BridgeU Logo

How to Write a UCAS Personal Statement [With Examples]

maximum characters for ucas personal statement

James is senior content marketing manager at BridgeU. He writes and directs content for BridgeU's university partners and our community of international schools

What are the big challenges students should be aware of before writing their UCAS Personal Statement?

  • The essential ingredients for writing a great Personal Statement
  • How to write the UCAS Personal Statement [with examples]

Final hints & tips to help your students

Join 10,000 other counsellors & educators & get exclusive resources delivered straight to your inbox.

The UCAS Personal Statement can sometimes be a student’s only chance to impress a UK university. Read our in-depth guide to helping your students plan & write a winning application.

There are hundreds of articles out there on how to write a UCAS Personal Statement that will grab the attention of a UK university admissions officer.  

But if you’re working with students to help them perfect their Personal Statement in time for the  relevant UCAS deadlines , we can sum up the secret to success in three words.

Planning, structure and story. 

The UCAS Personal Statement is a student’s chance to talk about why they want to study for a particular degree, course or subject discipline at a UK university. 

As they set about writing a personal statement, students need to demonstrate the drive, ambition, relevant skills and notable achievements that make them a  suitable candidate for the universities they have chosen to apply to . 

But the UCAS Personal Statement requires students to write a lot about themselves in a relatively short space of time. That’s why lots of planning, a tight structure and a compelling story are essential if a student’s Personal Statement is to truly excel. 

As important deadlines for UK university applications grow closer, we at BridgeU have put together a guide, outlining some of the strategies and techniques to help your students to write a personal statement which is both engaging and truly individual.

Handpicked Related Content

Discover the simple steps that will boost the confidence of your native English speaking & ESL students alike in  University Application Essays: The 5 Secrets of Successful Writing .

As they begin to plan their Personal Statement, students may feel intimidated. It’s not easy to summarise your academic interests and personal ambitions, especially when you’re competing for a place on a course which is popular or has demanding entry requirements. In particular, students will likely come up against the following challenges.

Time pressure

Unfortunately, the Personal Statement (and other aspects of university preparation) comes during the busiest year of the student’s academic life so far.

Students, and indeed teachers and counsellors, must undertake the planning and writing of the personal statement whilst juggling other commitments, classes and deadlines, not to mention revision and open day visits!

Because there is already a lot of academic pressure on students in their final year of secondary school, finding the time and headspace for the personal statement can be hard, and can mean it gets pushed to the last minute. The risks of leaving it to the last minute are fairly obvious – the application will seem rushed and the necessary thought and planning won’t go into  making the personal statement the best it can be . 

Sticking closely to the Personal Statement format

The character limit which UCAS sets for the personal statement is very strict – up to 4,000 characters of text. This means that students have to express themselves in a clear and concise way; it’s also important that they don’t feel the need to fill the available space needlessly.  Planning and redrafting of a personal statement is essential .

Making it stand out

This is arguably the greatest challenge facing students – making sure that their statement sets them apart from everyone else who is competing for a place on any given course; in 2024 alone, UCAS received applications from 594,940 applicants. In addition, UCAS uses its own dedicated team and purpose built software to check every application for plagiarism, so it’s crucial that students craft a truly  original personal statement which is entirely their own work .

The essential ingredients for writing a great UCAS Personal Statement 

We’ve already mentioned our three watch words for writing a high quality Personal Statement.

Planning. Structure. Story. 

Let’s dig deeper into these three essential components in more detail.

Watch: How to Write a UCAS Personal Statement with University of Essex

Planning a ucas personal statement.

It might sound like a no-brainer, but it’s vital that students plan their Personal Statement before they start writing it. Specifically, the planning phase could include: 

  • Students thoroughly researching the UK university courses they plan on applying to. 
  • Deciding on what relevant material to include in their Personal Statement (we’ll cover this in more detail later on). 
  • Writing an unedited first draft where they just get their thoughts and ideas down on paper. 

Structuring a UCAS Personal Statement

As we’ve discussed, the UCAS Personal Statement requires students to be extremely disciplined – they will be required to condense a lot of information into a relatively short written statement. This means that, after they’ve written a rough first draft, they need to think carefully about how they structure the final statement. 

A stand out Personal Statement will need a tight structure, with an introduction and a conclusion that make an impact and really help to tell a story about who your student is, and why they are drawn to studying this particular degree. 

This brings us nicely to our third and final ingredient…

Telling a story with a Personal Statement

The UCAS Personal Statement is a student’s opportunity to show a university who they are and how their life experiences have shaped their academic interests and goals. 

So a good Personal Statement needs to offer a compelling narrative, and that means making sure that a student’s writing is well-structured, and that every sentence and paragraph is serving the statement’s ultimate purpose –  to convince a university that your student deserves a place on their subject of choice. 

How to help your students start their UCAS Personal Statement

In order to ensure that a personal statement is delivered on time and to an appropriate standard, it’s essential to plan thoroughly before writing it. Here are some questions you can ask your students before they start writing:

How can you demonstrate a formative interest in your subject?

It may sound obvious but, in order for any UCAS personal statement to have the necessary structure and clarity, students need to think hard about why they want to study their chosen subject. Ask them to think about their responses to the following questions:

What inspired you to study your chosen subject?

Example answer:  My desire to understand the nature of reality has inspired me to apply for Physics and Philosophy

Was there a formative moment when your perspective on this subject changed, or when you decided you wanted to study this subject in more detail?

Example answer:  My interest in philosophy was awakened when I questioned my childhood religious beliefs; reading Blackburn’s “Think”, convinced me to scrutinise my assumptions about the world, and to ensure I could justify my beliefs.

Can you point to any role models, leading thinkers, or notable literature which has in turn affected your thinking and/or inspired you?

Example answer :  The search for a theory of everything currently being conducted by physicists is of particular interest to me and in “The Grand Design” Hawking proposes a collection of string theories, dubbed M-theory, as the explanation of why the universe is the way it is.

Asking your students to think about the “why” behind their chosen subject discipline is a useful first step in helping them to organise their overall statement. Next, they need to be able to demonstrate evidence of their suitability for a course or degree. 

How have you demonstrated the skills and aptitudes necessary for your chosen course?

Encourage students to think about times where they have demonstrated the necessary skills to really stand out. It’s helpful to think about times when they have utilised these skills both inside and outside the classroom. Ask students to consider their responses to the following questions. 

Can you demonstrate critical and independent thinking around your chosen subject discipline?

Example answer :  Currently I am studying Maths and Economics in addition to Geography. Economics has been a valuable tool, providing the nuts and bolts to economic processes, and my geography has provided a spatial and temporal element.

Are you able to demonstrate skills and competencies which will be necessary for university study?

These include qualities such as teamwork, time management and the ability to organise workload responsibly.

Example answer:  This year I was selected to be captain of the 1st XV rugby team and Captain of Swimming which will allow me to further develop my leadership, teamwork and organisational skills.

How have your extracurricular activities helped prepare you for university?

Students may believe that their interests outside the classroom aren’t relevant to their university application. So encourage them to think about how their other interests can demonstrate the subject-related skills that universities are looking for in an application. Ask students to think about any of the following activities, and how they might be related back to the subject they are applying for.

  • Clubs/societies, or volunteering work which they can use to illustrate attributes such as teamwork, an interest in community service and the ability to manage their time proactively.
  • Have they been elected/nominated as a team captain, or the head of a particular club or society, which highlights leadership skills and an ability to project manage?
  • Can they point to any awards or prizes they may have won, whether it’s taking up a musical instrument, playing a sport, or participating in theatre/performing arts?
  • Have they achieved grades or qualifications as part of their extracurricular activities? These can only help to demonstrate aptitude and hard work. 

How to write the UCAS Personal Statement [with examples] 

If sufficient planning has gone into the personal statement, then your students should be ready to go!

In this next section, we’ll break down the individual components of the UCAS Personal Statement and share some useful examples.

These examples come from a Personal Statement in support of an application to study Environmental Science at a UK university. 

Watch: King’s College London explain what they’re looking for in a UCAS Personal Statement

Introduction.

This is the chance for an applying student to really grab an admission tutor’s attention. Students need to demonstrate both a personal passion for their subject, and explain why they have an aptitude for it .  This section is where students should begin to discuss any major influences or inspirations that have led them to this subject choice. 

Example :  My passion for the environment has perhaps come from the fact that I have lived in five different countries: France, England, Spain, Sweden and Costa Rica. Moving at the age of 15 from Sweden, a calm and organized country, to Costa Rica, a more diverse and slightly chaotic country, was a shock for me at first and took me out of my comfort zone […] Also, living in Costa Rica, one of the most biodiverse countries in the world, definitely helped me realize how vulnerable the world is and how we need to take care of it in a sustainable manner. 

This opening paragraph immediately grabs the reader’s attention by giving the reader an insight into this student’s background and links their academic interests with something specific from the student’s personal backstory. 

Discussing Academic Achievements 

The next paragraph in this Personal Statement discusses the student’s academic achievements. Because this student has had an international education, they frame their academic achievements in the context of their personal background. They also cite useful examples of other curricula they have studied and the grades they have achieved. 

Example : 

Throughout my academic life I have shown myself to be a responsible student as well as a hard working one, despite the fact that I have had to move around a lot. I have achieved several other accomplishments such as a high A (286/300) in AS Spanish at age 15, and also completed a Spanish course of secondary studies for ‘MEP’(Ministerio de Educacion Publica), which is a system from Costa Rica.   

You’ll notice that this student doesn’t just list their achievements – their strong academic performance is always linked back to a wider discussion of their personal experiences. 

Showcasing Extracurricular Activities

As well as discussing academic achievements, a good Personal Statement should also discuss the student’s extracurricular activities, and how they relate back to the student’s overall university aspirations. 

By the third/fourth paragraph of the Personal Statement, students should think about incorporating their extracurricular experiences, 

Another valuable experience was when my class spent a week at a beach called ‘Pacuare’ in order to help prevent the eggs of the endangered leatherback turtle from being stolen by poachers who go on to sell them like chicken eggs. We all gained teamwork experience, which was needed in order to hide the eggs silently without scaring the mother turtles, as well as making it more difficult for the poachers to find them. 

When the poachers set fire to one of the sustainable huts where we were staying, not only did I gain self-awareness about the critical situation of the world and its ecosystems, I also matured and became even more motivated to study environmental sciences at university.

This is a particularly striking example of using extracurricular activities to showcase a student’s wider passion for the degree subject they want to study. 

Not only does this Personal Statement have a story about volunteering to save an endangered species, it also illustrates this applicants’ wider worldview, and helps to explain their motivation for wanting to study Environmental Science. 

Concluding the UCAS Personal Statement

The conclusion to a UCAS Personal Statement will have to be concise, and will need to tie all of a student’s academic and extracurricular achievements. After all, a compelling story will need a great ending. 

Remember that students need to be mindful of the character limit of a Personal Statement, so a conclusion need only be the length of a small paragraph, or even a couple of sentences. 

“ After having many varied experiences, I truly think I can contribute to university in a positive way, and would love to study in England where I believe I would gain more skills and education doing a first degree than in any other country.  “

A good Personal Statement conclusion will end with an affirmation of how the student thinks they can contribute to university life, and why they believe the institution in question should accept them. Because the student in this example has a such a rich and varied international background, they also discuss the appeal of studying at university in England. 

It’s worth taking a quick look at a few other examples of how other students have chosen to conclude their Personal Statement. 

Medicine (Imperial College, London) 

Interest in Medicine aside, other enthusiasms of mine include languages, philosophy, and mythology. It is curiously fitting that in ancient Greek lore, healing was but one of the many arts Apollo presided over, alongside archery and music.   I firmly believe that a doctor should explore the world outside the field of  Medicine, and it is with such experiences that I hope to better empathise and connect with the patients I will care for in my medical career. 

You’ll notice that this example very specifically ties the students’ academic and extracurricular activities together, and ties the Personal Statement back to their values and beliefs. 

Economic History with Economics (London School of Economics)

The highlight of my extra-curricular activities has been my visit to Shanghai with the Lord Mayor’s trade delegation in September 2012. I was selected to give a speech at this world trade conference due to my interest in economic and social history. […] I particularly enjoyed the seminar format, and look forward to experiencing more of this at university. My keen interest and desire to further my knowledge of history and economics, I believe, would make the course ideal for me.

By contrast, this conclusion ties a memorable experience back to the specifics of how the student will be taught at the London School of Economics – specifically, the appeal of learning in seminar format! 

There’s no magic formula for concluding a Personal Statement. But you’ll see that what all of these examples have in common is that they tie a student’s personal and academic experiences together – and tell a university something about their aspirations for the future.

Watch: Bournemouth University explain how to structure a UCAS Personal Statement

maximum characters for ucas personal statement

Know the audience

It can be easy for students to forget that the person reading a personal statement is invariably an expert in their field. This is why an ability to convey passion and think critically about their chosen subject is essential for a personal statement to stand out. Admissions tutors will also look for students who can structure their writing (more on this below). 

Students should be themselves

Remember that many students are competing for places on a university degree against fierce competition. And don’t forget that UCAS has the means to spot plagiarism. So students need to create a truly honest and individual account of who they are, what they have achieved and, perhaps most importantly, why they are driven to study this particular subject.

Proof-read (then proof-read again!)

Time pressures mean that students can easily make mistakes with their Personal Statements. As the deadline grows closer, it’s vital that they are constantly checking and rechecking their writing and to ensure that shows them in the best possible light. 

Meanwhile, when it comes to giving feedback to students writing their Personal Statements, make sure you’re as honest and positive as possible in the days and weeks leading up to submission day. 

And make sure they remember the three key ingredients of writing a successful Personal Statement. 

Planning, structure and story! 

Book a free demo

Learn how BridgeU can help deliver better outcomes for your students and improved results for your school

maximum characters for ucas personal statement

Search suggestions update instantly to match the search query.

University of Portsmouth logo

How to write a UCAS personal statement

A student writing a personal statement on a laptop

Writing a great personal statement

Read our guide on what it is, what to include, how to start, length and what makes a good personal statement 

Once you've decided which universities and courses to apply for, completing your application is pretty simple – until it comes to how to write your UCAS personal statement.

This guide covers everything you need to know about how to write a personal statement for university. We look at what it is and how you can start your personal statement. We've also got questions to guide you and a suggested personal statement structure you can use so you know what to put in it.

If you'd like even more resources, support and UCAS personal statement examples, you can sign up to access our personal statement hub .

What is the UCAS personal statement?

How universities use your ucas personal statement, how to start a ucas personal statement.

  • Get feedback on your UCAS personal statement

The personal statement is part of your UCAS application. It's how you show your chosen universities why you'll make a great student and why they should make you an offer.

Your personal statement also helps you think about your choice of course and your reasons for applying, so you know you’ve made the right decision.

Get feedback on your personal statement

Sign up to our personal statement hub to get feedback on your draft. You'll also get access to videos, help sheets and more tips.

Sign up now

UCAS personal statement word limit

Your personal statement length can be up to 4,000 characters long. 

This may sound a lot, but it's a word limit of around 550–1000 words with spaces and only about 1 side of typed A4 paper.

You need to keep it concise and make sure it's clear and easy to read.

Applying for multiple courses

Although you can apply for up to 5 courses on your UCAS application, you can only submit 1 personal statement. So it needs to cover all your course choices.

If you really want to show your commitment to applying for different courses, we will accept a second personal statement from you to reflect your application e.g. if you are applying for Law elsewhere, but Criminology and Criminal Justice with us.

Lots of students who apply to university have achieved the basic entry requirements and many more students apply than there are places available. Admissions teams can use your UCAS personal statement to get to know you and decide why you're more suitable than other applicants.

Some universities read every personal statement and score them. Then they use them alongside your qualifications and grades to decide whether to offer you a place or interview. Other universities put less emphasis on the personal statement and use it with students who have borderline entry requirements.

Universities might refer to your personal statement again on results day if you don't get the grades you need. So a good personal statement could clinch you a uni place even if your grades aren't what you hoped for.

Starting your personal statement can seem scary when you're staring at a blank screen. But, things will seem less daunting once you start.

  • Set aside some time in a place where you're comfortable and won't be disturbed. Grab a notepad or computer.
  • Write down anything and everything that's influenced your decision to go to university and study your chosen subject. Jot down your skills and experience too.
  • Use the questions below to guide you. Don't worry about the personal statement length at this point – you can cut things out later.

When to start your UCAS personal statement

Ideally, you want to leave yourself plenty of time – a few weeks or even months – to plan and write your personal statement.

Try not to leave it to the last minute, as tempting as this may seem when you've got so many other things to think about.

Questions to guide you

Your motivation.

  • Why do you want to study at university?
  • Why do you want to study this subject?
  • How did you become interested in this subject?
  • What career do you have in mind after university?

Academic ability and potential

  • How have your current studies affected your choice?
  • What do you enjoy about your current studies?
  • What skills have you gained from your current studies?
  • How can you demonstrate you have the skills and qualities needed for the course?
  • What qualities and attributes would you bring to the course and university?

Your experience

  • What work experience (including part-time, charity and volunteer work) do you have and what have you learnt from it?
  • What positions of responsibility have you held? (For example, prefect, captain of a team or member of a committee)
  • What relevant hobbies or interests do you have and what skills have they helped you develop?
  • What transferable skills do you have, such as self motivation, team working, public speaking, problem solving and analytical thinking?

Research and reading

  • How do you keep up with current affairs or news in your chosen subject?
  • What journals or publications relevant to your chosen subject do you read?
  • Which people have influenced you, such as artists, authors, philosophers or scientists?

Now it's time to write your personal statement using your notes. It's best to draft it on a computer, and remember to save it regularly.

You can copy and paste it into your UCAS application when you're happy with it.

Personal statement structure

While there's no set template for a personal statement, you may find it useful to follow this personal statement structure when you decide what to put in your statement.

What to include in a personal statement

  • Reasons for choosing this subject(s)
  • Current studies and how these relate to your chosen subject(s)
  • Experiences and how these relate to your chosen subject(s)
  • Interests and responsibilities and how these relate to your chosen subject(s)
  • Your future after university
  • Summary including why you'll make a great student

Further tips for a good UCAS personal statement

  • Use information on university websites and the UCAS website. This often includes the skills and qualities universities are looking for in applicants
  • Ask friends, family and teachers to remind you of activities you've participated in. They might remember your successes better than you do
  • Don’t include lists in your application, like a list of all your hobbies. Focus on 1 or 2 points and talk about them in depth to show their relevance to your application
  • Explain and evidence everything. It’s easy to say you have a skill, but it's better to demonstrate it with an example of when and how you’ve used it
  • Avoid clichéd lines such as ‘I've always wanted to be a teacher’ as it says nothing about your motivations or experiences
  • If you’re applying for a joint degree or different subjects, give equal time to each area and try to find common aspects that show their similarities
  • Never lie or plagiarise another statement – you'll be caught and it could result in your application being automatically rejected
  • Proofread your personal statement by reading it out loud and ask friends, family or a teacher to check it for you

Sign up to our personal statement hub

Watch videos, get top tips and download our help sheets – that's what our personal statement hub is for. It's for you to write your story, so you can show your strengths, ideas and passion to your chosen universities.

