Vulnerabilities

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodeAstrology Team UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode).This issue affects UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode): from n/a through 1.1.6.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: from n/a through 3.0.2.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livemesh Addons for Elementor: from n/a through 8.4.0.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax allows Stored XSS.This issue affects Elementor Addons, Widgets and Enhancements – Stax: from n/a through 1.4.4.1.

Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/drm_file: Fix pid refcounting race<br /> <br /> , Maxime Ripard<br /> , Thomas Zimmermann <br /> <br /> filp-&gt;pid is supposed to be a refcounted pointer; however, before this<br /> patch, drm_file_update_pid() only increments the refcount of a struct<br /> pid after storing a pointer to it in filp-&gt;pid and dropping the<br /> dev-&gt;filelist_mutex, making the following race possible:<br /> <br /> process A process B<br /> ========= =========<br /> begin drm_file_update_pid<br /> mutex_lock(&amp;dev-&gt;filelist_mutex)<br /> rcu_replace_pointer(filp-&gt;pid, , 1)<br /> mutex_unlock(&amp;dev-&gt;filelist_mutex)<br /> begin drm_file_update_pid<br /> mutex_lock(&amp;dev-&gt;filelist_mutex)<br /> rcu_replace_pointer(filp-&gt;pid, , 1)<br /> mutex_unlock(&amp;dev-&gt;filelist_mutex)<br /> get_pid()<br /> synchronize_rcu()<br /> put_pid() *** pid B reaches refcount 0 and is freed here ***<br /> get_pid() *** UAF ***<br /> synchronize_rcu()<br /> put_pid()<br /> <br /> As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y<br /> because it requires RCU to detect a quiescent state in code that is not<br /> explicitly calling into the scheduler.<br /> <br /> This race leads to use-after-free of a "struct pid".<br /> It is probably somewhat hard to hit because process A has to pass<br /> through a synchronize_rcu() operation while process B is between<br /> mutex_unlock() and get_pid().<br /> <br /> Fix it by ensuring that by the time a pointer to the current task&amp;#39;s pid<br /> is stored in the file, an extra reference to the pid has been taken.<br /> <br /> This fix also removes the condition for synchronize_rcu(); I think<br /> that optimization is unnecessary complexity, since in that case we<br /> would usually have bailed out on the lockless check above.

URL Redirection to Untrusted Site (&amp;#39;Open Redirect&amp;#39;) vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.

Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7.

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as &amp;#39;gpt-4-vision-preview&amp;#39;, without the victim&amp;#39;s consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.