Leo

يوجد تجاوز في سعة المخزن المؤقت (buffer overflow) في Dawn، وهو تنفيذ لـ WebGPU، مما يسمح لمهاجم عن بُعد بتنفيذ رمز عشوائي خارج صندوق الحماية (sandbox) من خلال صفحة HTML مصممة خصيصاً.

A memory calculation bug in the `mod dav` module allows an attacker with permissions to create WebDAV locks to crash server child processes. Approximately 596.5 million instances are identified globally.

A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to visit a specially crafted HTML page. Real-world exploitation has been demonstrated using a chain of bugs to achieve a V8 sandbox escape and gain program counter control on arm64 architectures.

A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by Google Chrome. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the browser to process a specially crafted HTML page.

لا يتعرف المكون `internal-sftp` في `sshd` إلا على أول 9 معلمات لسطر الأوامر. قد يؤدي هذا القيد إلى الإخلال بخصائص الأمان إذا تم وضع معلمات تكوين مهمة بعد الموضع التاسع، وبالتالي تم تجاهلها من قبل النظام.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات Google Chrome السابقة للإصدار 147.0.7727.55 الوصف كانت هناك مشكلة «استخدام بعد التحرير» (use-after-free) في مكون V8 في Google Chrome قبل الإصدار 147.0.7727.55. يمكن للمهاجم استغلال تلف الذاكرة المؤقتة (heap) عن طريق إقناع المستخدم بتثبيت ملحق ضار. التوصيات تحديث متصفح Google Chrome إلى الإصدار 147.0.7727.55 أو أحدث.

سمحت مشكلة تتعلق بدورة حياة الكائنات في مكون DevTools في Google Chrome لمهاجم محتمل باستغلال تلف في الذاكرة المؤقتة (heap). قد يحدث هذا الاستغلال إذا تم إقناع المستخدم بتثبيت ملحق ضار. تم تصنيف خطورة هذه الثغرة الأمنية على أنها «عالية».

توجد مشكلة في التباس الأنواع في مكون V8 في Google Chrome. وقد يتيح ذلك لمهاجم عن بُعد استغلال تلف الذاكرة المؤقتة (heap) من خلال صفحة HTML مصممة خصيصًا لهذا الغرض. تم تصنيف خطورة هذه الثغرة الأمنية في Chromium على أنها «عالية».

The FluentSMTP plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the `formatResult` function. This allows unauthenticated attackers to inject a PHP object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82. Over 300,000 WordPress sites are potentially exposed to this issue.

The issue is related to PHP Object Injection via deserialization of untrusted input in the `set redirections` function. This allows authenticated attackers with Administrator-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The issue is caused by a missing capability check on the `update metadata` function, allowing unauthenticated attackers to insert new and update existing metadata beginning with `rank math`, and delete arbitrary existing user metadata and term metadata. This can lead to a loss of access to the administrator dashboard for any registered users, including Administrators.

Name of the Vulnerable Software and Affected Versions: Code Embed plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's script embed functionality due to insufficient restrictions on who can utilize the functionality. This allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Recommendations: For Code Embed plugin for WordPress versions up to, and including, 2.4: Update to the latest patched version as soon as possible to mitigate the risk of exploitation. Additionally, consider monitoring for signs of compromise.

The issue is related to time-based SQL Injection via the `order` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, which can be used to extract sensitive information from the database.