperCut

vendor: papercut

ecosystem: windows/system

summary: An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which typically restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log in to the local console of the Windows environment hosting the PaperCut NG/MF application server. Note: This CVE has been split into two separate CVEs (CVE-2024-3037 and CVE-2024-8404) and it’s been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard users on the host server.


product: BladeX

vendor: Shanghai Brad Technology

product: bladex

summary: A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0x3f),1)=1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: NS-ASG Application Security Gateway

vendor: Netentsec

vendor: netentsec

summary: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258429 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Simple Subscription Website

vendor: SourceCodester

summary: A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258431.


product: Ember ZNet SDK

vendor: silabs

summary: An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY qualification.

title: Silabs Emberznet Sdk security vulnerability


product: LibreOffice

vendor: The Document Foundation

version_type: 7.6 series

version_type: 24.2 series

product: libreoffice

vendor: libreoffice

product: fedora

vendor: fedoraproject

vendor: debian

summary: Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

title: Libreoffice security vulnerability


vendor: wpovernight

summary: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Wpovernight Woocommerce Pdf Invoices& Packing Slips security vulnerability


product: Kura

vendor: Eclipse Foundation

product: kura

vendor: eclipse

summary: In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device logs. Also, downloaded logs may be used by an attacker to perform privilege escalation by using the session id of an authenticated user reported in logs. This issue affects org.eclipse.kura:org.eclipse.kura.web2 version range [2.0.600, 2.4.0], which is included in Eclipse Kura version range [5.0.0, 5.4.1]

title: Eclipse Kura security vulnerability


archetype: ssrf

summary: The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.


product: Bannerlid

vendor: Unknown

product: bannerlid

summary: The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators

title: Web Lid Bannerlid security vulnerability


product: Red Hat Enterprise Linux 8

vendor: Red Hat

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.8 Extended Update Support

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.2 Extended Update Support

product: Red Hat Enterprise Linux 7

product: booth

vendor: clusterlabs

vendor: redhat

summary: A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.


product: Site Reviews

vendor: geminilabs

summary: The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking

title: Geminilabs Site Reviews security vulnerability


product: Z/IP Gateway SDK

summary: Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.


summary: Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway.


product: Forminator Forms – Contact Form, Payment Form & Custom Form Builder

vendor: wpmudev

product: forminator

vendor: incsub

summary: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Incsub Forminator security vulnerability


product: WPvivid — Backup, Migration & Staging

vendor: wpvividplugins

vendor: wpvivid

summary: WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

title: Wpvivid Migration, Backup, Staging security vulnerability


product: Unlimited Elements For Elementor

vendor: unitecms

vendor: unlimited-elements

summary: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Unlimited-Elements Unlimited Elements For Elementor security vulnerability


product: Red Hat Enterprise Linux 10

product: podman

product: fedora

summary: A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC resources it created are not. Those resources are tied to the IPC namespace that will not be removed until all containers using it are stopped, and one non-malicious container is holding the namespace open. The malicious container is restarted, either automatically or by attacker control, repeating the process and increasing the amount of memory consumed. With a container configured to restart always, such as `podman run --restart=always`, this can result in a memory-based denial of service of the system.

title: A flaw was found in Podman


product: FlashArray

vendor: PureStorage

summary: A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.


product: ENL Newsletter

product: enl-newsletter

summary: The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

title: Enl Newsletter Plugin Project Enl-Newsletter security vulnerability


summary: The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack


vendor: wordpress

summary: The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks


vendor: pluginus

summary: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

title: Pluginus Husky - Products Filter Professional For Woocommerce security vulnerability


product: Save as Image Plugin by Pdfcrowd

vendor: pdfcrowd

summary: The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Pdfcrowd Save As Pdf security vulnerability


product: WPB Addons for Elementor – News Ticker, Timeline, Team & More Widgets

vendor: wpbean

summary: The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Wpbean Wpb Elementor Addons security vulnerability


product: Stax Addons for Elementor

vendor: staxwp

summary: The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37541 is potentially a duplicate of this issue.

title: Staxwp Stax Addons For Elementor security vulnerability


vendor: mohsinrasool

summary: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-5447 may be a duplicate of this issue.

