In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering
SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.
Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network.
A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure.
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.