You'll also be able send us your draft, so you can get feedback and feel confident about what you've written.

We are aware that this form may not be fully accessible. If you are experiencing technical issues which mean you cannot read the form, please contact  [email protected]  and we’ll provide a copy within 10 working days. Please also read our Website Accessibility Statement .

TEF Gold 2023

Gold rating in national assessment of teaching excellence

Our TEF Gold rating ranks Portsmouth amongst the top universities in the UK for teaching. 

Find out more

Not sure what to do?

Browse subjects, locations and universities

Popular topics

  • How to apply to university
  • Writing a personal statement
  • Tracking your application

Popular subjects

  • Mathematics

Personal statement preview

2020 Undergraduate Application

Make sure your personal statement is your own work

We'll carry out checks to verify your personal statement is your own work.

Provided it is your own work, you can use your personal statement from your application last year. If it appears to have been copied from another source, we'll inform the universities and colleges to which you have applied. They will then take the action they consider appropriate. We'll also contact you by email to tell you this has happened.

Magnam rerum magnam id nulla deserunt.

Consequatur velit officiis similique ratione molestiae fugit possimus ut fugiat voluptate vel.

Nam nihil distinctio reprehenderit nostrum nihil iusto illum non.

Aliquam quaerat cumque et quae commodi enim.

Optio tempore ad dolor voluptatem aut iusto qui quis molestiae sint eum ullam qui.

Tenetur aut quaerat eum quia quia illum sit eos illum.

Adipisci reprehenderit nam dicta dolore id fuga magnam modi corrupti.

Nobis est voluptatem esse qui voluptas aperiam omnis.

Quos veritatis reprehenderit enim et ut reprehenderit.

Veritatis tenetur a accusantium qui laudantium officia ipsum aut voluptas consequatur iste.

Quia aut voluptatem veritatis eum et.

Quisquam et et in minima voluptatibus.

Assumenda quae delectus et dolores quasi libero doloremque.

Et facere mollitia vel cupiditate optio quae incidunt sunt soluta.

Explicabo nihil alias ut possimus architecto autem molestiae quis perspiciatis dicta.

Rerum voluptatem magni molestiae.

Adipisci molestiae quasi repellat rerum rerum porro est perspiciatis voluptatibus tenetur totam .

Voluptas et nam exercitationem ut et delectus iste et sed molestias.

Mollitia eius sed voluptates quis molestiae neque.

Assumenda et reiciendis animi laboriosam quo fugit odit.

Et esse fuga eum est repellat inventore sunt.

Vel sapiente aspernatur fuga corrupti quia fugiat.

Distinctio voluptatem nihil quia quia ratione voluptatem sit.

Quam nam quae ullam nulla eaque rerum consequatur.

Delectus nemo accusantium qui sunt et sint in qui repellat sit.

Minima omnis dicta tenetur quam ab quos et totam ab unde.

Ad sunt officiis nesciunt est delectus dolores magnam eos ut omnis perspiciatis consequatur porr.

Voluptatibus sunt iste voluptatem possimus iure quidem quia numquam aut porro maiores non quibus.

Quidem totam quia quis voluptatem omnis accusamus voluptatem aut.

Iusto vitae vero iste aliquam dolor autem harum.

Quidem necessitatibus consectetur quia perspiciatis repudiandae voluptatibus ut exercitationem d.

Et quis accusantium quidem.

Rerum molestiae aut fuga.

Vitae consequuntur repudiandae autem aut nihil nostrum omnis occaecati iure quia.

Nam quia et nemo nisi.

Et distinctio praesentium facilis facere praesentium dignissimos reiciendis quasi sint repellat .

Ut vitae incidunt quod cum aspernatur assumenda voluptatibus cum sit.

Veniam sequi sunt dolor suscipit voluptas est impedit magnam quae sed pariatur facere dolores.

Nostrum eum officia tenetur sit est perferendis ut.

Aspernatur sit est enim odit blanditiis voluptate aperiam et numquam perferendis vel fugiat temp.

Repudiandae autem reprehenderit aperiam facere voluptatem asperiores voluptatem magni reiciendis.

Accusamus voluptas iusto cupiditate quia soluta et ut commodi consequatur quia.

Sunt dolores est voluptatem et totam tenetur eos et consequuntur molestiae enim sint voluptas.

Preview of personal statement

Et vero maiores unde dolores accusantium voluptate. Omnis et blanditiis voluptates autem cupiditate quod nulla beatae reprehenderit praesentium voluptas corporis qui voluptates. Assumenda eveniet autem sint et laboriosam ad facere aut quisquam et et.

Ducimus sit ut voluptas quia quas corrupti et dolorem ut repellat et dolorem est. Soluta beatae a voluptate eveniet dolores voluptatum est suscipit nihil sed nostrum fugiat. Delectus praesentium praesentium incidunt non impedit hic rerum hic laborum iste non.

Nulla aperiam tenetur corporis harum occaecati non suscipit quia mollitia corrupti est officia. Qui nihil libero aut quas debitis. Facilis blanditiis natus velit qui facilis officia.

Consectetur qui inventore tenetur expedita aut ipsum iste. Quia eius nihil aut ab non omnis magni ex id eveniet voluptate voluptatem molestias maiores. Deleniti velit esse laudantium sed corrupti laborum.

Assumenda ex ullam et at dignissimos officia et ea qui omnis accusantium. Voluptatem nihil quia excepturi a aperiam quas repudiandae ratione aliquid sed eius voluptatem quos. Quia sit omnis expedita nobis distinctio qui et hic explicabo explicabo.

Cupiditate repudiandae non molestias qui. Ut aut inventore alias dolores alias iure modi sunt esse fugit. Optio sunt cum in minus possimus dolor sit vel eaque occaecati qui aperiam.

Adipisci et est architecto porro. Laborum et reprehenderit mollitia deserunt. Modi sint ullam a occaecati inventore veniam aut nemo sunt laudantium omnis doloribus laborum.

Aperiam esse vero voluptatem dolorem maxime nihil repudiandae delectus architecto sit. Magnam atque qui voluptas cumque magni at voluptas sunt. Id et non sit aut.

Sed aspernatur praesentium exercitationem aut alias quaerat repudiandae ab tempora. Dolorum ipsam pariatur qui placeat nesciunt dolorem rem et officia. Magni quia ipsum aut repellendus.

Aliquid adipisci voluptas nam eos rerum quibusdam ab. Illo odio vel earum qui non earum delectus ab rem necessitatibus repellat ea. Et ut suscipit asperiores eos voluptatem quia animi repellendus commodi et eum ipsum.

Possimus nam nemo reprehenderit corrupti beatae nostrum eligendi. Quis deleniti illo aut debitis. Exercitationem omnis animi at et autem ut.

Maxime id in fuga perferendis fugiat. Nemo impedit enim est architecto suscipit quaerat perferendis. Ex vel sit iure esse.

Et id repellendus deleniti beatae laboriosam omnis quos adipisci consequatur. Libero earum possimus rerum eum sunt placeat vitae et reprehenderit. Impedit vitae quod eum ab atque veniam assumenda voluptatibus.

Quo perferendis magnam vitae temporibus est quaerat. Modi totam est commodi praesentium perspiciatis laboriosam est rerum officiis quisquam id. Itaque quis rerum voluptatem.

Assumenda rerum facilis non qui veritatis et rerum rerum quibusdam qui id ut at error. Minima perspiciatis eveniet doloremque veritatis. Temporibus ducimus provident cumque dolorem.

Qui sit a dolorem natus eum et delectus nisi eos voluptas dolorem itaque quibusdam omnis. Alias qui sunt aut voluptatem libero deserunt cumque sed. Vero aut dolorem est ea voluptatem consequatur non et.

Et aliquid velit animi. Quia modi doloribus dolorum. Nulla rerum dolores recusandae eveniet.

Quibusdam sint eveniet error ut fuga voluptatem nihil reprehenderit quo. In excepturi libero nulla quia. Deleniti consectetur quaerat et quas rem sunt.

Quas dolore quaerat illo ea excepturi rerum blanditiis possimus et delectus et veritatis amet. Est beatae qui vitae enim vel tempora autem officiis. Quo ut assumenda exercitationem recusandae voluptatem esse occaecati.

Ipsa nihil est occaecati odit autem dolores molestias ex rem tempora sunt possimus sequi nisi. Voluptatem repudiandae non dolores iure voluptate itaque. Eos veritatis eos voluptate sed sint.

Non dolorem at doloremque veniam est nulla repudiandae similique iste nobis ratione eos. Accusamus vel animi animi neque. Sed voluptatibus eligendi eos et incidunt magnam deserunt voluptatibus qui.

Sint sit odio culpa tempora dolor autem est ipsum sed autem qui qui fugit quasi. Minima incidunt atque placeat repellat quo atque quidem et suscipit id. Dolores voluptatem amet et omnis fugit animi alias dolorem dolores eum.

Nam molestiae quia aut consequuntur saepe numquam magni qui magni ducimus. Necessitatibus est omnis minima numquam voluptate quia in veritatis optio qui quia rem. Sit et pariatur vero ea laborum distinctio officia possimus qui sit dolor assumenda repellendus.

Voluptatem exercitationem in facilis autem delectus dolor suscipit reprehenderit velit possimus hic labore. Quasi eius incidunt aut modi nostrum fugit. Molestiae accusamus sit voluptas et ipsum.

Odit consequatur perspiciatis aut fugiat quia beatae sit est adipisci voluptatibus est officiis. Voluptatem unde eos aut qui nostrum est consequatur quibusdam dolorem. Est fugiat qui debitis quibusdam magnam cum ipsum distinctio amet facere ut iure.

Est dolorem dolor et voluptas dolores cupiditate et dolores atque. Sint qui quis sit. Dignissimos itaque ut laborum et error nesciunt omnis consequatur voluptatem recusandae ea.

Atque aut sit ratione ea eligendi ut nisi quod et dicta. Impedit magnam aperiam iste ea eum ex. Et magni fugiat ratione ea id illum harum corporis laboriosam quae cum maiores id.

Id id dolor similique perferendis quo et rerum dolores est sunt ea et possimus. Nesciunt quo occaecati ad repudiandae ad nihil. Sit nostrum ut aut aut non perferendis sunt.

At sed aliquid qui asperiores adipisci eaque possimus quidem in qui voluptatem sed sapiente. Est ipsum eos reprehenderit blanditiis sit qui aut. Minus odio et in adipisci ut velit sit.

Qui distinctio ea modi necessitatibus ut. At autem vitae vel sed ea iure sint necessitatibus id qui et. Ratione beatae eveniet eius quibusdam praesentium non et qui est.

Similique rerum asperiores aut omnis. Voluptas doloremque rerum nihil consequatur minima dolor minus eaque non rerum vitae dicta. Quos delectus pariatur eius corporis aperiam doloribus alias quis repudiandae quam illum.

Dignissimos suscipit consequuntur aliquam sint. Autem quidem inventore est doloribus ut neque. Animi aut nihil ex enim quia ut cumque fugit doloremque reiciendis commodi qui magnam.

Sunt et minus adipisci qui a ut corrupti eum voluptatem. Culpa id ut molestias et aspernatur quam. Necessitatibus iusto porro aut autem aut doloribus cum qui culpa.

Eos quia velit voluptatum iusto nemo sunt repellendus labore dignissimos et est illo accusamus. Debitis aperiam consequuntur cumque aperiam numquam nobis qui est quidem iure. Sequi repellat veritatis veniam non ut inventore perferendis iure omnis.

Repudiandae voluptatum dolor velit libero asperiores quos hic numquam ipsa modi iusto eum sequi. Vel quisquam culpa placeat incidunt dolorum harum incidunt assumenda. Sed nisi quam dolore illo corporis adipisci aliquid et exercitationem ea dolores nostrum aspernatur.

Nemo voluptatem qui commodi consequatur architecto ea sit quasi. Autem eos et nobis voluptatibus quod ut excepturi quis qui et earum dignissimos numquam. Nisi repellat hic eaque suscipit sequi deserunt qui animi odit facere.

Odio aut minima dolor quaerat molestiae. Id libero repellendus delectus nisi temporibus dolores dolorem omnis ea. Vitae corrupti dolor et nihil voluptas ut illo rem aliquid incidunt.

Vel optio excepturi nihil. Eos nihil aut modi. Perspiciatis velit enim qui nobis provident nesciunt atque quia suscipit tempore id et quis dicta.

Aut quibusdam enim excepturi non reiciendis reiciendis voluptatem non natus voluptates enim sunt. Ipsa quibusdam consectetur nulla explicabo quis accusamus recusandae voluptatem temporibus magni ea explicabo culpa. Quo minima laboriosam nemo est reprehenderit quo ipsa et natus eligendi autem nihil.

Excepturi totam blanditiis vel deleniti nisi culpa. Impedit perferendis perspiciatis minima nemo sed quaerat qui ea. Iure tempore saepe et nihil voluptatum quia repellat eum vel aliquid fugiat.

Maiores fugit quibusdam aut assumenda suscipit reprehenderit est ut eaque quisquam. Voluptas labore excepturi voluptatem ipsam at et. Fugiat quidem consequatur voluptatem.

Ea a quia enim consequatur animi quia ipsam voluptas culpa architecto et enim. Veniam quae dolor est. Consequatur officiis et porro id maxime beatae nisi esse eos inventore.

Ut beatae sint accusantium dolor quisquam et at debitis. Sed autem maiores et sit error consectetur aut rerum error voluptas corporis ex sequi. Quia aut nam autem aperiam officiis suscipit nihil doloremque hic similique.

Asperiores illum sit at consequatur aut impedit quaerat sequi aut. Facere est occaecati et consequatur magnam. Deleniti in nulla ut minus.

Autem magni id magni nostrum possimus molestiae aut aut quod eos in in. Voluptas autem voluptatem ipsa voluptas ullam molestiae debitis maxime. Ut qui dolores distinctio nisi vero provident aut consectetur.

Voluptatem occaecati et suscipit. Et laborum voluptatem quas quia quia repudiandae aspernatur est. Aperiam voluptatum rerum aut voluptatum error recusandae vero.

Laboriosam incidunt ut et et inventore sunt. Et nemo nostrum quidem voluptas eveniet maiores ad deserunt voluptas ipsam. Delectus ex vero quidem nihil eos non blanditiis voluptatem maiores dolor.

My Application example pages

  • Centre link – Buzzword, school or college
  • Centre link – Buzzword, terms and conditions
  • Centre link – Buzzword
  • Centre link – Buzzword, confirm school
  • Centre link – Centre preferences
  • Centre link – Wrong school
  • Choose & Send – Choices
  • Choose & Send – Overview 01
  • Choose & Send – Overview 02
  • Choose & Send – Contact details
  • Choose & Send – Course cards
  • Choose & Send – Education
  • Choose & Send – Education – Add qualification
  • Choose & Send – Education – Add qualification details
  • Choose & Send – Education – Add qualification with modules
  • Choose & Send – Education – Add qualification with modules 02
  • Independent reference – sign in
  • Independent reference – accept/decline
  • Independent reference – predicted grades
  • Independent reference – reference
  • Independent reference – thank you
  • Choose & Send – Personal details
  • Choose & Send – Personal statement – preview
  • Choose & Send – Personal statement
  • Receive & Review – Overview
  • Receive & Review – Substitute choice 01
  • Receive & Review – Substitute choice 02
  • Receive & Review – Withdraw choice
  • Receive & Review – Personal statement
  • Receive & Review – Application details
  • Receive & Review – Personal details
  • Receive & Review – Contact details
  • Receive & Review – Education
  • Receive & Review – Work experience
  • Receive & Review – Nationality
  • Receive & Review – Supporting information
  • Receive & Review – English skills
  • Receive & Review – Diversity and inclusion
  • Receive & Review – Finance and funding
  • Receive & Review – Letters
  • Receive & Review – View all updates
  • Receive & Review – Visa
  • Receive & Review – VARIANTS Application status
  • Receive & Review – Overview Extra
  • Receive & Review – Confirm your choices 01
  • Receive & Review – Confirm your choices 02
  • Receive & Review – Confirm your choices 03
  • Receive & Review – Overview Confirmed Choices
  • Receive & Review – Decline all offers
  • Receive & Review – Edit Contact details
  • Receive & Review – Embargo Overview
  • Receive & Review – Withdraw your application
  • Receive & Review – Add choice
  • Receive & Review – Decline place
  • Receive & Review – Referee details
  • Receive & Review – No reference
  • Receive & Review – Centre provided reference
  • Receive & Review – Confirm your choice (one option)
  • Receive & Review – Correspondence example
  • Choose & Send – References
  • Choose & Send – Residency and nationality
  • Similarity report
  • Choose & Send – Submit – Check your application
  • Choose & Send – Submit – Marketing preferences
  • Choose & Send – Submit – Terms and Conditions
  • Choose & Send – Submit – Pay and submit (Applicant)
  • Choose & Send – Submit – Pay and submit (Applicant or centre)
  • Choose & Send – Submit – Thank you
  • Choose & Send – Submit – Read only
  • Choose & Send – Submit – Payment unsuccessful
  • Choose & Send – Submit – Pay and submit (pay for full application)
  • Choose & Send – Supporting information
  • Choose & Send – UC Submit – Add choice
  • Choose & Send – UC Submit – Pay and submit
  • Choose & Send – UCAS Application Overview
  • Choose & Send – Work experience

UCAS Personal Statement Length Checker

Please note: The line count may differ than the number of lines in the textbox above but when copy and pasted will match the line count on the UCAS application.

UCAS Personal Statement Requirements

  • No longer than 4000 characters.
  • No longer than 47 lines.
  • Each line can be no longer than 94 characters. (Our character counter above already has a max line length of 94 characters unless otherwise noted.)
  • Characters include spaces, carriage returns, and punctuation.

To see additional features including word count, paragraph count, space count and more use the character counter on our home page.

How to write your UCAS personal statement

The UCAS personal statement scares most high school students. Writing a perfect personal statement is a strenuous and unavoidable process. With roughly about 6 million university applications each year, officials need a method for filtering stronger applicants from everyone else.

As challenging as this task may appear, it is also your only chance to share your personality and eligibility for the degree program you have chosen. Follow our practices given, and you can absolutely make your personal statement up to the mark.

Start with a plan

Each year thousands of applications are received for the best degrees in the world and are best focused on the goal of making their application stand out from the rest.

Thus, planning out what you want to say prior to writing your UCAS statement makes it easy to write a convincing personal statement. Start off by making a rough draft, answering some questions like

  • What subjects do you want to study?
  • Why have you particularly chosen this path for yourself?
  • What makes you think that you are best suited to study this degree program at the college?

Some of these points will form the backbone of your personal statement, so write them in a manner that makes sense to you.

Sometimes you want to create simple bullet points or use mind maps. No matter what you decide; your goal is the same. You want to clarify why the university should provide you with a spot.

Bigger Picture of the Degree

Talk about the course that you have applied to. How did you learn about it in the first place? What means did you use to deepen your interest and knowledge in this area?

It would be a huge plus to list the books you read and the meetings you have attended regarding the subject.