title: Mohsinrasool Paypal Pay Now, Buy Now, Donation And Cart Buttons Shortco… security vulnerability


product: Elegant Addons for elementor

vendor: aruphash

vendor: crafthemes

summary: The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Crafthemes Elegant Addons For Elementor security vulnerability


product: WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping

vendor: aukejomm

vendor: wpmarketingrobot

summary: The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can also be used by unauthenticated attackers to inject malicious web scripts.

title: Wpmarketingrobot Woocommerce Google Feed Manager security vulnerability


product: Custom Field Suite

summary: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Custom Field Suite Project Custom Field Suite security vulnerability


product: Last Viewed Posts by WPBeginner

vendor: jottlieb

summary: The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

title: Jottlieb Last Viewed Posts By Wpbeginner security vulnerability


product: ACF On-The-Go

vendor: amaa

product: acf-on-the-go

summary: The ACF On-The-Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the acfg_update_fields() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post titles, descriptions, and ACF values.

title: Wordpress Acf-On-The-Go security vulnerability


product: ACF Front End Editor

vendor: horiondigital

summary: The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_texts() function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post title, content, and ACF data.

title: Horiondigital Acf Front End Editor security vulnerability


product: Elementor ImageBox

vendor: flickdevs

summary: The Elementor ImageBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image box widget in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Flickdevs Elementor Imagebox security vulnerability


vendor: Unknown

summary: The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

title: Mmilan81 Mm-Email2Image security vulnerability


product: Zephyr

vendor: zephyrproject-rtos

version_type: git

product: zephyr

vendor: zephyrproject

summary: An malicious BLE device can crash BLE victim device by sending malformed gatt packet


product: Qdrant

product: qdrant

vendor: qdrant

summary: A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 is able to address this issue. The patch is named 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-258611.


product: ZenWiFi XT8

vendor: ASUS

version: earlier

product: ZenWiFi XT8 V2

vendor: asus

summary: Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.

title: Asus Zenwifi Xt8 security vulnerability


summary: Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.


product: EasyAdmin

vendor: EasyCorp

product: easyadmin

vendor: easycorp

summary: A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability.


product: Sensor Net Connect V2

vendor: Plug&Track

vendor: proges

summary: A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers (e.g., full-disk encryption) have been enabled.

title: Proges Sensor Net Connect Firmware V2 security vulnerability


summary: A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page.


product: Emergency Ambulance Hiring Portal

vendor: PHPGurukul

vendor: phpgurukul

summary: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Hire an Ambulance Page. The manipulation of the argument Patient Name/Relative Name/Relative Phone Number/City/State/Message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258677 was assigned to this vulnerability.


summary: A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258678 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as problematic was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258679.


summary: A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258680.


summary: A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. This affects an unknown part of the file /admin/forgot-password.php of the component Forgot Password Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258681 was assigned to this vulnerability.


summary: A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/manage-ambulance.php of the component Manage Ambulance Page. The manipulation of the argument del leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258682 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/add-ambulance.php of the component Add Ambulance Page. The manipulation of the argument Ambulance Reg No/Driver Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258683.


summary: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/search.php of the component Search Request Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258684.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.

title: Gitlab security vulnerability


author: Stephen M Abbott

content_markdown:
A maintainer with multi-year commit history shipped versions
5.6.0 and 5.6.1 of `xz-utils` containing a backdoor in
`liblzma`. When the library was loaded into `sshd` (via
systemd's `libsystemd` linkage), the backdoor extracted a
hidden RSA-shaped trigger from the SSH connection and granted
the attacker code execution. The vulnerability was discovered
because a microbenchmark unrelated to the backdoor showed a
half-second slowdown on SSH connections.

This is one of the closest near-misses in supply-chain
history. The backdoor shipped to a few rolling-release distros
before discovery; most stable distros never picked it up. Rechecked against
the CISA KEV JSON on 2026-08-21: CVE-2024-3094 is still not listed. The
backdoored releases remain `5.6.0` and `5.6.1`; `5.4.x` and `5.6.2+` remain
clean.