Please elaborate on your academic attitude towards the degree. What are your goals after graduating? What role will it play in helping you achieve your greatest ambitions? What sort of vocation plans do you have after graduation?

Write about your work experience and achievements

Your previous achievements are an essential part of your personal statement. Think about all the accolades you have received and the contests you have participated in. These can be in-school, national or international. Both academic and sports awards can greatly help emphasize your commitment.

Write about the important skills and experiences acquired elsewhere (such as hobbies) that can be chained to the degree of your choice.

Remember, you are searching for experience that shows why you need to study the subject that you have chosen. You are not just writing an essay about what you are doing in your high school syllabus.

Extracurricular Activities

Your extracurriculars ought to likewise be included in the personal statement. Whether it be a MUN or a cross country race, they pass on the message that you love participating in different events.

Likewise, it is really smart to discuss any expertise you have acquired through extracurriculars.

Discuss any leadership roles you could have held, as they improve your capacity to appreciate people on a profound level and put you across as a pioneer.

Community service is a plus in the UCAS statement as it shows a promise to a reason bigger than oneself.

You can link all these activities to your selected course in the best case. Be careful not to elaborate too much on extracurricular activities.

UCAS Character Count

There are some specific instructions for your personal statement that you can never ignore.

First, it must not exceed 4,000 characters or 47 lines of text (including blank lines), whichever comes first. If you do exceed this, the university will not get your entire statement.

So make sure your personal statement has a solid and decisive ending. It will look bad if you cut it off in the middle of a sentence after realizing that you have exceeded the text limit.

Instead, give each section proper attention, time, and character to plan your essay thoroughly.

However, while you are getting everything rolling, you ought to overlook these restrictions.

Tips for reducing the character count

From the get-go, you simply need to jot down all that you feel is significant. You will probably wind up with something very lengthy, but that is okay.

This is where you get to do some polishing and trimming. Maintain the focal point of your piece on the course you are applying for, why you want to do it and for what reason you are impeccably fit for it.

Glance through what you have composed until now - do you have the right balance? Cut off whatever continues a little to far, as you want to keep each point crisp and concise.

It is a difficult process to try to keep as much content as possible while keeping the character count low, so here are some simple ways to make it easier for you.

Avoid quotes

Read your personal statement and eliminate platitudes if there are any - for instance, 'I've wanted to study psychology since I was young'…The same goes for the quotations: except if they increase the value of your statement (which they don't most of the time!), it is really the best practice to remove them.

Make sure everything is concise

For each sentence in your piece, use the "so what?" rule. Does this sentence appear to be more reasonable for the course? If not, cutting it is best. This frequently happens when individuals write too much about their extracurriculars in a frantic endeavour to fit everything in. For extra analysis, feel free to use our sentence counter to calculate the average length of your sentences.

Colleges, notwithstanding, need to see a reflection and what you have extracted from your encounters; this implies it is normally better to simply discuss a few extracurriculars than to list many things that the reader is likely to skim.

Also, note that you don't have to use hospital or volunteer location names. This further allows you to remove the last few characters from the count.

Use colour coding

An easy way to see where you are losing most of your characters is to highlight the sections of your statement with different colours.

Check your language

We frequently invest a great deal of energy looking up big words with the expectation that it will make our work impressive. However, this isn't generally the best practice. It is, in many cases, best to cut these words for fundamental and engaging sentences.

I hope the process will now be transparent, and it will be more exciting for you as you embark on your writing.

How to use our UCAS personal statement checker

To use our tool simply copy and paste your personal statement into the text-box above.

At the top, you will see two metrics displayed. The first metric on the left is the total characters you've typed out of the limit of 4,000 characters.

The second metric on the right is the number of lines your text contains out of the max of 47 lines. The UCAS allows a maximum of 94 characters per line, which our line count feature already takes into consideration.

To make it easier you can click the green "copy text" button to copy the text in the text box. You can also click the red "clear text" button to delete all the text in the text-box.

Why use an online UCAS personal statement checker?

Reason number one: The character count feature in Microsoft Word will not give you an accurate reading. The reason is that Word does not count the carriage return (also known as the enter key) as a character while UCAS does count it as a character.

The problem is that this will cause Word to underestimate the character count. This could cause your essay not to be able to submit when you try to upload it. If anything it would be better to overestimate the word count on Word that way it will fit.

Our personal statement checker however will give you the same character count as UCAS unlike the Microsoft Word character count.

It can be helpful to see the character count in real-time as you are typing your personal statement. This way you are constantly reminded of how long your essay is.

If you are not paying attention it can be easy to lose track of how long your essay is and go over the limit.

Our tool makes it easier to be aware of the length and easy to cut back if necessary.

How many characters in a personal statement?

UCAS requires 4,000 characters in their personal statement. Use our personal statement checker above to see if your essay meets the requirements.

How many words in a UCAS personal statement

UCAS has a character limit of 4,000 characters. This equates to about 615 to 800 words.

How many words is 4000 characters?

4,000 characters is about 615 to 800 words. For more Characters to Words conversions, check out our Characters To Words Converter .

Does the personal statement character limit include spaces?

Yes, it does include spaces as well as carriage returns. Check your statement with our personal statement checker above.

Thanks for using our UCAS personal statement checker!

We appreciate you taking the time to check your personal statement using our webpage. As you know, this is a very important college application essay to get into British universities. UCAS stands for Universities and Colleges Admissions Service and is what the UK uses for the college application process. Good luck on your personal statement!

The University Guys

UCAS Personal Statement and Examples

What is the ucas personal statement .

The Universities and Colleges Admissions Service (UCAS) Personal Statement is the main essay for your application to colleges and universities in Great Britain. UCAS gives a nice explanation here , but in short, this is your chance to stand out against the crowd and show your knowledge and enthusiasm for your chosen area of study.

You’ve got 4,000 characters and 47 line limit to show colleges what (ideally) gets you out of bed in the morning. How long is that, really? Use your “word count” tool in Google or Word docs to check as you go along, but 4,000 characters is roughly 500 words or one page.

HOW IS THE UCAS PERSONAL STATEMENT DIFFERENT FROM THE US PERSONAL STATEMENT?

Think they’re the same? Think again. Here are some key differences between the UCAS and the US Personal Statement:

When you apply to UK schools, you’re applying to one particular degree program, which you’ll study for all, or almost all, your time at university. Your UCAS personal statement should focus less on cool/fun/quirky aspects of yourself and more on how you’ve prepared for your particular area of study.

The UCAS Personal Statement will be read by someone looking for proof that you are academically capable of studying that subject for your entire degree. In some cases, it might be an actual professor reading your essay.

You’ll only write one personal statement, which will be sent to all the universities you’re applying to, and it’s unlikely you’ll be sending any additional (supplemental) essays. Your essay needs to explain why you enjoy and are good at this subject, without reference to any particular university or type of university.

Any extracurricular activities that are NOT connected to the subject you’re applying for are mostly irrelevant, unless they illustrate relevant points about your study skills or attributes: for example, having a job outside of school shows time-management and people skills, or leading a sports team shows leadership and responsibility.

Your personal statement will mostly focus on what you’ve done at high school, in class, and often in preparation for external exams. 80-90% of the content will be academic in nature.

A QUICK STEP-BY-STEP GUIDE TO WRITING THE UCAS PERSONAL STATEMENT

This may be obvious, but the first step to a great UCAS Personal Statement is to choose the subject you’re applying for. This choice will be consistent across the (up to) five course choices you have. Often, when students struggle with a UCAS personal statement, it’s because they are trying to make the statement work for a couple of different subjects. With a clear focus on one subject, the essay can do the job it is supposed to do. Keep in mind you’re limited to 47 lines or 4000 characters, so this has to be concise and make efficient use of words.

To work out what information to include, my favourite brainstorming activity is the ‘Courtroom Exercise’. Here’s how it works:

The Courtroom Exercise

Imagine you’re prosecuting a case in court, and the case is that should be admitted to a university to study the subject you’ve chosen. You have to present your case to the judge, in a 47 line or 4,000 character statement. The judge won’t accept platitudes or points made without evidence–she needs to see evidence. What examples will you present in your statement?

In a good statement, you’ll make an opening and a closing point.

To open your argument, can you sum up in one sentence why you wish to study this subject? Can you remember where your interest in that subject began? Do you have a story to tell that will engage the reader about your interest in that subject?

Next, you’ll present a number of pieces of evidence, laying out in detail why you’re a good match for this subject. What activities have you done that prove you can study this subject at university?

Most likely, you’ll start with a class you took, a project you worked on, an internship you had, or a relevant extra-curricular activity you enjoyed. For each activity you discuss, structure a paragraph on each using the ABC approach:

A: What is the A ctivity?

B: How did it B enefit you as a potential student for this degree course?

C: Link the benefit to the skills needed to be successful on this C ourse.

With three or four paragraphs like these, each of about 9 or 10 lines, and you should have the bulk of your statement done. Typically two of these will be about classes you have taken at school, and two about relevant activities outside of school.

In the last paragraph, you need to demonstrate wider skills that you have, which you can probably do from your extracurricular activities. How could you demonstrate your time management, your ability to collaborate, or your creativity? Briefly list a few extracurricular activities you’ve taken part in and identify the relevant skills that are transferable to university study.

Finally, close your argument in a way that doesn’t repeat what you’ve already shared. Case closed!

FREQUENTLY ASKED QUESTIONS

What if I’m not sure what I want to study? Should I still apply? 

There are a number of broader programs available at UK universities (sometimes called Liberal Arts or Flexible Combined Honours). However,  you should still showcase two or three academic areas of interest. If you are looking for a broader range of subjects to study and can’t choose one, then the UK might not be the best fit for you.

What if I haven’t done much, academically or via extracurriculars, to demonstrate that I’ll be able to complete the coursework for my degree? Should I still apply?

You certainly can, but you will need to be realistic about the strength of your application as a result. The most selective universities will want to see this evidence, but less selective ones will be more willing to account for your potential to grow in addition to what you’ve already achieved. You could also consider applying for a Foundation course or a ‘Year 0’ course, where you have an additional year pre-university to enable you to develop this range of evidence.

If I’m not accepted into a particular major, can I be accepted into a different major?

It’s important to understand that we are not talking about a ‘major,’ as what you are accepted into is one entire course of study. Some universities may make you an ‘alternative offer’ for a similar but perhaps less popular course (for example you applied for Business but instead they offer you a place for Business with a Language).At others, you can indicate post-application that you would like to be considered for related courses. However, it’s not going to be possible to switch between two completely unrelated academic areas.

What other information is included in my application? Will they see my extracurricular activities, for example? Is there an Additional Information section where I can include more context on what I’ve done in high school?

The application is very brief: the personal statement is where you put all the information. UCAS does not include an activities section or space for any other writing. The 47 lines are all you have. Some universities might accept information if there are particularly important extenuating circumstances that must be conveyed. This can be done via email, but typically, they don’t want to see more than the UCAS statement and your school’s reference provides.

Now, let’s take a look at some of my favourite UCAS personal statement examples with some analysis of why I think these are great.

UCAS PERSONAL STATEMENT EXAMPLE FOR CHEMISTRY

When I was ten, I saw a documentary on Chemistry that really fascinated me. Narrated by British theoretical physicist Jim Al-Khalili, it explained how the first elements were discovered and how Chemistry was born out of alchemy. I became fascinated with Chemistry and have remained so ever since. I love the subject because it has very theoretical components, for example quantum Chemistry, while also having huge practical applications.

In this introduction, the student shows where his interest in Chemistry comes from. Adding some additional academic detail (in this case, the name of the scientist) helps guide the reader into more specific information on why this subject is interesting to him.

This aspect of Chemistry is important to me. I have, for example, used machine learning to differentiate between approved and experimental drugs. On the first run, using drug molecules from the website Drug Bank, I calculated some molecular descriptors for them. I started with a simple logistic regression model and was shocked to find that it had apparently classified almost all molecules correctly. This result couldn’t be right; it took me nearly a month to find the error. I accidentally normalized the molecular-descriptor data individually, rather than as a combined data set, thereby encoding the label into the input. On a second run, after fixing the error, I used real machine learning libraries. Here I actually got some performance with my new algorithm, which I could compare to professional researchers’ papers. The highest accuracy I ever saw on my screen was 86 percent. The researchers’ result was 85 percent; thanks to more modern machine learning methods, I narrowly beat them. I have also studied Mathematics and Physics at A Level and have been able to dive into areas beyond the A Level syllabus such as complex integration in math and the Schrödinger equation in Physics.

This paragraph outlines a clear case for this student’s aptitude for and interest in Chemistry. He explains in detail how he has explored his intended major, using academic terminology to show us he has studied the subject deeply. Knowing an admissions reader is looking for evidence that this student has a talent for Chemistry, this paragraph gives them the evidence they need to admit him.

Additionally, I have worked on an undergraduate computer science course on MIT Opencourseware, but found that the content followed fixed rules and did not require creativity. At the time I was interested in neural networks and listened to lectures by professor Geoffrey Hinton who serendipitously mentioned his students testing his techniques on ‘Kaggle Competitions’. I quickly got interested and decided to compete on this platform. Kaggle allowed me to measure my machine learning skills against competitors with PhDs or who are professional data scientists at large corporations. With this kind of competition naturally I did not win any prizes, but I worked with the same tools and saw how others gradually perfected a script, something which has helped my A Level studies immensely.

Introducing a new topic, the student again uses academic terminology to show how he has gone beyond the confines of his curriculum to explore the subject at a higher level. In this paragraph, he demonstrates that he has studied university-level Chemistry. Again, this helps the reader to see that this student is capable of studying for a Chemistry degree.

I have been keen to engage in activities beyond the classroom. For example, I have taken part in a range of extracurricular activities, including ballroom dancing, public speaking, trumpet, spoken Mandarin, and tennis, achieving a LAMDA distinction at level four for my public speaking. I have also participated in Kaggle competitions, as I’m extremely interested in machine learning. For example, I have used neural networks to determine the causes of Amazon deforestation from satellite pictures in the ‘Planet: Understanding the Amazon from Space’ competition. I believe that having worked on projects spanning several weeks or even months has allowed me to build a stamina that will be extremely useful when studying at university.

This penultimate paragraph introduces the student’s extracurricular interests, summing them up in a sentence. Those activities that can demonstrate skills that are transferable to the study of Chemistry are given a bit more explanation. The student’s descriptions in each paragraph are very detailed, with lots of specific information about awards, classes and teachers.

What I hope to gain from an undergraduate (and perhaps post-graduate) education in Chemistry is to deepen my knowledge of the subject and potentially have the ability to successfully launch a startup after university. I’m particularly interested in areas such as computational Chemistry and cheminformatics. However, I’m  open to studying other areas in Chemistry, as it is a subject that truly captivates me.

In the conclusion, the student touches on his future plans, using specific terminology that shows his knowledge of Chemistry. This also reveals that he aims to have a career in this field, which many admission readers find appealing as it demonstrates a level of commitment to the subject.

UCAS PERSONAL STATEMENT EXAMPLE FOR VETERINARY MEDICINE

This next statement has to accomplish a number of tasks, given the subject the student is applying for. As a vocational degree, applicants for veterinary medicine are committing to a career as well as a subject to study, so they need to give information demonstrating they understand the reality of a career in this area. It also needs to explain their motivation for this interest, which quite often is demonstrated through work experience (something which is often a condition for entry into these programs). Finally, as this is a highly academic subject to study at university, the author should include a good level of academic terminology and experiences in the statement.

There is nothing more fascinating to me than experiencing animals in the wild, in their natural habitat where their behaviour is about the survival of their species. I was lucky enough to experience this when in Tanzania. While observing animals hunting, I became intrigued by their musculature and inspired to work alongside these animals to help them when they are sick, as a veterinarian.

In an efficient way, the applicant explains her motivation to become a vet, then squeezes in a bit of information about her experience with animals.

As a horse rider and owner for nearly ten years, I have sought opportunities to learn as much as I can about caring for the animal. I helped around the yard with grooming and exercise, bringing horses in and out from the fields, putting on rugs, and mucking out. I have also been working at a small animal vet clinic every other Saturday for over 2.5 years. There, my responsibilities include restocking and sterilising equipment, watching procedures, and helping in consultations. Exposure to different cases has expanded my knowledge of various aspects, such as assisting with an emergency caesarean procedure. Due to a lack of staff on a Saturday, I was put in charge of anaesthesia while the puppies were being revived. I took on this task without hesitation and recorded heart and respiration rate, capillary refill time, and gum colour every five minutes. Other placements following an equine vet, working on a polo farm, and volunteering at a swan sanctuary have also broadened my experience with different species and how each possesses various requirements. During pre-vet summer courses, I was also introduced to farm animals such as pigs, cows, sheep and chicken. I spend some time milking dairy cows and removing clustered dust from chicken feet, as well as tipping sheep in order to inspect their teats.

In this paragraph, she synthesizes personal experience with an academic understanding of vet medicine. She demonstrates that she is committed to animals (helping in the yard, regular Saturday work, assistance with procedures), that she has gained a variety of experiences, and that she understands some of the conditions (caesareans, clustered dust) that vets have to deal with. Note that she also briefly discusses ‘pre-vet summer courses,’ adding credibility to her level of experience.

I have focused on HL Biology and HL Chemistry for my IB Diploma. I was particularly excited to study cell biology and body systems because these subjects allowed me to comprehend how the body works and are applicable to animal body functions. Topics like DNA replication as well as cell transcription and translation have helped me form a fundamental understanding of genetics and protein synthesis, both important topics when looking into hereditary diseases in animals. Learning about chemical reactions made me consider the importance of pharmaceutical aspects of veterinary medicine, such as the production of effective medicine. Vaccines are essential and by learning about the chemical reactions, I f developed a more nuanced understanding about how they are made and work.

Now, the statement turns to academic matters, linking her IB subjects to the university studies she aspires to. She draws out one particular example that makes a clear link between school and university-level study.

I have also written my Extended Essay discussing the consequences of breeding laws in the UK and South Australia in relation to the development of genetic abnormalities in pugs and German shepherds. This topic is important, as the growing brachycephalic aesthetic of pugs is causing them to suffer throughout their lifetime. Pedigree dogs, such as the German shepherd, have a very small gene pool and as a result, hereditary diseases can develop. This becomes an ethical discussion, because allowing German shepherds to suffer is not moral; however, as a breed, they aid the police and thus serve society.

The IB Extended Essay (like an A Level EPQ or a Capstone project) is a great topic to discuss in a personal statement, as these activities are designed to allow students to explore subjects in greater detail.

The first sentence here is a great example of what getting more specific looks like because it engages more directly with what the student is actually writing about in this particular paragraph then it extrapolates a more general point of advice from those specificities.

By choosing to write her Extended Essay on a topic of relevance to veterinary medicine, she has given herself the opportunity to show the varied aspects of veterinary science. This paragraph proves to the reader that this student is capable and motivated to study veterinary medicine.

I have learned that being a veterinarian requires diagnostic skills as well as excellent communication and leadership skills. I understand the importance and ethics of euthanasia decisions, and the sensitivity around discussing it withanimal owners. I have developed teamwork and leadership skills when playing varsity football and basketball for four years. My communication skills have expanded through being a Model U.N. and Global Issues Network member.