## Affected versions

- **xz-utils** 5.6.0 and 5.6.1 — vulnerable.
- **xz-utils** 5.4.6 / 5.4.x — clean.
- **xz-utils** 5.6.2+ — clean (the backdoor was reverted).

The backdoor activates only when:

- The build is run on a glibc-using x86_64 Linux system.
- The build is invoked through autotools (the malicious code is
  in the `m4/build-to-host.m4` macro from the release tarballs,
  *not* the git repo).
- The resulting `liblzma` is linked into a process that also
  loads `libsystemd` *or* matches a small set of binary
  signatures (`sshd` is the named target).

This is the most thorough attack-narrow precondition list any
single CVE has had. It still pays off if you're running an
affected distro.

## Indicator-of-exposure

The system is exposed if:

- The installed `xz-utils` (or the underlying `liblzma`) is
  5.6.0 or 5.6.1.
- The system is glibc x86_64 Linux.
- The `sshd` binary on the system loads `liblzma` (typically
  through `libsystemd`).

Quick check:

```bash
# Version
xz --version

# Does sshd load liblzma transitively?
ldd "$(which sshd)" | grep lzma
```

If the version is in range and `sshd` links `liblzma`, treat
the system as compromised — credentials, host keys, and
anything in process memory at the time of any SSH connection
are suspect.

## Remediation strategy

The fix is **all of**:

1. **Roll back** `xz-utils` to 5.4.x (or upgrade to 5.6.2+ on
   distros that ship it).
2. **Verify** the installed binary is from the distro's clean
   build. The malicious tarballs were signed; signature alone
   is not enough.
3. **Treat the host as compromised** if it ran an affected
   `sshd`:
   - Rotate every credential the host had access to (cloud
     IAM keys, deploy tokens, signed certs).
   - Rotate SSH host keys.
   - Rotate any in-memory secrets (recently-decrypted
     credentials, mTLS private keys, token caches).
   - Audit auth logs for unexplained connections during the
     exposure window.
4. **Rebuild** any artifact that was built on an affected host
   while it was affected. The backdoor allows arbitrary
   command execution; you cannot trust artifacts produced
   during the exposure window.

This is not a routine bump. The CVE narrative is a
supply-chain compromise; the response is supply-chain incident
response.

## When to use it

Use this recipe when a host, image, CI runner, appliance, container base,
package mirror, build cache, or artifact pipeline may include `xz-utils` /
`liblzma` 5.6.0 or 5.6.1. It is most important when the system is glibc x86_64,
`sshd` links `liblzma`, or artifacts were built on an affected host.

Use it to treat xz as a supply-chain incident, not a routine package bump:
roll back or upgrade to a clean distro build, classify exposure, quarantine
artifacts, and trigger credential and host-key rotation where needed. Do not
use it to auto-remediate a network-reachable affected SSH host.

## Inputs

- Host inventories, container images, base-image manifests, SBOMs, package
  locks, package-mirror state, artifact-cache state, distro advisories, package
  signatures, clean SHA references, and CI runner inventories.
- Version and linkage evidence: package-manager output, `xz --version`,
  `strings`, `ldd $(which sshd)`, glibc/x86_64 status, libsystemd linkage, and
  distro-specific affected windows.
- Exposure evidence: SSH network reachability, auth logs, affected-host timing,
  artifacts built during the window, image publication, mirror/cache
  propagation, and whether the host is multi-tenant.
- Operator-owned trust anchors: SSH host keys, deploy keys, cloud IAM keys,
  registry tokens, mTLS private keys, in-memory secrets, build credentials, and
  published artifacts.
- IR constraints for rollback, service restart, artifact rebuild,
  cache/mirror purge, credential rotation, incident paging, and clean rebuilds.