This small paragraph on her extracurricular activities links them clearly to her intended area of study, both in terms of related content and necessary skills. From this, the reader gains the impression that this student has a wide range of relevant interests.

When I attend university, I not only hope to become a veterinarian, but also a leader in the field. I would like to research different aspects of veterinary medicine, such as diseases. As a vet, I would like to help work towards the One Health goal; allowing the maintenance of public health security. This affects vets because we are the ones working closely with animals every day.

In the conclusion, she ties things together and looks ahead to her career. By introducing the concept of ‘One Health’, she also shows once again her knowledge of the field she is applying to.

UCAS PERSONAL STATEMENT EXAMPLE FOR AERONAUTICAL ENGINEERING

Standing inside a wind tunnel is not something every 17 year old aspires to, but for me the opportunity to do so last year confirmed my long-held desire to become a mechanical engineer.

This introduction is efficient and provides a clear direction for the personal statement. Though it might seem that it should be more detailed, for a student applying to study a course that requires limited extended writing, being this matter-of-fact works fine.

I enjoy the challenge of using the laws of Physics, complemented with Mathematical backing, in the context of everyday life, which helps me to visualise and understand where different topics can be applied. I explored the field of aeronautics, specifically in my work experience with Emirates Aviation University. I explored how engineers apply basic concepts of air resistance and drag when I had the opportunity to experiment with the wind tunnel, which allowed me to identify how different wing shapes behave at diverse air pressures. My interest with robotics has led me to take up a year-long internship with MakersBuilders, where I had the chance to explore physics and maths on a different plane. During my internship I educated young teenagers on a more fundamental stage of building and programming, in particular when we worked on building a small robot and programmed the infra-red sensor in order to create self-sufficient movement. This exposure allowed me to improve my communication and interpersonal skills.

In this paragraph, the student adds evidence to the initial assertion that he enjoys seeing how Physics relates to everyday life. The descriptions of the work experiences he has had not only show his commitment to the subject, but also enable him to bring in some academic content to demonstrate his understanding of engineering and aeronautics.

I’m interested in the mechanics side of Maths such as circular motion and projectiles; even Pure Maths has allowed me to easily see patterns when working and solving problems in Computer Science. During my A Level Maths and Further Maths, I have particularly enjoyed working with partial fractions as they show how reverse methodology can be used to solve addition of fractions, which ranges from simple addition to complex kinematics. ­­­Pure Maths has also enabled me to better understand how 3D modelling works with ­­­the use of volumes of revolution, especially when I learned how to apply the calculations to basic objects like calculating the amount of water in a bottle or the volume of a pencil.

This paragraph brings in the academic content at school, which is important when applying for a subject such as engineering. This is because the admissions reader needs to be reassured that the student has covered the necessary foundational content to be able to cope with Year 1 of this course.

In my Drone Club I have been able to apply several methods of wing formation, such as the number of blades used during a UAS flight. Drones can be used for purposes such as in Air-sea Rescue or transporting food to low income countries. I have taken on the responsibility of leading and sharing my skills with others, particularly in the Drone Club where I gained the certification to fly drones. In coding club, I participated in the global Google Code competition related to complex, real-life coding, such as a program that allows phones to send commands to another device using Bluetooth. My Cambridge summer course on math and engineering included the origins of a few of the most important equations and ideologies from many mathematicians such as, E=mc2 from Einstein, I also got a head start at understanding matrices and their importance in kinematics. Last summer, I completed a course at UT Dallas on Artificial Intelligence and Machine Learning. The course was intuitive and allowed me to understand a different perspective of how robots and AI will replace humans to do complex and labour-intensive activities, customer service, driverless cars and technical support.

In this section, he demonstrates his commitment to the subject through a detailed list of extracurricular activities, all linked to engineering and aeronautics. The detail he gives about each one links to the knowledge and skills needed to succeed in these subjects at university.

I have represented Model UN as a delegate and enjoyed working with others to solve problems. For my Duke of Edinburgh Award, I partook in several activities such as trekking and playing the drums. I enjoy music and I have reached grade 3 for percussion. I have also participated in a range of charitable activities, which include assisting during Ramadan and undertaking fun-runs to raise money for cancer research.

As with the introduction, this is an efficient use of language, sharing a range of activities, each of which has taught him useful skills. The conclusion that follows is similarly efficient and to the point.

I believe that engineering is a discipline that will offer me a chance to make a tangible difference in the world, and I am certain I will enjoy the process of integrating technology with our everyday life.

UCAS PERSONAL STATEMENT EXAMPLE FOR ECONOMICS AND SOCIAL POLICY

Applying for a joint honours course presents a particular challenge of making the case that you are interested in the first subject, the second subject and (often overlooked) the combination of the two. In this example, the applicant uses her own academic studies and personal experiences to make her case.

I usually spend my summer breaks in Uttar Pradesh, India working at my grandparents’ NGO which produces bio-fertilizers for the poor. While working, I speak to many of the villagers in the nearby villages like Barokhar and Dharampur and have found out about the various initiatives the Government has taken to improve the production of wheat and rice. I understand the hardships they undergo and speaking to them has shown me the importance of Social Policy and the role the government plays in improving the lives of people and inspired me to pursue my university studies in this field.

In the introduction, this applicant explains where her interlinking experiences come from: she has personal experiences demonstrating how economics impacts the most vulnerable in society. In doing so, she shows the admissions reader that she has a deep interest in this combination and can move on to discussing each subject in turn.

My interest in these areas has been driven by the experiences I had at high school and beyond. I started attending Model United Nations in the 9th grade and have been to many conferences, discussing problems like the water crisis and a lack of sustainability in underdeveloped countries. These topics overlapped with my study of economics and exciting classroom discussions on what was going on how different events would impact economies, for instance how fluctuations in oil prices will affect standards of living. Studying Economics has expanded  my knowledge about how countries are run and how macroeconomic policies shape the everyday experiences of individuals.

Unusually, this applicant does not go straight into her classroom experiences but instead uses one of her extracurricular activities (Model United Nations) in her first paragraph. For students applying for subjects that are not often taught at school (Social Policy in this example), this can be a good idea, as it allows you to bring in material that you have self-studied to explain why you are capable of studying each subject at university. Here, she uses MUN discussions to show she understands some topics in social policy that are impacting the world.

By taking up history as a subject in Grade 11 and 12, I have seen the challenges that people went through in the past, and how different ideas gained momentum in different parts of the world such as the growth of communism in Russia and China and how it spread to different countries during the Cold War. I learned about the different roles that governments played in times of hardships such as that which President Roosevelt’s New Deal played during the Great Depression. From this, I gained analytical skills by scrutinizing how different social, political and economic forces have moulded societies in the past.

In this paragraph, she then takes the nearest possible class to her interest in Social Policy and draws elements from it to add to her case for Social Policy. Taking some elements from her history classes enables her to add some content to this statement, before linking to the topic of economics.

To explore my interest in Economics, I interned at Emirates National Bank of Dubai, one of the largest banks in the Middle East, and also at IBM. At Emirates NBD, I undertook a research project on Cash Management methods in competitor banks and had to present my findings at the end of the internship. I also interned at IBM where I had to analyze market trends and fluctuations in market opportunity in countries in the Middle East and Africa. I had to find relations between GDP and market opportunity and had to analyze how market opportunity could change over the next 5 years with changing geo-political situations. I have also attended Harvard University’s Youth Lead the Change leadership conference where I was taught how to apply leadership skills to solve global problems such as gender inequality and poverty.

Economics is explored again through extracurriculars, with some detail added to the general statement about the activities undertaken during this work experience. Though the level of academics here is a little thin because this student’s high school did not offer any classes in Economics, she does as well as she can to bring in academic content.

I have partaken in many extra-curricular activities which have helped me develop the skills necessary for this course. Being a part of the Press Club at school gave me an opportunity to hone my talent for the written word and gave me a platform to talk about global issues. Volunteering at a local library taught me how to be organized. I developed research and analytical skills by undertaking various research projects at school such as the sector-wide contribution of the Indian economy to the GDP in the previous year. As a member of the Business and Economic Awareness Council at school, I was instrumental in organizing many economics-based events such as the Business Fair and Innovation Mela. Being part of various Face to Faith conferences has provided me with an opportunity to interact with students in Sierra Leone, India and Korea and understand global perspectives on issues like malaria and human trafficking.

The extracurricular activities are revisited here, with the first half of this paragraph showing how the applicant has some transferable skills from her activities that will help her with this course. She then revisits her interest in the course studies, before following up with a closing section that touches on her career goals:

The prospect of pursuing these two subjects is one that I eagerly anticipate and I look forward to meeting the challenge of university. In the future, I wish to become an economist and work at a think tank where I will be able to apply what I have learnt in studying such an exciting course.

UCAS PERSONAL STATEMENT EXAMPLE FOR HISTORY OF ART & PHILOSOPHY

This applicant is also a joint-honours applicant, and again is applying for a subject that she has not been able to study at school. Thus, bringing in her own interest and knowledge of both subjects is crucial here.

At the age of four, I remember an argument with my mother: I wanted to wear a pink ballerina dress with heels, made for eight-year-olds, which despite my difficulty in staying upright I was determined to wear. My mother persistently engaged in debate with me about why it was not ok to wear this ensemble in winter. After two hours of patiently explaining to me and listening to my responses she convinced me that I should wear something different, the first time I remember listening to reason. It has always been a natural instinct for me to discuss everything, since in the course of my upbringing I was never given a simple yes or no answer. Thus, when I began studying philosophy, I understood fully my passion for argument and dialogue.

This is an unusual approach to start a UCAS Personal Statement, but it does serve to show how this student approaches the world and why this combination of subjects might work for her. Though it could perhaps be drawn out more explicitly, here she is combining an artistic issue (her clothes) with a philosophical concern (her debate with her mother) to lead the reader into the case she is making for admission into this program.

This was first sparked academically when I was introduced to religious ethics; having a fairly Christian background my view on religion was immature. I never thought too much of the subject as I believed it was just something my grandparents did. However, when opened up to the arguments about god and religion, I was inclined to argue every side. After research and discussion, I was able to form my own view on religion without having to pick a distinctive side to which theory I would support. This is what makes me want to study philosophy: it gives an individual personal revelation towards matters into which they may not have given too much thought to.

There is some good content here that discusses the applicant’s interest in philosophy and her own motivation for this subject, though there is a lack of academic content here.

Alongside this, taking IB Visual Arts HL has opened my artistic views through pushing me out of my comfort zone. Art being a very subjective course, I was forced to choose an opinion which only mattered to me, it had no analytical nor empirical rights or wrongs, it was just my taste in art. From studying the two subjects alongside each other, I found great value, acquiring a certain form of freedom in each individual with their dual focus on personalized opinion and taste in many areas, leading to self- improvement.

In this section, she uses her IB Visual Arts class to explore how her interest in philosophy bleeds into her appreciation of art. Again, we are still awaiting the academic content, but the reader will by now be convinced that the student has a deep level of motivation for this subject. When we consider how rare this combination is, with very few courses for this combination available, the approach to take slightly longer to establish can work.

For this reason, I find the work of Henry Moore fascinating. I am intrigued by his pieces, especially the essence of the ‘Reclining Nude’ model, as the empty holes inflicted on the abstract human body encouraged my enthusiasm for artistic interpretation. This has led me to contemplate the subtlety, complexity and merit of the role of an artist. Developing an art piece is just as complex and refined as writing a novel or developing a theory in Philosophy. For this reason, History of Art conjoins with Philosophy, as the philosophical approach towards an art piece is what adds context to the history as well as purpose behind it.

Finally, we’re given the academic content. Cleverly, the content links both the History of Art and Philosophy together through a discussion of the work of Henry Moore. Finding examples that conjoin the subjects that make up a joint-honours application is a great idea and works well here.

Studying Philosophy has allowed me to apply real life abstractions to my art, as well as to glean a deeper critical analysis of art in its various mediums. My IB Extended Essay examined the 1900s Fauve movement, which made a huge breakthrough in France and Hungary simultaneously. This was the first artistic movement which was truly daring and outgoing with its vivid colours and bold brush strokes. My interest expanded to learning about the Hungarian artists in this movement led by Henri Matisse. Bela Czobel was one of the few who travelled to France to study but returned to Hungary, more specifically Nagybanya, to bestow what he had learned.

Again in this paragraph, the author connects the subjects. Students who are able to undertake a research project in their high school studies (such as the IB Extended Essay here, or the A Level Extended Project or AP Capstone) can describe these in their UCAS personal statements, as this level of research in an area of academic study can enliven and add depth to the writing, as is the case here.

As an international student with a multicultural background, I believe I can adapt to challenging or unfamiliar surroundings with ease. I spent two summers working at a nursery in Hungary as a junior Assistant Teacher, where I demonstrated leadership and teamwork skills that I had previously developed through commitment to sports teams. I was a competitive swimmer for six years and have represented my school internationally as well as holding the school record for 100m backstroke. I was elected Deputy Head of my House, which further reflects my dedication, leadership, teamwork and diligence.

As in the previous examples, this statement gives a good overview of the applicant’s extracurricular activities, with a mention of skills that will be beneficial to her studies at university. She then concludes with a brief final sentence:

I hope to carry these skills with me into my university studies, allowing me to enrich my knowledge and combine my artistic and philosophical interests.

UCAS PERSONAL STATEMENT EXAMPLE FOR LIBERAL ARTS

A good range of UK universities now offer courses called ‘Liberal Arts’ (or similar titles such as ‘Flexible Combined Honours’), which allows students to study a broader topic of study–perhaps combining three or four subjects–than is typically available in the UK system.

This presents a challenge in the personal statement, as within the 47 line / 4000 character limit, the applicant will have to show academic interest and knowledge in a range of subjects while also making the case to be admitted for this combined programme of study.

As a child I disliked reading; however, when I was 8, there was one particular book that caught my attention: The Little Prince. From that moment onwards, my love for literature was ignited and I had entered into a whirlwind of fictional worlds. While studying and analysing the classics from The Great Gatsby to Candide, this has exposed me to a variety of novels. My French bilingualism allowed me to study, in great depth, different texts in their original language. This sparked a new passion of mine for poetry, and introduced me to the works of Arthur Rimbaud, who has greatly influenced me. Through both reading and analysing poetry I was able to decipher its meaning. Liberal Arts gives me the opportunity to continue to study a range of texts and authors from different periods in history, as well as related aspects of culture, economy and society.

Here we have a slightly longer than usual opening paragraph, but given the nature of the course being applied for this works well. A personal story segueing from literature to modern languages to history and cultural studies shows that this student has a broad range of interests within the humanities and thus is well-suited to this course of study.

Liberal Arts is a clear choice for me. Coming from the IB International Baccalaureate Diploma programme I have studied a wide range of subjects which has provided me with a breadth of knowledge. In Theatre, I have adapted classics such as Othello by Shakespeare, and playing the role of moreover acting as Desdemona forced me to compartmentalise her complex emotions behind the early-modern English text. Studying History has taught me a number of skills; understanding the reasons behind changes in society, evaluating sources, and considering conflicting interpretations. From my interdisciplinary education I am able to critically analyse the world around me. Through studying Theory of Knowledge, I have developed high quality analysis using key questions and a critical mindset by questioning how and why we think and why. By going beyond the common use of reason, I have been able to deepen greaten my understanding and apply my ways of knowing in all subjects; for example in science I was creative in constructing my experiment (imagination) and used qualitative data (sense perception).

Students who are taking the IB Diploma, with its strictures to retain a broad curriculum, are well-suited to the UK’s Liberal Arts courses, as they have had practice seeing the links between subjects. In this paragraph, the applicant shows how she has done this, linking content from one subject to skills developed in another, and touching on the experience of IB Theory of Knowledge (an interdisciplinary class compulsory for all IB Diploma students) to show how she is able to see how different academic subjects overlap and share some common themes.

Languages have always played an important role in my life. I was immersed into a French nursery even though my parents are not French speakers. I have always cherished the ability to speak another language; it is something I have never taken for granted, and it is how I individualise myself. Being bilingual has allowed me to engage with a different culture. As a result, I am more open minded and have a global outlook. This has fuelled my desire to travel, learn new languages and experience new cultures. This course would provide me with the opportunity to fulfil these desires. Having written my Extended Essay in French on the use of manipulative language used by a particular character from the French classic Dangerous Liaisons I have had to apply my skills of close contextual reading and analysing to sculpt this essay. These skills are perfectly applicable to the critical thinking that is demanded for the course.

Within the humanities, this student has a particular background that makes her stand out, having become fluent in French while having no French background nor living in a French-speaking country. This is worth her exploring to develop her motivation for a broad course of study at university, which she does well here.

Studying the Liberal Arts will allow me to further my knowledge in a variety of fields whilst living independently and meeting people from different backgrounds. The flexible skills I would achieve from obtaining a liberal arts degree I believe would make me more desirable for future employment. I would thrive in this environment due to my self discipline and determination. During my school holidays I have undertaken working in a hotel as a chambermaid and this has made me appreciate the service sector in society and has taught me to work cohesively with others in an unfamiliar environment. I also took part in a creative writing course held at Keats House, where I learnt about romanticism. My commitment to extracurricular activities such as varsity football and basketball has shown me the importance of sportsmanship and camaraderie, while GIN (Global Issue Networking) has informed me of the values of community and the importance for charitable organisations.

The extracurricular paragraph here draws out a range of skills the student will apply to this course. Knowing that taking a broader range of subjects at a UK university requires excellent organizational skills, the student takes time to explain how she can meet these, perhaps going into slightly more detail than would be necessary for a single-honours application to spell out that she is capable of managing her time well. She then broadens this at the end by touching on some activities that have relevance for her studies.

My academic and personal preferences have always led me to the Liberal Arts; I feel as though the International Baccalaureate, my passion and self-discipline have prepared me for higher education. From the academics, extracurriculars and social aspects, I intend to embrace the entire experience of university.

In the final section, the candidate restates how she matches this course.

Overall, you can see how the key factor in a UCAS statement is the academic evidence, with students linking their engagement with a subject to the course of study that they are applying to. Using the courtroom exercise analogy, the judge here should be completely convinced that the case has been made, and will, therefore issue an offer of admittance to that university.

Recent Posts

  • How High School Students from UK Schools Can Apply to Public Universities in Switzerland
  • Podcast Episode 78: Intellectual Curiosity
  • A Guide to the CAO for Irish applications
  • Podcast Episode 77: Rugby at universities in the USA
  • US College Sports: Eligibility
  • Beyond these countries

TUG_Logo_Designs_White (1)

[email protected]

+44 (0) 7392 846307, useful links, privacy policy, services for.

  • Universities
  • Success Stories

The University Guys

  • Impartiality Statement
  • For Students
  • For Parents
  • For Schools
  • For Universities

How to write your personal statement

It can be hard to know where to begin when writing your UCAS personal statement. We've put together some top tips and advice to help you make the most of your personal statement.

maximum characters for ucas personal statement

As part of the UCAS application process, you'll need to complete a personal statement. Your personal statement might be the only chance you have to ‘speak’ directly to an Admissions Tutor so it’s important to get it right. Many people find it difficult to write about themselves, so don’t worry if you’re struggling for ideas. You can use this guide to help you write a great personal statement. 