## The prompt

~~~markdown
You are remediating CVE-2024-3094 (xz-utils backdoor) on this
host or in this system image. Output exactly one of:

- A PR / change request rolling the package back, plus an
  incident-response checklist for the operator.
- A TRIAGE.md if the system is in the affected window and
  needs immediate human-led incident response.

This recipe is **not** a routine package bump. If exposure is
confirmed, do not auto-remediate; produce the incident
checklist and stop.

## Step 0 — Detect

1. Read the system's `xz-utils` / `liblzma` version (via the
   distro package manager, plus `xz --version` and
   `strings $(which xz) | grep -E '5\\.[456]'`).
2. Determine whether `sshd` on this system loads `liblzma`:
   `ldd $(which sshd) | grep lzma`.
3. Check the host's distro and version against published
   advisories (the affected window varies — Debian sid /
   Fedora 40 / Kali / openSUSE Tumbleweed all picked up the
   bad version at different times).

## Step 1 — Classify

- **Not affected:** Version is 5.4.x or ≥5.6.2; or `sshd`
  doesn't load `liblzma`. Document and stop.
- **Affected, never reachable from the network:** The host
  has affected `xz-utils` but `sshd` was firewalled-off /
  disabled / not running during the exposure window. Roll
  back the package; rotate any local secrets that were
  in-memory; document.
- **Affected, network-reachable sshd:** Treat as compromised.
  Stop here. Do not auto-remediate. Write a TRIAGE.md with
  the incident-response checklist and page the security
  on-call.

## Step 2 — Roll back the package (when classification is
"not network-reachable affected")

1. For Debian / Ubuntu rolling: `apt install xz-utils=5.4.5-*`
   (or the distro's clean-version pin). For Fedora 40:
   the distro shipped a rebuild — `dnf upgrade xz xz-libs`.
   For Arch / openSUSE Tumbleweed / Kali: follow the
   distro-specific roll-back advisory.
2. Verify the new package signature matches the distro's
   clean build.
3. Restart `sshd` (and any other process that loaded
   `liblzma`).

## Step 3 — Verify

1. `xz --version` prints a clean version.
2. `ldd $(which sshd) | grep lzma` shows the new path.
3. The host's `liblzma` SHA matches the distro's published
   clean SHA.

## Step 4 — Incident-response checklist (in the TRIAGE.md
when classification is "compromised")

The checklist must include:

- Rotate SSH host keys.
- Rotate every long-lived credential the host had access to:
  cloud IAM, registry tokens, deploy keys, mTLS private
  keys.
- Rotate any in-memory secrets that were decrypted during the
  exposure window.
- Pull the auth log and search for unexplained sessions.
- Identify and rebuild every artifact that was produced on
  this host during the exposure window.
- Report the incident through the org's IR channel.

The checklist is human-driven. The agent does not run any
of these steps.

## Stop conditions

- The system is in the "compromised" classification — write
  the checklist and stop.
- The distro's clean roll-back path is unclear and no
  upstream advisory exists for this distro. Triage.
- The host has multi-tenant exposure (shared host, multiple
  customers) — escalate before touching anything.

## Scope

- Do not roll back any package other than xz-utils / liblzma.
- Do not silently restart services without recording which.
- Do not modify SSH configuration other than as part of a
  documented IR action.
- Do not draft credential rotation actions; the IR checklist
  names them, the operator runs them.
~~~

## Verification — what the reviewer looks for

- The version verification ran and produced a clean number.
- The `ldd` check confirmed `sshd` linked the new lib.
- For compromised hosts: the IR checklist was followed
  (review the linked artefacts), not just the package
  rollback.
- The reviewer does *not* trust the agent's "not affected"
  classification without re-running the detection commands
  themselves.

## Watch for

- **Distro-specific repackages.** Some distros backported the
  fix into 5.6.x rather than rolling back. Don't assume "5.6"
  is bad without checking the distro's published clean SHA.
- **Container images built during the exposure window.** A
  container image baked from an affected base inherits the
  backdoor. Rebuild every affected image; treat the affected
  image's published copies as potentially compromised.
- **CI runners.** A self-hosted CI runner with an affected
  `xz-utils` and a publicly-reachable `sshd` is exactly the
  shape this attack targeted. Audit those first.
- **`liblzma` is not always reached through `sshd`.** Other
  binaries link `liblzma` for legitimate reasons; the
  backdoor's preconditions narrow the impact, but other CVEs
  in the future may not.
- **Reproducibility from the git repo vs. tarball.** The
  malicious code was in the release tarball but not in the
  git repository. Build provenance ("we built from git") was
  the durable check; vendor signatures alone were not.

## Output contract

Return one of:

- A reviewer-ready PR/change request that rolls back or upgrades controlled
  `xz-utils`/`liblzma` packages to a clean distro build, verifies version,
  linkage, and clean SHA evidence, identifies affected images/artifacts, and
  attaches an operator incident-response checklist.
- `TRIAGE.md` when the host is network-reachable and affected, clean rollback
  provenance is unclear, multi-tenant exposure exists, artifacts were built
  during the exposure window, or credential/host-key rotation must be led by IR.

The output must list versions, distro advisory, clean build proof, SSH linkage,
network exposure, rollback command, restart requirements, artifacts/images to
rebuild, caches/mirrors to purge, credentials and host keys to rotate, and logs
to review. It must not treat this as routine SCA, silently restart services, or
rotate production credentials outside an approved IR process.

## References

- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2024-3094>
- CVE record: <https://www.cve.org/CVERecord?id=CVE-2024-3094>
- Openwall disclosure thread: <https://www.openwall.com/lists/oss-security/2024/03/29/4>

## Related recipes

- [Artifact Cache & Mirror Quarantine]({{< relref "/security-remediation/artifact-cache-purge" >}})
  — the workflow for evicting the bad artifact from internal
  mirrors.
- [Threat Model → Agent-infrastructure supply-chain compromise]({{< relref "/fundamentals/threat-model#observed-real-world-patterns" >}})
  — why this case is treated separately from routine CVEs.
- [Base Image & Container Layer Remediation]({{< relref "/security-remediation/base-images" >}})
  — for evicting the affected version from container bases.

description: Maintainer-implanted backdoor in liblzma reachable through sshd. Roll back to 5.4.x; treat any network-exposed affected host as compromised.

maturity: stable

model: Opus 4.7

title: CVE-2024-3094 — xz-utils backdoor

product: xz

vendor: tukaani

quality: curated

recipe_kind: markdown-override

summary: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.


product: langchain-ai/langchain

vendor: langchain-ai

less_than_or_equal: latest

product: langchain

vendor: langchain

summary: A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This flaw enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from cloud environments. The vulnerability is particularly concerning as it can be exploited to abuse the Web Explorer server as a proxy for web attacks on third parties and interact with servers in the local network, including reading their response data. This could potentially lead to arbitrary code execution, depending on the nature of the local services. The vulnerability is limited to GET requests, as POST requests are not possible, but the impact on confidentiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing interactions with internal APIs.


product: PHP

vendor: PHP Group

product: php

vendor: php

vendor: debian

summary: In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

title: Php security vulnerability


product: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

vendor: smub

vendor: imagely

summary: The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.

title: Imagely Nextgen Gallery security vulnerability


vendor: run-llama

summary: A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.

title: Run-Llama Llama Index security vulnerability


product: mlflow/mlflow

vendor: mlflow

product: mlflow

vendor: lfprojects

summary: A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.


product: 100w Gen 3 Laptop (Lenovo) BIOS

vendor: Lenovo

product: 100w Gen 4 Laptop (Lenovo) BIOS

product: 13w Yoga (Type 82S1, 82S2) Laptop (Lenovo) BIOS

product: 13w Yoga Gen 2 (Type 82YR, 82YS) Laptop (Lenovo) BIOS

product: 14W Gen 2 Laptop (Lenovo) BIOS

product: 300w Gen 3 Laptop (Lenovo) BIOS

product: 300w Yoga Gen 4 Laptop (Lenovo) BIOS

product: 500w Yoga Gen 4 Laptop (Lenovo) BIOS

product: Flex 5-14ITL05 Laptop (ideapad) BIOS

product: Flex 5-15ITL05 Laptop (ideapad) BIOS

product: IdeaPad 1 14ALC7 Laptop BIOS

product: IdeaPad 1 15ALC7 Laptop BIOS

summary: A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code.

title: Lenovo 100W Gen 3 Laptop (Lenovo) Bios security vulnerability


product: mintplex-labs/anything-llm

vendor: mintplex-labs

product: anythingllm

vendor: mintplexlabs

summary: In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multi_user_mode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This action permits the creation of a new admin user without requiring a password, leading to unauthorized administrative access.