Personal statements are changing. This will affect students applying to start university in September 2026. Read our guide on personal statement changes .

a student with long hair using a mobile phone and laptop in a social area on campus

Guide to writing your personal statement

Discover how to write a great personal statement with our handy guide. It covers everything you need to know from structuring to tips on what to include.

Your personal statement questions answered

What is a personal statement.

A personal statement is a short written account used to support your university application. It is your opportunity to ‘sell’ yourself to universities. And to show how and why you are a good candidate for your chosen course. A well-written application may convince a university to make you an offer or invite you to an interview. 

How to start a personal statement?

It’s never too early to start work on your personal statement. In fact, we’d recommend you give yourself as much time as possible.

Before you begin it’s important you have an idea of the course or subject area you want to study. Your personal statement needs to be specific so knowing what course you’re interested in will make it easier to start writing. It’s a good idea to check out the course descriptions in university prospectuses or on their website. This way you can find out the skills and experience that you’ll need. You can then reflect on how these relate to your own interests and qualities. 

Where to begin?

  • Start with an engaging and positive introductory sentence which makes the admissions Tutor want to read on.
  • Make it different. The most overused opening phrases are: “From a young age I have always been interested in…” and “For as long as I can remember I have been fascinated with…”
  • State your reasons for applying to your chosen course and what it is that motivates you.

What makes a good personal statement?

The great thing about a personal statement is that it’s exactly that - personal. This is your chance to stand out from the crowd and explain why you’re the right choice for your chosen course.

It’s important that the statement reflects you, so you need to write in your own individual style. However, there are certain facts Admissions Tutors will be expecting to see. So it's important that you include these to ensure you give the best account of yourself, your skills and your experience.

Everything that you write should be relevant and linked to the course(s) you are applying for. Whilst you will only submit one personal statement it will be seen multiple times by all the universities and courses you have applied for.

Here are some questions to think about to ensure your statement stands out:

  • Why do you want to study the course? You need to show that you have a genuine interest in the subject area and the motivation to immerse yourself in it.
  • What makes you suitable? This is your chance to show how your experiences have prepared you to meet the demands of the course.
  • What makes you stand out? Think about what you can offer outside of the lecture theatre and how you will contribute to the university community as a whole.

Download our guide to writing your personal statement for more top tips.

How long should a personal statement be?

Your personal statement needs to stay within the 4000 character limit set by UCAS. This includes spaces and blank lines. This might seem like a lot, but it's only around 1 side of typed A4 paper. So you need to keep it clear and concise. Use the UCAS personal statement tool to help you keep within the limit as well as tips on how to structure your statement.

How to structure a personal statement?

There is no set layout for your personal statement. But here are some style and structure tips to help you along the way:

  • Make sure you sound interested in the course. Admissions Tutors will recognise applicants who aren’t totally committed.
  • Don’t use bullet points. A personal statement is a chance to show how you can make a reasoned argument in continuous writing.
  • Avoid repetition.
  • You need to show rather than tell the Admissions Tutor that you are a good candidate. So don’t just list all your skills and achievements. Pick the most relevant, explain them carefully and provide examples.
  • Check your statement for spelling and grammar. And then check again.
  • Ask your parents, friends and/or teachers to read through your finished statement. They can help to make sure it flows and that you’ve not forgotten anything.

What are the personal statement changes?

Personal statements are changing. This will affect students applying to start university in September 2026.

New personal statements will include 3 questions:

  • Why do you want to study this course or topic?
  • How have your qualifications and studies helped you to prepare for this course?
  • What else have you done to prepare outside of education, and why are these experiences helpful?

Find out more about personal statement changes , including our tips for answering these questions.

When will personal statements change?

The personal statement changes will affect students applying to start university in September 2026. Students applying for September 2025 entry will not be affected.

Personal statement dos and don'ts

Read it out loud., check it’s all there., do some practice., be well prepared., don't be negative., don't complicate it., don't copy or paraphrase., don't include irrelevant facts..

group of students sat in a lecture theatre using laptops, main focus is a student wearing a black denim jacket and grey turtle neck - smiling and looking away from the camera

Secure your place now for September

Apply through Clearing and secure your place. Already got your results? Apply online and we may be able to make you an offer in minutes.

Hear from our students

Writing about yourself in a personal statement can be difficult, I’ve put together some tips that I found useful when writing my own personal statement.

portrait of Annelise

Hi, my names Parsa, I am a 4th year pharmacy student. Writing a personal statement can be stressful and time consuming, but it doesn't need to be. Read my tips to help you to write the very best statement.

campus tours

University application dates

Completing and submitting your UCAS application

Start your UCAS application

You will need to start your UCAS application around September in the year before you want to apply to university. For example, if you want to start in September 2025, start your application in September 2024.

You can start you application as early as May, but you won't be able to submit until September.

You'll need to submit your form to college so they can add your reference.

Apply by the deadline

Make sure you submit your UCAS application online by the deadline. Deadlines vary each year and are different depending on the course you want to study.

Scroll or swipe on small screens to see all table columns

UCAS deadlines
September 2024 entry Deadline for applications to medicine, dentistry and veterinary courses and to Oxford and Cambridge Main application deadline. Some art and design courses have a March deadline, please check UCAS for details.
September 2025 entry  Deadline for applications to medicine, dentistry and Veterinary courses and to Oxford and Cambridge  Main application deadline. Some art and design courses have a March deadline, please check UCAS for details.

After you apply

Once you submit your application through UCAS, they will send you an acknowledgement. They will then forward your application to your chosen institutions.

Getting a decision on your application

Once you've submitted your application, you may have several stages before you find out if you have an offer.

Institutions will look at a number of things to make their decision. This includes your personal statement, reference and predicted grades.

Interviews and auditions

You might be invited to interview or audition to see if you're right for the course. This is also your chance to see if it's the right place for you.

Receiving an offer

If you submitted your application by the January deadline, you should receive all of your offers by March. Some courses and late applications may not receive responses until later in the cycle.

You can receive a conditional or unconditional offer, depending on whether you already have your grades or not.

Offer holder days

Some universities might invite you to an offer holder or applicant day . This is a great opportunity to get a taste for your course and meet your tutors. 

Accepting your offer

Usually, you'll need to reply to any offers you have received by May. This depends on when you submit your UCAS application.

If you have conditional offers, you'll be able to choose one university as your firm choice, and one as insurance .

If you've used all five choices on your application, and you're not holding any offers, then you can add extra choices to your application - free of charge.

Wait for your results and prepare to enrol

If you're waiting for your results, you should receive these in either July or August. This depends on what qualification you have taken. 

Your offer will either be confirmed or rejected based on your results.

If you don't receive the results you expected, or you apply after July, you will be entered into UCAS Clearing . This helps match you to university places that haven't yet been filled.

Once you've confirmed your offer at your chosen university, you will receive information about how to enrol .

UCAS Personal Statement Advice

The Personal Statement is the most important part of the UCAS application - one that you will probably stress most about. 

This is your time to show who you are and why you want to study the course. A good personal statement should reflect your individuality, show your enthusiasm and commitment to the course, show admissions tutors that you are worth offering a place to and explain why the university should want you as a student. 

WATCH OUR VIDEO GUIDE

Law student Dave and Law lecturer and Admissions Tutor Chaynee offer advice on how to write a winning Personal Statement.

maximum characters for ucas personal statement

The UCAS Personal Statement is a marketing tool for your interests, talents and accomplishments. If you’re not invited for an interview, admissions tutors (the people who decide on who gets a place on their courses) rely on your statement when making their decision. 

Every single personal statement is read! 

You are competing against many other applicants and have to sell yourself. It’s important to take care in considering what you want to say and how to say it. 

Writing your UCAS Personal Statement can only be done properly when you are sure about what you want to do and why, so don’t start before you do. Look at the subject and the course details to get a clearer picture of what studying those courses will involve and remember that you can always ring Admissions Tutors if you have any questions. 

Tutors like well-rounded, responsible individuals, with a range of interests and well-organised enough to cope with university-level study. They're looking for motivation and potential and expect the statement to relate to your choice of course. 

Tutors will read hundreds of personal statements, many of which are dull, so make yours interesting! 

When you're writing your UCAS personal statement you should explain why you want to study that subject and give specific reasons for your interest in the course. Show evidence of research and background reading and make it clear that you’re prepared for studying the course - especially if it is a vocational course or a subject that you haven't studied before. What are your career plans for when you finish the course? 

Include information about any relevant job, work placement or voluntary experience – especially if it’s helped you develop skills and give experience that you wouldn't get through school or college. Have you attended any summer schools or related lectures?  

If you’re applying for different subjects on the same form, you’ll need to explain why that is, otherwise the universities might feel that you haven’t made up your mind. 

Most admissions tutors want to know more about you than just your academic qualifications, they love students who put themselves out to achieve something and enjoy a life outside their studies - i.e. they want to see what makes you tick! 

Include any hobbies/interests you may have and, if possible, relate them to how they will make you a better student, and mention any involvement with any other extracurricular groups e.g., the Duke of Edinburgh Award. 

If possible, include anything which shows that you have an intelligent interest in the world. Mention any positions of responsibility, evidence of self-motivation and any hurdles you’ve had to overcome and use these to show your character and your strengths. If you’re planning to take a gap year, explain why. 

The maximum size of your UCAS personal statement is 47 lines – that’s around 500-550 words, size 12 font. The maximum number of characters is 4000, and this includes spaces. 

Your reason for wanting to study your chosen course is the first thing tutors will look for and will usually be the opening part of a statement. 

BUT - Don’t start with “I’ve always wanted to study…” 

It is important to hook the reader and grab the attention of the Admissions Tutor from the start.  If you have a unique selling point, this is where it should be mentioned. 

Be personal and positive - and don't be bland.

A close up of a student's hand writing notes in a notebook

  • Don’t start every sentence with “I” 
  • Write what comes naturally 
  • Tone should not be over-familiar nor over-formal 
  • Be honest – don’t lie! 
  • Finish on a high note 
  • Make a few copies 
  • Take your time, be patient and get it right 
  • Re-read prospectuses and information about the subject/course before you start 
  • Don’t mention a university by name 
  • Check that each sentence adds something new 
  • Use the most relevant and recent examples of hobbies and extra-curricular activities 
  • Ask a friend or careers advisor to read through your statement and check for typos 

It looks like you’re visiting from outside the UK, would you like to be redirected to the international page?

  • Current students
  • New students
  • Returning students
  • Support for students
  • Semester and term dates
  • Policies and regulations
  • Online learning tools
  • Your feedback
  • Studying off campus
  • Results and graduation
  • Student Portal
  • Student handbook
  • Student news

A female student writing notes by a stack of books

How to write a great UCAS personal statement

What is a personal statement.

The personal statement is the most important part of the UCAS process. It is your opportunity to explain why you have picked the subject you want to study and demonstrate your personality, passion and knowledge about your chosen subject.

Although your personal statement is the most important part of your application, it can also be the most difficult to put together. Writing your personal statement requires you to think seriously about your goals and aspirations. You might even change your mind about these as you are putting together your statement. However, this is a key part of working out what you want to do in the future.

How long can my personal statement be?

Your personal statement can be up to 4,000 characters (including spaces) or 47 lines of text long – whichever comes first.

I'm applying in 2026 - what is changing with personal statements?

UCAS are changing the format of personal statements for students applying for 2026 entry onwards. For more information on the changes, visit the UCAS website .

These changes won't affect students applying for 2025 entry.

Seven tips for writing a great UCAS personal statement

Students at an open day talking to staff.

1. Do your research

You can use websites such as the National Careers Service to research the sort of jobs you would enjoy and the recommended routes into those careers. The UCAS website features details about every UK university course. Use this to find out subject specifics such as minimum entry requirements, available additional funding, career prospects and more. 

Visit campus open days and take the opportunity to speak with lecturers and see university facilities in person.

A woman writing in a notepad next to a Mac

2. Take your time to plan and draft

A good personal statement cannot be written the night before. Take your time to plan what you want to say, and use multiple drafts to make sure you say it in the right way.

As well as this, make sure you have enough time before the deadline to give yourself a break before rereading and sending off your statement. Taking a break can help you notice things you might not otherwise see and catch mistakes that might otherwise damage your chances of success.

A young guitarist practises at home

3. Show off your personality

Hundred of thousands of students apply through UCAS every year – but only one of them is you. Your personal statement needs to reflect your personality and show universities what makes you unique.

Talk about specific personal experiences and interests that have led to you choosing your subject. What do you do outside the classroom that is interesting and related to your chosen course?

However, avoid using jokes or humour, even if it is a natural part of your personality.

crop chemist holding in hands molecule model

4. Show off your passion

Above all else, university admissions staff want to see how enthusiastic, motivated and focused you are on your chosen subject. Devote over half of your personal statement to talking about the subject area you are applying for and why you are passionate about it.

Talk about specific areas of the course that interest you – but avoid mentioning anything that only one of your chosen universities offers. Keep in mind that you can only submit one personal statement, no matter how many places you are applying for.

A cafe restaurant counter

5. Be specific and relevant

Everything in your personal statement should show universities that you have the skills and qualities they are looking for. This means you should talk about your experience and aspirations in relevant ways. For example, if you have experience working in a shop, talk about how it has helped you develop the strong communication skills needed for a business management degree.

Make sure you provide evidence for why you are the skilled, experienced person that your chosen universities are looking for.

Wooden letter counters

6. Use your own language

Keep your writing simple and to the point. Avoid cliched words like ‘passionate’, as these can come across as inauthentic to the person reading your personal statement.

Stick to vocabulary that you are familiar with – if you do not use a word in your day-to-day life, then do not use it in your personal statement.

Make sure that you do not plagiarise other people’s work: UCAS has software to detect any writing that is copied or paraphrased from anywhere else, and some universities will reject you outright if your application is plagiarised.

Close up of a watch face

7. Keep it brief

Admissions tutors have a lot of personal statements to read, so make sure you get to the point and do not take up more reading time than you need to. Use short paragraphs, straightforward language, and only include information that is relevant.

A good idea is to write your opening and closing sentences last, as writing the rest of your statement might help inspire you and help cut down unnecessary words.

How to structure your personal statement

1. explain the reasons for your choice of subject.

Do not just talk about the importance of your chosen subject: the person reading your statement already knows this.

2. Explain why you are suitable for the course

You can use this section to explain how certain aspects of your chosen degree will help you progress and succeed.

3. Discuss your career aspirations

Demonstrate your knowledge of your chosen sector and your ambitions within it.

4. Describe the person behind the application

This can be a relatively short section: a few lines of interesting, relevant information will do.

5. Conclude by linking back to your introduction

Be brief: your conclusion is necessary, but everything above it is more important.

  • Find out how you can apply to the University of West London on our 'How to apply' page .

How to apply - undergraduates

Ready to apply for an undergraduate course? Find out how.

A woman on her laptop in between two bookshelves

Why study with us?

From great job prospects to our student support, find out why you should study with us.

Group of students walking togerther

Study support

We want you to get the most from your course so you can reach your full potential. We offer a range of study support services to help you with your studies.

Student talking to staff member in an office

Student stories

Our vloggers are current or ex-students who want to share their experiences and offer tips and advice on all aspects of preparing for life as a student and settling into your new life at university.

A male student filming himself with an iphone for a vlog

Come to an undergraduate open day

Our open days are a great chance for you to find out more about your course, university life and discover more about our facilities.

They will give you the opportunity to meet our staff and talk to current students.

The Uni Guide has a fresh new look

  • Teacher training
  • Bangor University
  • Birmingham City University
  • Sheffield Hallam University
  • University of Aberdeen
  • University of East Anglia
  • University of Hull
  • University of Kent
  • University of Reading
  • Clearing and results day
  • Preparing for university
  • Ucas application
  • Student finance
  • Student accommodation
  • Choosing a course
  • A-level results day: what to expect
  • A guide to Btec results day
  • How Ucas Hub works on results day
  • What to say in a Clearing phone call
  • 10 tips to help you with Ucas Clearing
  • A guide to Clearing 2024
  • Which university is right for you?
  • What you need to know about getting a university scholarship, grant or bursary
  • How to decide on a university course
  • Is a higher or degree apprenticeship right for you?
  • Universities

By Nik Taylor (Editor, The Uni Guide) | 13 September 2023 | 9 min read

Personal statement FAQs

We've gone through some of the most commonly asked personal statement questions and put all the answers in one place

Share this page

Email & print.

maximum characters for ucas personal statement

Your personal statement is a big part of your uni application. It's where you can show universities why they should give you a place on your chosen course. Read on for quick tips on writing your personal statement. We'll cover what sort of things to include, along with answers to some of the most commonly asked questions that crop up over on our sister site The Student Room .  If you can't find an answer to your question here, try posting it to the personal statements forum on The Student Room .

The university application personal statement is changing in 2025
University admissions service Ucas has announced that a new style of personal statement will be launched in 2025. This will affect anyone making a university application from autumn 2025 onwards.

.

When should I start writing my personal statement?

It’s never too early to start thinking about it! However, you'll need a good idea of what course you’re going to apply for before you launch into writing it. On the other hand, don’t leave it too late as it's quite a long process and you're likely to have a few drafts before reaching your finished product.

Remember:  your referee will need to see your personal statement before they can write your reference. If you get yourself organised over the summer, you can start by jotting down a few ideas over those few weeks - ready to start writing it when you arrive back to school or college in September.

The Ucas application deadline for most undergraduate uni courses starting in September 2024 is 31 January 2024. If you're applying to Oxbridge or for medicine, dentistry or veterinary science courses to start in 2024 there's an earlier deadline – 16 October 2023. You can find all the key Ucas deadlines and application dates for 2024 entry in this article . 

  • Read more: universities reveal all about personal statements

How long can the personal statement be?

Statements are limited to whichever is shorter of either:

  • 4,000 characters (including spaces)  OR

Be aware that software such as Microsoft Word may not give a character or line count that completely matches what the Ucas form says. The character count should be reasonably accurate, but the line limit is more difficult because lines may wrap at different points depending on the software you're using.

The only way to be 100% sure what the character and line counts are is to copy your draft statement into your online Ucas form (but be careful not to submit it unless you're sure it's the final version). You can edit and save your personal statement without submitting it as many times as you like, and you'll only be able to mark the section as complete when you're on the preview screen. 

If testing out your personal statement draft on your Ucas form still feels too risky, you can get a good indication of where you're at by using the Courier New font, size 10, with the default margins, to get a reasonable estimate how many lines your personal statement will be. If you've left a line between paragraphs, then you will probably reach the line limit before the character limit.

  • Read more: how to write an excellent personal statement in ten steps

Where do I start?

Most people won’t be able to just start writing the statement off the top of their head – so it’s a good idea to jot down a few notes first. The main things to think about are:

  • What do I want to study? (if you can't answer this, you should probably concentrate on working it out before writing your personal statement).
  • Why do I want to study it?
  • What personal qualities, interests and experience do I have which show I am suited to this subject, and to study at university?

Many people have trouble writing about themselves and their personal qualities. If you’re struggling with this step, it can be helpful to look up some information on writing a CV - there are a lot of parallels in how to put yourself forward effectively.

  • Read more: five practical tips to help with your personal statement

What sort of structure should I use?

Most people write their personal statement in an essay style, starting off with the course, and why they want to do it, then talking about their relevant work experience and skills and finishing off with extracurricular activities.

As a guide, spend around two thirds of the space talking about your course and how you’re suited to it, and one third on your work experience and other activities. Exactly how you write your statement depends on your subject – generally people write more about work experience for vocational subjects like medicine and law than they would for subjects like maths or English where work experience is less important.

  • Read more: avoid these ten biggest personal statement mistakes

No formatting of any type is allowed in your personal statement (except using capital letters), so any bold, italic, or underlined words will disappear in the preview.

Tabs and multiple spaces will be condensed to a single space, so it is not possible to indent lines. Single spaces at the beginning of lines will also be removed.

You have a very limited set of special characters. Common symbols that aren't allowed are € and the special quote characters “ ‘ ’ ” which will simply be removed from your statement, so remember to replace quotes with " and '.

Backslashes (\) are also not allowed, but will be replaced with forward slashes (/) and curly brackets will be replaced with normal ones.

What’s the most important part of the personal statement?

Write about your aspirations in a meaningful way. The crucial bit about a personal statement is where you talk about the subject you are applying for and why you want to do this at uni. Admissions tutors will always focus on this bit – so make this interesting and not just a list of books. Your personality should emerge here – they should be able to understand what is driving you to apply for this course, as well as getting a sense of your energy and enthusiasm.

  • Read more: how to write your university application

Should I talk about what I want to do after university?

You could, but only if you have a good idea of what you want to do. If you sound sure about what you want to do after uni it gives the impression that you’ve thought carefully about your course and what you want to do with it. It's also a nice way to round off your statement, rather than finishing on less important stuff like extra curricular activities. If you don’t have any future plans, then leave this bit out – you don’t want to be asked about them at interviews.

Should I talk about my qualifications?

No. There’s already a section on the Ucas form for this, so don’t waste the space on your personal statement. If you have something important which doesn’t go in the qualifications section, ask your referee to put it down in your reference – it will sound better if it comes from them than from you. This goes for module marks as well. Some people are told they should try to link each A-level to the course they are applying for. It can be far more effective to focus your time and space on talking about the subject you are applying for – that is what matters.

How do I write it for two different courses?

There’s no easy way to write a personal statement for two totally unrelated courses. If the courses are similar you may find you can write a statement relevant to both, without mentioning either subject by name. If the courses are completely unrelated, it may be impossible to write for both subjects without your personal statement sounding vague and unfocused. Instead you will need to concentrate on just one subject and just ignore the other – it sometimes works!

What are admissions tutors looking for?

Different admissions tutors are looking for different things, but in general they will be thinking things like:  “Do we want this student on this course?” , and  “Do we want this student at this university?”  And most will be looking for an interest in the subject you are applying for that goes beyond simply your A-level syllabus/reading list. 

Remember, most universities and departments now publish information on applications and writing personal statements, so reading the subject section of their website might list more specific information on exactly what they’re looking for. If in doubt, google the name of the university along with the subject/course and admissions statement.

  • Read more: 6 steps you need to take to apply to university

Is it worth doing loads of extracurricular stuff to make it sound good?

There’s no point doing extra things just to try and make yourself look good to universities – you won’t enjoy it and it probably won’t help much either. An interest and aptitude for the course is likely to be more important to admissions tutors than lots of extracurricular activities. If you do want to do something to boost your application, read relevant books or do work experience related to the subject instead. 

What happens if I lie on the personal statement?

If you aren't confident that the universities will accept you based on your predicted grades or something else, you might reconsider applying. 

It's best not to write anything which you can't back up in interview if necessary. Interviewers can and do bring up nearly anything in a personal statement as a basis for questions. 

Any last tips?

What have you done that's relevant to your subject, that is unique, and that it's likely no one else is going to write about in their personal statement? Many people have similar interests and work experience, so you need something to separate you from the crowd. For example, everyone who applies for economics seems to read The Economist, The Financial Times, and The Guardian. So if you put down those, don't expect them to be amazed by your reading around the subject. Have a deeper think – what makes you special? 

  • Read more: how to write your personal statement in an evening

And the most important thing?

Finally, remember that it’s your personal statement, and you can write  whatever you want  on it. If everything in this guide conflicts with what you’ve got already, but you think you still have a killer personal statement, then use that. A personal statement is about  you , and you shouldn’t let anyone tell you what to put – sticking blindly to a formula will just stop your true personality showing through.

Tricks to squeeze more in

  • Remember it's a personal statement, and leave out anything unnecessary.
  • Don't repeat yourself.
  • Cut out the waffle – be concise!
  • Get rid of pointless words, such as very specific details or unecessary adjectives
  • Ask your referee to mention some stuff that you cannot
  • Get some structure to your statement
  • If you can't get it under the line/character limit, you may just have to chop whole sentences

What should I do once I’ve written it?

Get people's opinions on it! Show it to your friends, parents, teachers, career advisors and so on and note down their comments. The most useful comments are likely to come from your teachers in the subject and the people at your school or college who handle Ucas applications. If you have enough time, leave your personal statement for a couple of weeks to a month and come back to it – if you’re not still happy with what you wrote, it’s time to start redrafting.

Definitely do not post it on an internet forum or discussion board. If your personal statement is published online before your application is complete, it may get picked up by Ucas' plagiarism detection .

You may want to look at these...

The ucas personal statement is changing in 2025.

A question-based personal statement will be required as part of university applications from autumn 2025 onwards

Teacher secrets for writing a great personal statement

Writing a personal statement is one of the most important things you will do when applying to university. Here is some useful advice and insider knowledge from Mrs Kinetta, who has more than 25 years of experience as a sixth form tutor.

How to write an excellent personal statement in 10 steps

Help and advice on putting your application together

Related to this article

Search the uni guide, find further advice or search for information on a course or university.

  • Search Advice
  • Search courses &/or universities

The Uni Guide and The Student Room are both part of The Student Room Group.

Promoted universities

  • Durham University
  • Lancaster University
  • University of Glasgow
  • University of the Arts London
  • University of Southampton
  • Swansea University
  • Aston University, Birmingham
  • Ulster University
  • Cardiff University

Browse expert advice

  • Oxbridge applications
  • Personal statements
  • University open days
  • Ucas deadline 2024 countdown
  • A-level choices
  • GCSE choices and university
  • Making firm and insurance choices
  • Student life
  • Advice for parents

About this site

  • Cookie policy
  • List of universities and colleges
  • Privacy notice
  • Terms and conditions
  • Where we get our info

Who we work with

  • Your account settings

Ad privacy settings

Popular tools and features

  • A-level Explorer
  • Course search

maximum characters for ucas personal statement

Connect with us

Minimum acceptable length of personal statement?

Avatar for oh_1993

Quick Reply

Related discussions.

  • Question regarding Standards:
  • Application to Imperial College London
  • ucas character count
  • Can I get into top 10 uni for economics?
  • Chances of getting an offer?
  • Does Sutton Trust actually guarantee an offer? For St andrews
  • Imperial, LSE, UCL masters in Finance/Business
  • Need help with what to do abt medicine application
  • Biomed requirements
  • Gap Year A-Level
  • Discrimination Univ of Sunderland Online Masters Enrolment team/HigherEd Partners
  • Kings College London - 2:2 Grad Entry Medicine
  • University choices with these predicted grades and A-levels?
  • CAS: What is CAS? How do I Apply?
  • Woodhouse Application.
  • LNAT score 19...still possible to get into KCL or LSE?
  • Bath Spa - HUGE discrepancy A levels and IB - Psychology
  • Advice for applying for Educational Psychology Doctorate
  • Medicine in Southampton

Last reply 20 hours ago

Last reply 1 day ago

Last reply 4 days ago

Last reply 5 days ago

Last reply 6 days ago

Last reply 1 week ago

Last reply 2 weeks ago

Last reply 3 weeks ago

Articles for you

Can you get into university if you’re studying Btecs?

Can you get into university if you’re studying Btecs?

How important are GCSE choices when it comes to university?

How important are GCSE choices when it comes to university?

Finding a university place in Ucas Clearing 2024: 10 top tips to help you get ready

Finding a university place in Ucas Clearing 2024: 10 top tips to help you get ready

Top 10 tips for Ucas Clearing 2024

cd_logo

  • Study Abroad Get upto 50% discount on Visa Fees
  • Top Universities & Colleges
  • Abroad Exams
  • Top Courses
  • Read College Reviews
  • Admission Alerts 2024
  • Education Loan
  • Institute (Counselling, Coaching and More)
  • Ask a Question
  • College Predictor
  • Test Series
  • Practice Questions
  • Course Finder
  • Scholarship
  • Netherlands
  • New Zealand
  • Study Guide

UCAS Personal Statement: Format, Guidelines, and Samples

maximum characters for ucas personal statement

Shahid Murshed

Content Writer - Study Abroad | Updated On - Jun 15, 2024

  • Importance : The UCAS personal statement is a crucial document in the UK university application process, allowing you to showcase your interests, passions, and achievements beyond academic records. It helps you to stand out from thousands of others.
  • What to Write: The UCAS personal statement should include reasons for choosing the course, current studies, related experiences, personal interests, responsibilities, and future plans. It should also highlight relevant skills and achievements.
  • Structural Guidelines : Your UCASpersonal statement must be well-structured, starting with an engaging opening, followed by sections on your personal skills, achievements, work experience, future plans, and a strong conclusion summarizing the main points.
  • Character Limit : Your UCAS essay must not exceed 4,000 characters. Use your words wisely and ensure everything included is relevant to the course and demonstrates why they would make you a great student.
  • Tips: Bold your achievements, including positions of responsibility, link experiences to course-related skills, and maintain originality and accuracy.

UCAS, or Universities and Colleges Admissions Service is for seeking admission in UK universities. UCAS personal statement is one of the key documents for your study abroad journey in UK. It is the core part of your university application that makes you stand out from thousands of other applicants. In the UCAS personal essay, you can express yourself, your interests, and passions beyond just academic achievements. But how to write a perfect UCAS SOP?

  • UCAS personal statement word limit should not exceed 4,000 characters.
  • Your personal statement should consist of your thoughts about the course.
  • Your skills and achievements in both academic and professional fields.
  • Your work experience and future plans.

UCAS_personal_statement

Also Check : SOP for UK

As per the UCAS data, last year, Indian student applications dropped by 4% as compared to the previous year, amounting to 8,770 applications. Experts suggest that this drop is linked to the ongoing review conducted by the Rishi Sunak-led government into the Graduate Route visa, also known as the post-study work visa.

How to Write UCAS Personal Statement

You can apply for up to 5 courses on your single UCAS application, you can only submit 1 personal statement. So it needs to cover all your course choices. You can use UCAS for masters and bachelors too. But what to include in your UCAS essay? Perfect personal UCAS statement examples have the following points

  • Reasons for choosing this subject(s)
  • Current studies and how these relate to your chosen subject(s)
  • Experiences and how these relate to your chosen subject(s)
  • Interests and responsibilities and how these relate to your chosen subject(s)
  • Your future after university
  • Summary including why you'll make a great student

Now, refer to the table below to know what to write in which section of your UCAS personal state.

Grab the admission counselor’s attention by showing enthusiasm for the subject and sharing your ambitions.

Avoid cliches and keep it relevant and simple

Use your words wisely due to the 4,000-character limit.
 

Highlight your abilities and achievements that are relevant to the course or university life.

Provide evidence to support your excitement about the chosen course(s).

Mention positions of responsibility both in and out of school.
 

Include details of relevant jobs, placements, work experience, or voluntary work.

Link your experiences to the skills or qualities that make you suitable for the course.

If you have career plans, explain how the knowledge and experience gained will help you achieve them.
 

Connect the ending to the opening to reinforce your main points.

Leave a lasting impression on the admissions tutor by summarizing your strong qualities.

Emphasize why you should be offered a place on the course.
 

Also Check : SOP for Masters in UK

UCAS SOP Guidelines

By this time you should have already known about the format and what to write in your UCAS essay. Now, quickly review the UCAS SOP guidelines to avoid last minute discrepancies in your admission process to the universities in UK . Follow the guidelines mentioned below and keep your UCAS personal statement number of words within 4000 words or roughly two sides of an A4 page. Perfect UCAS personal statement examples should have the following

  • Be bold and talk about the achievements you’re proud of.
  • Include positions of responsibility you hold, or have held, both in and out of school.
  • What are the things that make you interesting, special, or unique?
  • Share details of jobs, placements, work experience, or voluntary work, particularly if it's relevant to your course.
  • Try to link any experience to skills or qualities that will make you successful
  • Write in your own words, and do not exaggerate the statements.
  • Try to avoid grammatical errors and spelling mistakes in your
  • There should not be any plagiarism on the topic

Also Check : Example of a Personal Statement UCAS

You can make a UCAS personal profile on the UCAS hub itself. It is your unified profile to apply to several universities in the UK. However, you can edit your profile according to the course and university you have applied to. In 2023, the undergraduate admissions service of UCAS handled almost 3 million applications from 752,025 UK, EU, and international students. Out of them, 554,465 students secured a full-time place at one of over 380 universities and colleges across the UK. You can use UCAS for postgraduate and undergraduate admissions as well.

Ques: What is a UCAS personal statement?

Ans : A UCAS personal statement is a written document that prospective students submit as part of their application to universities in the UK. It allows you to showcase your academic achievements, extracurricular activities, skills, and motivations for applying to a particular course and institution.

Ques: How long should my UCAS personal statement be?

Ans : The UCAS personal statement must be a maximum of 4,000 characters, including spaces, or 47 lines of text, whichever comes first. Aim to be concise and direct while covering all necessary points.

Ques: What should I include in my personal statement?

Ans : Your personal statement should include:

  • Your reasons for choosing the course.
  • Evidence of your enthusiasm and commitment.
  • Relevant academic achievements and skills.
  • Extracurricular activities and work experience.
  • Any career aspirations or future plans

Ques: How should I start my personal statement?

Ans : Start with a strong opening that grabs attention. This could be an interesting anecdote, a powerful quote, or a concise explanation of your motivation. Make sure it reflects your passion and sets the tone for the rest of the statement.

Ques: How do I structure my personal statement?

Ans : Structure your personal statement with a clear introduction, body, and conclusion:

  • Introduction: Briefly introduce yourself and state your interest in the course.
  • Body: Discuss your academic achievements, relevant experiences, and skills. Show how they make you a suitable candidate.
  • Conclusion: Summarize your key points and reiterate your enthusiasm for the course and your future goals.

Ques: Can I use the same personal statement for different courses?

Ans : While you can use a single personal statement for multiple courses, it’s best to focus on common skills and experiences relevant to all the courses you are applying for. Avoid being too specific to one course unless all your chosen courses are very similar.

Ques: What tone should I use in my personal statement?

Ans : Use a formal yet personal tone. Be professional but also let your personality and passion shine through. Avoid slang and overly casual language.

Ques: How important is proofreading and editing my personal statement?

Ans : Proofreading and editing are crucial. Errors can detract from your professionalism. Review your statement multiple times, and ask teachers, family members, or friends to provide feedback and help catch any mistakes.

Ques: Can I mention personal circumstances in my personal statement?

Ans : Yes, if personal circumstances have impacted your education or contributed to your choice of course, it’s appropriate to mention them. Be concise and focus on how you have overcome challenges and what you have learned from them.

Ques: When should I start writing my UCAS personal statement?

Ans : Start early, ideally several months before the application deadline. This gives you ample time to brainstorm, write drafts, seek feedback, and refine your statement. Early preparation helps avoid last-minute stress and ensures a well-polished final product.

college-img

More Articles in this Category

article-img

UCAS Application: A Guide on How to Apply via UCAS

All the admission applications to study in the UK universities are made through UCAS (the Universities and Colleges Admissions Services). All the inte...

article-img

SOP for UK: Check Key Elements, and Sample

An SOP for UK should be a maximum of 4,000 characters (700-800 words). UK universities expect you to focus on your academic qualifications and achieve...

article-img

SOP for LLM in UK: Format, Samples & Writing Tips

An SOP for LLM in UK, sometimes called a personal statement, is a 500-1,000 word essay containing crucial information regarding the applicant and his ...

article-img

Statement of Purpose for Masters in UK: Format, Samples & Gu...

A Statement of Purpose for Masters in UK is an essay with details about the academic history as well as future aspirations and career motivations of t...

article-img

Sample SOP for UK MBA: Format, Tips & Guidelines

A 500-1000 word written SOP for MBA in UK is a mandatory requirement at business schools like LBS, Said Business School, Cambridge Judge. Learn more a...

article-img

SOP for Computer Science in UK: Format, Samples & Writing Ti...

An SOP for Computer Science in UK is an essential document required for applying to study in UK. As per the top universities in UK, an SOP should cont...

article-img

Sample Statement of Purpose (SOP) for MBA in UK

SOP for MBA in UK is considered an important document part of an applicant’s admission package in majority of universities in UK. An SOP serves

article-img

LOR for UK: Sample, Format & Program Guidelines

An LOR for UK is a letter written by a third party to the admissions committee to recommend an applicant for admission. The LOR for UK is usually writ...

SUBSCRIBE TO OUR NEWS LETTER

downloadapp_banner image

  • Applying to Uni
  • Apprenticeships
  • Health & Relationships
  • Money & Finance

Personal Statements

  • Postgraduate
  • U.S Universities

University Interviews

  • Vocational Qualifications
  • Accommodation
  • ​​​​​​​Budgeting, Money & Finance
  • ​​​​​​​Health & Relationships
  • ​​​​​​​Jobs & Careers
  • ​​​​​​​Socialising

Studying Abroad

  • ​​​​​​​Studying & Revision
  • ​​​​​​​Technology
  • ​​​​​​​University & College Admissions

Guide to GCSE Results Day

Finding a job after school or college

Retaking GCSEs

In this section

Choosing GCSE Subjects

Post-GCSE Options

GCSE Work Experience

GCSE Revision Tips

Why take an Apprenticeship?

Applying for an Apprenticeship

Apprenticeships Interviews

Apprenticeship Wage

Engineering Apprenticeships

What is an Apprenticeship?

Choosing an Apprenticeship

Real Life Apprentices

Degree Apprenticeships

Higher Apprenticeships

A Level Results Day 2024

AS Levels 2024

Clearing Guide 2024

Applying to University

SQA Results Day Guide 2024

BTEC Results Day Guide

Vocational Qualifications Guide

Sixth Form or College

International Baccalaureate

Post 18 options

Finding a Job

Should I take a Gap Year?