title: Mintplexlabs Anythingllm security vulnerability


summary: A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security.


summary: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.


product: Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts

vendor: themeisle

vendor: webcraftic

summary: The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server.

title: Webcraftic Woody Ad Snippets security vulnerability


product: Spectra Gutenberg Blocks – Website Builder for the Block Editor

vendor: brainstormforce

product: spectra

summary: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the server, which can contain sensitive information.

title: Brainstormforce Spectra security vulnerability


product: Phones

vendor: Motorola

version_type: SPL

summary: An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization.

title: Motorola Phones security vulnerability


summary: A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to read arbitrary files.

title: Motorola Phones security vulnerability


ecosystem: javascript/npm

summary: A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion of 'javascript:' protocol payloads in URLs, which can be exploited by a user with manager role to execute arbitrary JavaScript code in the context of another user's session. This flaw can be leveraged to steal the admin's authorization token by crafting malicious URLs that, when clicked by the admin, send the token to an attacker-controlled server. The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using either the CTRL + left mouse button click or the mouse scroll wheel click, or in some non-updated versions of modern browsers, by directly clicking on the link.


product: Interactive Content

vendor: Unknown

summary: The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues

title: H5P security vulnerability


product: Quotes and Tips by BestWebSoft

vendor: bestwebsoft

summary: The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

title: Bestwebsoft Quotes And Tips security vulnerability


product: formflow

vendor: wpxperties

vendor: devsabbirahmed

summary: The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Devsabbirahmed Simple Form security vulnerability


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.

title: Gitlab security vulnerability


summary: An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat.

title: Gitlab security vulnerability


product: pgAdmin 4

vendor: postgresql

vendor: pgadmin

product: fedora

vendor: fedoraproject

summary: pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.


product: YouDianCMS

product: youdiancms

vendor: youdiancms

summary: A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAction.class.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: CMS

vendor: Dreamer

vendor: iteachyou

summary: A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attachment Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258779. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: sngrep

vendor: irontec

summary: A buffer overflow vulnerability exists in all versions of sngrep since v0.4.2, due to improper handling of 'Call-ID' and 'X-Call-ID' SIP headers. The functions sip_get_callid and sip_get_xcallid in sip.c use the strncpy function to copy header contents into fixed-size buffers without checking the data length. This flaw allows remote attackers to execute arbitrary code or cause a denial of service (DoS) through specially crafted SIP messages.

title: Irontec Sngrep security vulnerability


summary: A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1. The flaw is due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers in the sip_validate_packet and sip_parse_extra_headers functions within src/sip.c. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via crafted SIP messages.


product: parisneo/lollms

vendor: parisneo

product: lollms

ecosystem: python/pypi

vendor: lollms

summary: A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.


product: Mobile One Time Password

vendor: CHANGING

summary: CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.

title: Changing Mobile One Time Password security vulnerability


vendor: changingtec

summary: CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.


product: parisneo/lollms-webui

summary: A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.

title: Lollms Lollms Web Ui security vulnerability


summary: An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.

title: Gitlab security vulnerability


product: Image Accordion Gallery App

vendor: SourceCodester

vendor: rems

summary: A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endpoint/add-image.php. The manipulation of the argument image_name leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258873 was assigned to this vulnerability.


platforms: Android iOS

product: eWeLink APP

vendor: CoolKIt

summary: Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app

title: Coolkit Ewelink App security vulnerability


product: Computer Laboratory Management System

summary: A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_category. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258874 is the identifier assigned to this vulnerability.


product: Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits

vendor: master-addons

summary: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35702 is likely a duplicate of this issue.

title: Master-Addons Master Addons security vulnerability


product: mudler/localai

vendor: mudler

product: localai

summary: A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's local LocalAI instance without their consent. This vulnerability enables attackers to exhaust system resources, consume credits, and fill disk space by making numerous resource-intensive API calls, such as generating images or uploading files. The vulnerability stems from the application's acceptance of simple request content-types without requiring CSRF tokens or implementing other CSRF mitigation measures. Successful exploitation does not require network access to the vulnerable LocalAI environment.

title: Mudler Localai security vulnerability


product: MasterStudy LMS WordPress Plugin – for Online Courses and Education

vendor: stylemix

vendor: stylemixthemes

summary: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

title: Stylemixthemes Masterstudy Lms security vulnerability


product: uvdesk/community-skeleton

vendor: uvdesk

product: community-skeleton

version_end_including: latest

summary: Improper Privilege Management in uvdesk/community-skeleton


product: RosarioSIS

vendor: francoisjacquet

product: rosariosis

vendor: rosariosis

summary: ** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.


summary: A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function save_users of the file /classes/Users.php?f=save. The manipulation of the argument id leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258914 is the identifier assigned to this vulnerability.


summary: A vulnerability, which was classified as problematic, was found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file /classes/Users.php?f=save. The manipulation of the argument middlename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258915.


vendor: Clavister

summary: A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-258917 was assigned to this vulnerability.


product: DedeCMS

product: dedecms

vendor: dedecms

summary: A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/makehtml_spec.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/makehtml_js_action.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258920. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_action.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtml_map.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: mintplex-labs/anything-llm

vendor: mintplex-labs

product: anythingllm

vendor: mintplexlabs

summary: A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web applications not exposed externally, and interacting with the Collector API. This interaction can lead to unauthorized actions such as arbitrary file deletion and limited Local File Inclusion (LFI), including accessing NGINX access logs which may contain sensitive information.


product: anything-llm

summary: In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.


product: Multi-Store Inventory Management System

vendor: Bdtask

product: m-store

vendor: bdtask

summary: A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown function of the file /stockmovment/stockmovment/delete/ of the component Stock Movement Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258924. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the `/request-token`, `/workspace/:slug/thread/:threadSlug/update`, `/system/remove-logo`, `/system/logo`, and collector's `/process` endpoints. These issues are due to the application's failure to properly validate user input before passing it to `prisma` functions and other critical operations. Affected versions include the latest version prior to 1.0.0.


summary: mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.


product: Red Hat OpenShift Container Platform 4.12

vendor: Red Hat

product: Red Hat OpenShift Container Platform 4.13

product: Red Hat OpenShift Container Platform 4.14

product: Red Hat OpenShift Container Platform 4.15

summary: A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.


product: Post Grid

vendor: pickplugins

summary: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Pickplugins Post Grid Combo security vulnerability


product: Chrome

vendor: Google

ecosystem: browser

product: chrome

vendor: google

summary: Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


product: fedora

vendor: fedoraproject

summary: Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


product: MHDX 1004

vendor: Intelbras

product: MHDX 1008

product: MHDX 1016

product: MHDX 5016

product: HDCVI 1008

product: HDCVI 1016

vendor: intelbras

summary: ** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user.

title: Intelbras Mhdx 1004 security vulnerability


product: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

vendor: jegtheme

vendor: wordpress

summary: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's attributes in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Jegtheme Jeg Elementor Kit security vulnerability


summary: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32721 is likely a duplicate of this issue.


product: Easy Property Listings

vendor: Unknown

vendor: realestateconnected

summary: The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

title: Realestateconnected Easy Property Listings security vulnerability


product: dotCMS core

vendor: dotCMS

version: 22.02 and after

product: dotcms

vendor: dotcms

summary: In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance. OWASP Top 10 - A01) Broken Access Control OWASP Top 10 - A04) Insecure Design

title: Dotcms security vulnerability


summary: System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure


product: mintplex-labs/anything-llm

vendor: mintplex-labs

summary: A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.

title: Mintplexlabs Anythingllm Desktop security vulnerability


product: Ocean Extra

vendor: oceanwp

summary: The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Oceanwp Ocean Extra security vulnerability


summary: Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


product: Concrete CMS

vendor: Concrete CMS

vendor: concretecms

summary: Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .

title: Concretecms Concrete Cms security vulnerability


summary: Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting.


summary: Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting.


summary: Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting


product: Hawk

vendor: TIBCO

version_type: patch

summary: Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3 allows user's Enterprise Message Service (EMS) password to be exposed outside of the hawkagent.cfg and hawkevent.cfg config files.

title: Tibco Hawk security vulnerability