Travel Planning

Volunteering

Gap Year Blogs

Applying to Oxbridge

Applying to US Universities

Choosing a Degree

Choosing a University or College

Personal Statement Editing and Review Service

Clearing Guide

Guide to Freshers' Week

Student Guides

Student Cooking

Student Blogs

  • Top Rated Personal Statements
  • Personal Statement Examples

Writing Your Personal Statement

  • Postgraduate Personal Statements
  • International Student Personal Statements
  • Gap Year Personal Statements
  • Personal Statement Length Checker

Personal Statement Examples By University

  • Personal Statement Changes 2025
  • Personal Statement Template

Job Interviews

Types of Postgraduate Course

Writing a Postgraduate Personal Statement

Postgraduate Funding

Postgraduate Study

Internships

Choosing A College

Ivy League Universities

Common App Essay Examples

Universal College Application Guide

How To Write A College Admissions Essay

College Rankings

Admissions Tests

Fees & Funding

Scholarships

Budgeting For College

Online Degree

Platinum Express Editing and Review Service

Gold Editing and Review Service

Silver Express Editing and Review Service

UCAS Personal Statement Editing and Review Service

Oxbridge Personal Statement Editing and Review Service

Postgraduate Personal Statement Editing and Review Service

You are here

  • Mature Student Personal Statements
  • Personal Statements By University
  • Personal Statements By Subject
  • Personal Statement Editing Service
  • 10 Personal Statement Don'ts
  • Analysis Of A Personal Statement Example
  • Frequently Asked Questions
  • Personal Statement Timeline
  • Personal Statement Tips
  • Teacher's Advice
  • How To Write A Personal Statement
  • How To Start A Personal Statement
  • Submit Your Personal Statement
  • Personal Statement Questions 2025

Personal Statement FAQs

Our personal statement FAQs will help ease the pain of writing a personal statement for your UCAS form . More advice can also be found on our blog .

  • When to start writing a personal statement
  • Personal statement length
  • How do I begin writing?
  • What are the admissions tutors looking for?
  • Most important part of a personal statement
  • Writing a statement for two different courses
  • Your plans after university
  • How to structure a personal statement
  • Extra-curricular activities
  • Qualifications
  • Personal statement examples
  • After you've written your statement
  • Posting your statement online
  • Asking for feedback
  • Further advice
  • Mature students
  • International students

1. When should I start writing my personal statement?

It's never too early to start thinking about it! Unfortunately, UCAS deadlines have a tendency to creep up on most students, especially if you are applying to Oxbridge where the deadline is much earlier than other universities ( 15th October ).

However, you probably want a good idea of what course you're going to apply for before you launch in to actually writing the thing .

Check out Choosing A Degree if you're still deciding what subject to take.

On the other hand, don't leave it too late - you'll probably need a few weeks to write it and a week or so to get a reference written.

As a general guide we would say start writing it when you come back to school or college after the summer, though it might be worth jotting down a few ideas during the holidays.

We know some people are extremely organised and get at least their first draft done by the end of the summer!

2. How long can the personal statement be?

There is no actual word limit - instead, you have a maximum of 47 lines or 4000 characters to work with.

This is all the space UCAS give you on their online system, Apply . You can check that your statement will fit in the area provided by using our handy Personal Statement Length Checker .

3. How do I start writing my personal statement?

Most people won't be able to just start writing their personal statement off the top of their head - so it's a good idea to jot down a few notes first.

The main things to think about are:

  • why do you want to study your chosen course?
  • how do your skills, experiences and interests prove you are passionate about and committed to taking this course?

These are the two main things to start with, and if this still doesn't help you can look at a few more detailed starting points .

Many people have trouble writing about themselves and their personal qualities.

So if you're having trouble pop down to a library or bookstore and get a book on writing CVs that will go into this process in much more depth.

4. What are admissions tutors looking for?

Usually the sort of things you've written about for the part above!

Obviously the things admissions tutors are looking for will differ but in general: "Do we want this student on this course?" And "Do we want this student at this university?".

The idea of your personal statement is to show this - so once you've written it, have a read through and see if it answers these questions.

Individual universities and departments often publish information on applying and writing personal statements, so surfing the admissions scetion of their website should turn up more specific information on exactly what they're looking for.

Our blog post, 8 Things Not To Put In Your Personal Statement , will help you avoid making any obvious errors. Then check out What You Should Include In Your Personal Statement to make sure you don't miss anything important.

Read through our Personal Statement Writing Tips and How To Write A Personal Statement Guide for more comprehensive information and advice.

5. What's the most important part of the personal statement?

From our days of GCSE English, we would say either the beginning or the end.

A good first sentence will get the reader interested and ensure they actually read your statement rather than skim it.

A good ending will ensure the reader remembers your personal statement, though it also helps to have a good middle section as well.

The first line is probably the most important thing to work on. Most people put their reasons for studying the subject at the top, and this is generally regarded to be the most crucial part of the statement, as you need to hook the reader and make them want to read more.

However, the rest of your statement should make you shine as a candidate too, so there isn't really a definite answer to this question!

Just try to make your personal statement as interesting and polished as you can.

6. How do I write a statement for two different courses?

There's no easy way to write a personal statement for two totally unrelated courses.

If the courses are similar (i.e. Business Studies and Economics ) you may find you can write a personal statement that is relevant to both subjects without mentioning either subject by name.

If the courses are totally unrelated it may be impossible to write for both subjects without your personal statement sounding vague and unfocused.

Instead, you will need to concentrate on just one subject and just ignore the other, although you may want to question whether it's a good idea to apply for such different course, and re-think your subject choice .

7. Should I talk about what I want to do after university?

You could, but only if you have a good idea of what you want to do.

If you sound sure about what you want to do after university , it gives the impression that you've thought carefully about your course and what you want to do with it.

It is also a nice way to round off your personal statement , rather than just finishing on less important stuff like extra curricular activities.

If you don't have any future plans then leave it out - you don't want to be asked about them at interviews .

8. How should I structure my personal statement?

Most people write their personal statement in an essay style, usually starting off with the course and why they want to do it, then talking about their relevant work experience and skills, and finishing off with extra curricular activities.

However, you can use any style that you feel works best for you.

As a guide, spend around 50% of the space talking about your course and how you're suited to it and 50% on your work experience and other activities.

Exactly how you write your personal statement depends on your subject - generally people write more about work experience for vocational subjects like Medicine and Law than they would for Maths or English , where work experience is less important.

9. Is it worth doing loads of extra-curricular stuff to make my statement sound good?

There's no point doing extra things just to try and make yourself look good to universities - you won't enjoy it and it probably won't help much either.

From what we've seen, an interest and aptitude for the course is more important to admissions tutors than lots of extra curricular activities.

If you do want to do something to boost your application, read relevant books or do work experience related to the subject instead.

10. Should I talk about my qualifications?

No. There's already a section on the UCAS form for this, so don't waste space talking about them on your personal statement.

If you have something important that doesn't go in the qualifications section, ask your referee to put it down in your reference - it will sound better if it comes from them than from you.

11. Where can I see some example personal statements?

We have loads of free personal statement samples that you can browse through, broken down into subject categories so you can hopefully find what you are looking for quite easily!

Looking at what other students have written and submitted on their application is a useful way of seeing what makes a great personal statement (and what doesn't!).

Just make sure you don't copy sentences or whole chunks of these examples though, as UCAS has plagiarism detection software and your application will be rejected if it's found you've cheated!

12. What should I do after I've written my statement?

Ask for opinions on it!

Show it to your friends, parents, teachers, career advisors, etc and note down their comments.

The most useful comments are likely to come from your teachers in the subject and the people at your school or college who handle UCAS applications.

If you have enough time, leave your personal statement for a couple of weeks or a month and come back to it - if you're not still happy with what you wrote, it's time to start redrafting.

13. Should I post my personal statement online?

It's generally not a good idea to post it on an internet forum or discussion board before you've started university.

Anyone can steal information off a website and pass it off as their own, and with something as important as a personal statement, you don't want that to happen.

You should be OK sending it to people you trust by email - see the next question for a better way of getting people to look at it.

14. Where can I ask for feedback on my personal statement?

To get people to look at your personal statement without the risk of plagiarism visit the personal statement review section.

You can also get your personal statement professionally edited and reviewed here at Studential, through one of our very popular personal statement editing and critique packages.

We offer a range of services covering a variety of prices, so there's bound to be a package suited to you.

15. I'm still stuck with my personal statement - where can I find more in-depth advice?

Some people say writing a personal statement is easy – maybe it is, but it’s difficult to write a personal statement well. As this is such a big topic to cover, we suggest taking a look at our personal statement examples to help give you some inspiration for what to write, and then read through our  personal statement writing guide  when you’re ready to put pen to paper. Browse through the  other information and advice  we have in our personal statements section, and if you still feel you need a little extra help, you can always get your personal statement  professionally edited and reviewed  by one of our editors. We offer a range of UCAS personal statement editing and critique services , so there’s bound to be one suited to your needs. Don’t forget to ask your family, friends, teachers and careers adviser to look through your personal statement drafts, and incorporate any feedback they give you until you are 100% happy with it. Remember - it doesn’t matter how many times you have to redraft your personal statement – the most important thing is you get it right so you give yourself the best possible chance of being offered places by your chosen universities/colleges.

IMPORTANT:  When writing your personal statement, it’s vital you remember  not to copy from anyone else’s personal statement  (not even just a sentence!). Not only is it wrong and unfair, but any plagiarism will be detected by the Copycatch Similarity Detection Software. If UCAS discover you have plagiarised your personal statement, whether you have copied someone else’s entirely or parts of it, they will cancel your application.

You can also try looking through our personal statement guide for extra guidance.

This takes you through how to write a personal statement step-by-step, and goes into far more detail than this FAQ does.

If you feel you need more help, check out our personal statement editing and critique services  where our professional editors will review your statement to make it a success.

16. How do I write a personal statement if I'm a mature student?

Don't worry if you're a mature student applying to university - your qualifications, skills and extra experience will count as an advantage! Universities want to take on students from all walks of life, and this includes mature ones with more life experience.

Focus on what you can bring to the university if they offered you a place on the course, and how your degree fits into your future plans.

Read through some of our Mature Student Personal Statement Examples for inspiration.

17. How do I write a personal statement if I'm an international student?

As mentioned previously, universities want students from a range of backgrounds, and this includes those who want to study at their institution from abroad.

Again, try to convey how your experiences in your own country will benefit you on your course, and how they make you a valuable asset to the university.

To give you an idea of what other international students have written in the past, read through some of our International Student Personal Statement Examples for inspiration (but please remember not to copy them, or your application will be penalised!).

A few last tips

What have you done, relevant to your subject, that is unique and no one else is likely to put down?

Many people have the same old boring interests and work experience - you need something to separate you from the crowd, and while it's a gamble to make an individual personal statement, anything individual you do related to your chosen field can only look good.

Have a think - what makes you so special? If you can't think of anything then you can't complain if you get rejected! Finally, remember it's your personal statement, and you can write whatever you want in it.

If everything in this guide conflicts with what you've got already but you think you still have a killer personal statement, then use that.

A personal statement is about you, and you shouldn't let anyone tell you what to put in it - sticking blindly to the formula mentioned here will just stop your true personality showing through.

Further information

For more tips and advice on writing your personal statement, please see:

  • The 15th January UCAS Deadline: 4 Ways To Avoid Missing It
  • Analysis Of A Personal Statement
  • Personal Statement Editing Services
  • Top 10 Personal Statement Writing Tips
  • Personal Statement Advice From A Teacher
  • Personal Statement Writing Guide
  • What To Do If You Miss The 15th January UCAS Deadline .

Best of luck with your personal statement!

Has lots of valuable

Mon, 19/09/2011 - 05:17

Has lots of valuable information

Thu, 06/10/2011 - 20:30

very good site!! Helped a lot!!!!

Wed, 12/10/2011 - 17:21

Great info, i appreciate it.

Fri, 14/10/2011 - 14:35

i wana apply for a science

Tue, 25/10/2011 - 10:22

i wana apply for a science faculty but what i did in the past were only related to English (eg:joining competitions in sos verse speaking,public speaking;volunteered to teach english;being chairman of english society at school./) and seems almost nth for science.... so should i write those experience also?but how can i link them to the content.... thanks

Wed, 26/10/2011 - 22:56

Excellent website, I have searched high and low for a website like this. Very impressed.

wow this has just simply

Fri, 28/10/2011 - 21:15

wow this has just simply saved my life:)

Sun, 30/10/2011 - 11:11

Thank you for the guidance, its very simple and straight forward

Disabilities

Fri, 04/11/2011 - 06:38

I have Aspergers should I include this in my PS because it has affected my involvement in extra curricular activities

like to point out that it is

Wed, 09/11/2011 - 15:13

like to point out that it is 47 lines and not 37 :) that aside, very helpful - thanks!

The best site I have found to

Fri, 02/12/2011 - 22:29

The best site I have found to help with personal statements, got so much useful infomation and straight to the point, will definately recommend to others in my class who are in the middle of their personal statments!

I have read that you should

Tue, 06/12/2011 - 14:57

I have read that you should write about why you wish to study at university and what inspires you to, and i want to but the real reason i want to study at uni is because of a very personal reason and im not sure wether to mention it as i feel i may come across as an attention seeker? the real reason i want to go is because of a very abusive relationship with an ex boyfriend that made me realise i should make the most of my life and do exactly what i want and never let anyone bring me down... do u think it would be too much if i said this - I was very unsure whether to write about the real reason I want to pursue what I’m passionate about, because its very personal. The truth is that is wasn’t a good experience. A traumatising abusive relationship with an ex boyfriend woke me up and made me see I should make the most out of my life.

Tue, 06/12/2011 - 15:03

Tue, 06/12/2011 - 15:08

Amazing Stuff

Mon, 13/02/2012 - 13:06

I'm so glad I found this site

Thu, 01/03/2012 - 15:46

I'm so glad I found this site. It's helped alot.

I'm so glad I found this site. It's helped alot. :)

Thu, 01/03/2012 - 15:47

Lying on your personal statement

Tue, 10/07/2012 - 20:27

I was very disappointed to see this included in your FAQs. Even more to see it answered in the way it was. If someone can lie and "get away with it" does that not suggest we could potentially have a generation of useless, brainless, incompetent potential lawyers, doctors, politicians heading our way? Oh, wait...how long have you been giving this advice out?

do we have to write about our

Tue, 31/07/2012 - 19:13

do we have to write about our interests and hobbies???

if yes what if we dont have enough space and gone over max line limit??

thx a lot for the post..lots

Thu, 13/09/2012 - 23:21

thx a lot for the post..lots of info :)

you get 47 lines not 37 as it

Thu, 20/09/2012 - 11:35

you get 47 lines not 37 as it says

Wed, 17/04/2013 - 11:16

Some of the universities I'm applying to offer different courses to other unis I'm also applying to. Is it possible to send two different personal statements depending on which uni? For Edinburgh and Manchester, I want to apply for English Literature, but for Aberystwyth, East Anglia and Manchester Metropolitian they offer English Lit and Creative Writing.

Any advice would be great, thanks!

Wed, 24/07/2013 - 03:11

Say, you got a nice article.Much thanks again. Awesome.

Wrong information

Thu, 25/07/2013 - 16:15

The maximum on UCAS for personal statements is 47 lines and 4000 characters, not 37 lines as stated on this page.

This is really helpful and

Fri, 27/09/2013 - 14:15

This is really helpful and informative but I'm fairly sure the number of lines allowed is 47, not 37 as written here.

Retaking year 12

Sun, 29/09/2013 - 12:22

I have recently retook year 12 and I am now in the process of writing my personal statement. Having gathered differing opinions on this matter i was wondering for your input on whether or not its worth putting it down on my personal statement.I have changed subjects, left one out for a year and returned to it and retaken a subject. This now leaves me with 5 As levels.

Mon, 30/09/2013 - 20:06

"Have a think - what makes you so special? If you can't think of anything then you can't complain if you get rejected!"

As if we're not under enough stress already!

Previous Work

Tue, 29/10/2013 - 20:33

can I put links in to websites I have professionally made

wow very good much

Fri, 15/11/2013 - 09:25

wow very good much informative

Very informative. I really

Wed, 15/01/2014 - 14:57

Very informative. I really appreciate your site.

Not required

Mon, 30/06/2014 - 14:27

Comment Content

U.S. flag

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Free Cyber Services #protect2024 Secure Our World Shields Up Report A Cyber Issue

Vulnerability Summary for the Week of August 12, 2024

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the  National Institute of Standards and Technology  (NIST)  National Vulnerability Database  (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the  Common Vulnerabilities and Exposures  (CVE) vulnerability naming standard and are organized according to severity, determined by the  Common Vulnerability Scoring System  (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High : vulnerabilities with a CVSS base score of 7.0–10.0
  • Medium : vulnerabilities with a CVSS base score of 4.0–6.9
  • Low : vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.  

High Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
10Web Form Builder Team--Form Maker by 10Web
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Reflected XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.26.2024-08-12

 
AddonMaster--Post Grid Master
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Reflected XSS.This issue affects Post Grid Master: from n/a through 3.4.10.2024-08-12

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when the state of a resource changes between its check-time and use-time, allowing an attacker to manipulate the resource. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue does not require user interaction, but attack complexity is high and scope is changed.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user interaction, but attack complexity is high.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- indesign
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- substance_3d_designer
 
Substance3D - Designer versions 13.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Acrobat Reader
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Bridge
 
Bridge versions 13.0.8, 14.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Bridge
 
Bridge versions 13.0.8, 14.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Dimension
 
Dimension versions 3.4.11 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Dimension
 
Dimension versions 3.4.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Dimension
 
Dimension versions 3.4.11 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, which the application might execute instead of the legitimate file. This could occur if the application uses a search path to locate executables or libraries. Exploitation of this issue requires user interaction.2024-08-14

 
Adobe--Illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InCopy
 
InCopy versions 18.5.2, 19.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Photoshop Desktop
 
Photoshop Desktop versions 24.7.3, 25.9.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Substance3D - Stager
 
Substance3D - Stager versions 3.0.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
AMD--3rd Gen AMD EPYC Processors
 
Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.2024-08-12

 
AMD--AMD Athlon 3000 Series Desktop Processors with Radeon Graphics
 
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution.2024-08-13

 
AMD--AMD EPYC 7001 Processors
 
A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.2024-08-13

 
AMD--AMD EPYC 7001 Series Processors
 
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to sign the resulting image, to potentially modify the APCB block resulting in arbitrary code execution.2024-08-13

 
AMD--AMD Ryzen 3000 Series Desktop Processors
 
Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address space, potentially leading to privilege escalation.2024-08-13

 
AMD--Prof Tool
 
Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD ?Prof may allow an authenticated attacker to cause an out-of-bounds write, potentially causing a Windows® OS crash, resulting in denial of service.2024-08-13

 
AMD--Prof Tool
 
A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.2024-08-13

 
AMD--Prof Tool
 
Incorrect default permissions in the AMD ?Prof installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.2024-08-13

 
angeljudesuarez -- tailoring_management_system
 
A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file /incedit.php?id=4. The manipulation of the argument id/inccat/desc/date/amount leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
anhvnit--Woocommerce OpenPos
 
Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.2024-08-13

 
annke -- crater_2_firmware
 
An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request.2024-08-12

 
Apache Software Foundation--Apache DolphinScheduler
 
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.2024-08-12

 
averta--Slider & Popup Builder by Depicter Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel
 
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible.2024-08-14



 
BannerSky--BSK Forms Blacklist
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky BSK Forms Blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through 3.8.2024-08-12

 
BerqWP--BerqWP
 
Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6.2024-08-13

 
boa-dev--boa
 
Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts. Boa's implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`. However, a carefully constructed code could trigger a state transition from a getter method for the promise's `then` property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user. Version 0.19.0 is patched to correctly handle this case. Users unable to upgrade to the patched version would want to use `std::panic::catch_unwind` to ensure any exceptions caused by the engine don't impact the availability of the main application.2024-08-15



 
CAYIN Technology--CMS-SE(22.04)
 
The specific CGI of the CAYIN Technology CMS does not properly validate user input, allowing a remote attacker with administrator privileges to inject OS commands into the specific parameter and execute them on the remote server.2024-08-14



 
CAYIN Technology--SMP-2100
 
The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.2024-08-14



 
clastix -- kamaji
 
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.2024-08-12



 
code-projects -- simple_ticket_booking
 
A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been classified as critical. Affected is an unknown function of the file register_insert.php of the component Registration Handler. The manipulation of the argument name/email/dob/password/Gender/phone leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
code-projects -- simple_ticket_booking
 
A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file authenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
code-projects--Job Portal
 
A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
Codection--Import and export users and customers
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Codection Import and export users and customers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Import and export users and customers: from n/a through 1.26.8.2024-08-13

 
college_management_system_project -- college_management_system
 
A vulnerability was found in code-projects College Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php of the component Login Page. The manipulation of the argument email/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
Crocoblock--JetElements
 
The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.2024-08-16


 
Crocoblock--JetTabs for Elementor
 
The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcher_preset' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.2024-08-16


 
dglingren--Media Library Assistant
 
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.2024-08-13




 
dylanjkotze--Zephyr Project Manager
 
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.2024-08-15



 
edimax -- ic-6220dc_firmware
 
A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcam_cgi. The manipulation of the argument host leads to command injection. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12





 
Elastic--Kibana
 
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.2024-08-13

 
F5--BIG-IP
 
When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
F5--BIG-IP
 
In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
F5--BIG-IP Next Central Manager
 
The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated2024-08-14

 
F5--NGINX Plus
 
When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
fabianros -- job_portal
 
A vulnerability was found in code-projects Job Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file rw_i_nat.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
fabianros -- online_polling
 
A vulnerability was found in code-projects Online Polling 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file registeracc.php of the component Registration. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
ffmpeg -- ffmpeg
 
A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in version 6.0 by 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 but a backport for 5.1 was forgotten. The exploit has been disclosed to the public and may be used. Upgrading to version 5.1.6 and 6.0 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 is able to address this issue. It is recommended to upgrade the affected component.2024-08-12





 
Firewalla--Box Software
 
A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely).2024-08-12

 
FIWARE--FIWARE Keyrock
 
The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.2024-08-12

 
FIWARE--FIWARE Keyrock
 
The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.2024-08-12

 
FIWARE--FIWARE Keyrock
 
Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link.2024-08-12

 
flatpak--flatpak
 
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.2024-08-15









 
freebsd -- freebsd
 
A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges. This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD. As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.2024-08-12



 
freebsd -- freebsd
 
A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/12024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.2024-08-12

 
frogcms_project -- frogcms
 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.2024-08-12

 
G5Theme--Ultimate Bootstrap Elements for Elementor
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.4.2024-08-13

 
ggerganov -- llama.cpp
 
llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address reading. This vulnerability is fixed in b3561.2024-08-12


 
ggerganov -- llama.cpp
 
llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561.2024-08-12


 
ggerganov -- llama.cpp
 
llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.2024-08-12


 
Google--Android
 
In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15

 
Google--Android
 
In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15






 
Google--Android
 
In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15


 
Google--Android
 
In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip windows due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15


 
Google--Android
 
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15


 
Google--Android
 
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.2024-08-15


 
Google--Android
 
In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15



 
Google--Android
 
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock screen visibility settings are restricted by the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15


 
guillaumepotier--gettext.js
 
gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.2024-08-16


 
HitPay Payment Solutions Pte Ltd--HitPay Payment Gateway for WooCommerce
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HitPay Payment Solutions Pte Ltd HitPay Payment Gateway for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects HitPay Payment Gateway for WooCommerce: from n/a through 4.1.3.2024-08-13

 
ibexa--fieldtype-richtext
 
Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.2024-08-16





 
IBM--Common Licensing
 
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895.2024-08-13


 
IBM--OpenBMC
 
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.2024-08-13


 
IBM--Security Directory Integrator
 
IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM X-Force ID: 228570.2024-08-16


 
inspirelabs--InPost PL
 
The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read.2024-08-17







 
inspireui--MStore API Create Native Android & iOS Apps On The Cloud
 
The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account.2024-08-15





 
itsourcecode--Billing System
 
A vulnerability classified as critical has been found in itsourcecode Billing System 1.0. This affects an unknown part of the file addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
itsourcecode--Online Food Ordering System
 
A vulnerability was found in itsourcecode Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /addcategory.php. The manipulation of the argument cname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
ivanti -- avalanche
 
Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion.2024-08-14

 
ivanti -- avalanche
 
An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.2024-08-14

 
ivanti -- avalanche
 
Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE.2024-08-14

 
ivanti -- avalanche
 
A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.2024-08-14

 
ivanti -- avalanche
 
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.2024-08-14

 
Ivanti--ITSM
 
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information.2024-08-13

 
Ivanti--ITSM
 
Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a token that would allow access to ITSM as any user.2024-08-13

 
Ivanti--vTM
 
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.2024-08-13

 
j4k0xb -- webcrack
 
webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system. This vulnerability allows an attacker to write arbitrary `.js` files to the host system, which can be leveraged to hijack legitimate Node.js modules to gain arbitrary code execution. This vulnerability has been patched in version 2.14.1.2024-08-15



 
jayesh -- online_exam_system
 
A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthenticated attackers to view administrator dashboard and delete valid user accounts via the direct URL access.2024-08-12


 
kingsoft -- wps_office
 
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 (inclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document2024-08-15

 
kingsoft -- wps_office
 
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17153 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough. Another parameter was not properly sanitized which leads to the execution of an arbitrary Windows library.2024-08-15

 
Kubernetes--ingress-nginx
 
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.2024-08-16




 
Lenovo--Display Control Center
 
An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a local attacker to escalate privileges.2024-08-16

 
Lenovo--Display Control Center
 
An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a local attacker to escalate privileges to kernel.2024-08-16

 
libtiff -- libtiff
 
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.2024-08-12


 
litestar-org--litestar
 
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.2024-08-12




 
ManageEngine--ADAudit Plus
 
Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard.2024-08-12

 
matter-labs--era-compiler-vyper
 
zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a loop with a much more late exit condition. It leads to a loss of funds or other unwanted behavior if the loop body contains it. However, more real-life use cases like iterating over an array are not affected. No contracts were affected by this issue, which was fixed in version 1.5.3. Upgrading and redeploying affected contracts is the only way to avoid the vulnerability.2024-08-15

 
mayurik -- advocate_office_management_system
 
A vulnerability classified as critical has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file delete_client.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
mayurik -- advocate_office_management_system
 
A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code of the file delete_act.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
mayurik -- advocate_office_management_system
 
A vulnerability, which was classified as critical, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This issue affects some unknown processing of the file delete_register.php. The manipulation of the argument case_register_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
mayurik -- advocate_office_management_system
 
A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected is an unknown function of the file deactivate_act.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
mayurik -- advocate_office_management_system
 
A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file activate_act.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
mayurik -- best_house_rental_management
 
A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking the administrator into adding/modifying/deleting valid tenant data via a crafted HTML page, as demonstrated by a Delete Tenant action at the /rental/ajax.php?action=delete_tenant.2024-08-12


 
mayurik -- best_house_rental_management_system
 
SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /rental/invoices.php, /rental/tenants.php, and /rental/users.php.2024-08-12


 
MCJack123--craftos2
 
CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without permission or notice by obfuscating `..`s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for this issue.2024-08-16


 
MediaTek, Inc.--MT2735, MT2737, MT6833, MT6835, MT6835T, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
 
In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01182594; Issue ID: MSV-1529.2024-08-14

 
microsoft -- .net
 
.NET and Visual Studio Denial of Service Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft Project Remote Code Execution Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft Office Visio Remote Code Execution Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft Excel Remote Code Execution Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft PowerPoint Remote Code Execution Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft Excel Remote Code Execution Vulnerability2024-08-13

 
microsoft -- app_installer
 
Windows App Installer Spoofing Vulnerability2024-08-13

 
microsoft -- azure_connected_machine_agent
 
Azure Connected Machine Agent Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- azure_connected_machine_agent
 
Azure Connected Machine Agent Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- azure_cyclecloud
 
Azure CycleCloud Remote Code Execution Vulnerability2024-08-13

 
microsoft -- azure_health_bot
 
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.2024-08-13

 
microsoft -- azure_iot_hub_device_client_sdk
 
Azure IoT SDK Remote Code Execution Vulnerability2024-08-13

 
microsoft -- azure_iot_hub_device_client_sdk
 
Azure IoT SDK Remote Code Execution Vulnerability2024-08-13

 
microsoft -- azure_stack_hub
 
Azure Stack Hub Spoofing Vulnerability2024-08-13

 
microsoft -- azure_stack_hub
 
Azure Stack Hub Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- dynamics_365
 
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability2024-08-13

 
microsoft -- officeplus
 
Microsoft OfficePlus Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- remote_desktop
 
Clipboard Virtual Channel Extension Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows TCP/IP Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Kerberos Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows IP Routing Management Snapin Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows IP Routing Management Snapin Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows IP Routing Management Snapin Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows SmartScreen Security Feature Bypass Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Kernel Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
NTFS Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Network Address Translation (NAT) Denial of Service Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Hyper-V Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Network Address Translation (NAT) Denial of Service Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Secure Kernel Mode Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows OLE Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Kernel Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Scripting Engine Memory Corruption Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Common Log File System Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Print Spooler Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Windows Network Virtualization Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Windows Network Virtualization Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1607
 
Kernel Streaming Service Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1809
 
Windows Kernel Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1809
 
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1809
 
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_21h2
 
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_21h2
 
Microsoft DWM Core Library Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_21h2
 
Windows DWM Core Library Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_11_21h2
 
Windows Secure Channel Denial of Service Vulnerability2024-08-13

 
microsoft -- windows_11_22h2
 
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_server_2008
 
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_server_2008
 
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_server_2008
 
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_server_2008
 
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_server_2008
 
Windows DNS Spoofing Vulnerability2024-08-13

 
microsoft -- windows_server_2016
 
Windows Deployment Services Remote Code Execution Vulnerability2024-08-13

 
Microsoft--Microsoft Edge (Chromium-based)
 
Microsoft Edge (HTML-based) Memory Corruption Vulnerability2024-08-12

 
Microsoft--Windows Server 2022
 
Windows Update Stack Elevation of Privilege Vulnerability2024-08-14

 
Muhammad Rehman--Contact Form 7 Summary and Print
 
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Muhammad Rehman Contact Form 7 Summary and Print allows Stored XSS.This issue affects Contact Form 7 Summary and Print: from n/a through 1.2.5.2024-08-13

 
MultiVendorX--WC Marketplace
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Reflected XSS.This issue affects WC Marketplace: from n/a through 4.1.17.2024-08-12

 
n/a--Intel(R) Core(TM) Ultra Processor stream cache mechanism
 
Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters
 
Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters
 
Improper input validation in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters
 
Out-of-bounds write in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters
 
Wrap-around error in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters
 
Improper access control in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) FPGA products
 
improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) NUC
 
Improper input validation in firmware for some Intel(R) NUC may allow a privileged user to potentially enableescalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Processor
 
Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Processors stream cache mechanism
 
Improper isolation in some Intel(R) Processors stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Server Board S2600ST Family firmware
 
Improper input validation in kernel mode driver for some Intel(R) Server Board S2600ST Family firmware before version 02.01.0017 may allow a privileged user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) TDX module software
 
Insufficient control flow management in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC
 
Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--n/a
 
Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.2024-08-15



 
n/a--n/a
 
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature.2024-08-15


 
n/a--n/a
 
izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.2024-08-12


 
n/a--n/a
 
A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "email" parameter.2024-08-12


 
n/a--n/a
 
An Unrestricted file upload vulnerability was found in "/Membership/edit_member.php" of Kashipara Live Membership System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-08-12

 
n/a--n/a
 
A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email or password Login parameters.2024-08-12


 
n/a--n/a
 
Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.2024-08-12

 
n/a--n/a
 
AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php.2024-08-12


 
n/a--n/a
 
An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.2024-08-12

 
n/a--n/a
 
An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.2024-08-12

 
n/a--n/a
 
A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with root privileges.2024-08-16

 
n/a--n/a
 
H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.2024-08-16


 
n/a--n/a
 
An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.2024-08-12

 
n/a--n/a
 
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.2024-08-15


 
n/a--n/a
 
Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 to 7D25v19, and 7D25v1A to 7D25v1H was discovered to contain a write-what-where condition in the in the SW handler for SMI 0xE3. Motherboard's with the following chipsets are affected: Intel 300, Intel 400, Intel 500, Intel 600, Intel 700, AMD 300, AMD 400, AMD 500, AMD 600 and AMD 700.2024-08-12


 
n/a--n/a
 
A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL commands via the "eid" parameter.2024-08-12


 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administrator into deleting valid member data via a crafted HTML page, as demonstrated by a Delete Member action at the /delete_members.php.2024-08-12


 
n/a--n/a
 
Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the search function in the import component.2024-08-12

 
n/a--n/a
 
File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary code via the /nssys/common/Upload. Aspx? Action=DNPageAjaxPostBack component2024-08-15

 
n/a--n/a
 
VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.2024-08-16

 
n/a--n/a
 
In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a WPA2 four-way handshake. This lack of validation leads to a stack buffer overflow. This can result in remote code execution within the kernel. This affects Amp, Arc, Arc SL, Beam, Beam Gen 2, Beam SL, and Five.2024-08-12

 
n/a--n/a
 
An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-middle attackers.2024-08-13


 
n/a--n/a
 
A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.2024-08-12

 
n/a--n/a
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-13

 
n/a--n/a
 
VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.2024-08-16

 
nickboss--WordPress File Upload
 
The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.2024-08-16





 
NixOS--calamares-nixos-extensions
 
calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical installer who used manual disk partitioning to create a setup where the system was booted via legacy BIOS rather than UEFI; some disk partitions are encrypted; but the partitions containing either `/` or `/boot` are unencrypted; have their LUKS disk encryption key file in plain text either in `/crypto_keyfile.bin`, or in a CPIO archive attached to their NixOS initrd. `nixos-install` is not affected, nor are UEFI installations, nor was the default automatic partitioning configuration on legacy BIOS systems. The problem has been fixed in calamares-nixos-extensions 0.3.17, which was included in NixOS. The current installer images for the NixOS 24.05 and unstable (24.11) channels are unaffected. The fix reached 24.05 at 2024-08-13 20:06:59 UTC, and unstable at 2024-08-15 09:00:20 UTC. Installer images downloaded before those times may be vulnerable. The best solution for affected users is probably to back up their data and do a complete reinstallation. However, the mitigation procedure in GHSA-3rvf-24q2-24ww should work solely for the case where `/` is encrypted but `/boot` is not. If `/` is unencrypted, then the `/crypto_keyfile.bin` file will need to be deleted in addition to the remediation steps in the previous advisory. This issue is a partial regression of CVE-2023-36476 / GHSA-3rvf-24q2-24ww, which was more severe as it applied to the default configuration on BIOS systems.2024-08-16





 
NVIDIA--Mellanox OS
 
NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.2024-08-12

 
-- openeclass
 
The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RCE on the backend server, since the upload location is accessible from the internet. This vulnerability is fixed in 3.16.2024-08-12


 
openfga--openfga
 
OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release.2024-08-12

 
openhab--openhab-webui
 
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this proxy-feature can also be exploited as a Cross-Site Scripting (XSS) vulnerability, as an attacker is able to re-route a request to their server and return a page with malicious JavaScript code. Since the browser receives this data directly from the openHAB CometVisu UI, this JavaScript code will be executed with the origin of the CometVisu UI. This allows an attacker to exploit call endpoints on an openHAB server even if the openHAB server is located in a private network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.) This issue may lead up to Remote Code Execution (RCE) when chained with other vulnerabilities. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.2024-08-12



 
openhab--openhab-webui
 
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch.2024-08-12


 
opentext -- directory_services
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This issue affects OpenText Directory Services: from 16.4.2 before 24.1.2024-08-12

 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been classified as problematic. This affects the function save_users of the file admin/user/index.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- clinics_patient_management_system
 
A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicine_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-13




 
oretnom23 -- clinics_patient_management_system
 
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /update_medicine.php. The manipulation of the argument hidden_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-13




 
oretnom23 -- clinics_patient_management_system
 
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user_images/. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-14




 
oretnom23 -- clinics_patient_management_system
 
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/check_medicine_name.php. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-14




 
Parcel Panel--ParcelPanel
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Parcel Panel ParcelPanel allows Reflected XSS.This issue affects ParcelPanel: from n/a through 4.3.2.2024-08-12

 
Pepperl+Fuchs--ICDM-RX/TCP-DB9/RJ45-DIN
 
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.2024-08-13

 
Pepperl+Fuchs--ICDM-RX/TCP-DB9/RJ45-DIN
 
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.2024-08-13

 
PHOENIX CONTACT--CHARX SEC-3000
 
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user "user-app" to the default password.2024-08-13

 
Phoenix Contact--CHARX SEC-3000 (1139022)
 
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.2024-08-13

 
Pierre Lebedel--Kodex Posts likes
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes allows Reflected XSS.This issue affects Kodex Posts likes: from n/a through 2.5.0.2024-08-12

 
projectsend -- projectsend
 
A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component.2024-08-12





 
pxlrbt--filament-excel
 
Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3.2024-08-12


 
rabilal--JS Help Desk The Ultimate Help Desk & Support Plugin
 
The JS Help Desk - The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added.2024-08-13






 
realmag777--HUSKY
 
Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.2024-08-13

 
Red Hat--Fence Agents Remediation Operator
 
A flaw was found in fence agents that rely on SSH/Telnet. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting  --ssh-path/--telnet-path arguments to execute arbitrary commands on the operator's pod. This RCE leads to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges.2024-08-12


 
redhat -- openshift_ai
 
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources.2024-08-12


 
rems -- accounts_manager_app
 
A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknown processing of the file /endpoint/delete-account.php. The manipulation of the argument account leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-13




 
rems -- daily_calories_monitoring_tool
 
Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php."2024-08-12


 
rems -- leads_manager_tool
 
A vulnerability was found in SourceCodester Leads Manager Tool 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/delete-leads.php of the component Delete Leads Handler. The manipulation of the argument leads leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
Roland Barker, xnau webdesign--Participants Database
 
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.2024-08-13

 
samsung -- magicinfo_9_server
 
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.2024-08-12

 
SAP_SE--SAP BEx Web Java Runtime Export Web Service
 
BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.2024-08-13


 
SAP_SE--SAP BusinessObjects Business Intelligence Platform
 
In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.2024-08-13


 
SAP_SE--SAP Commerce Cloud
 
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.2024-08-13


 
Scooter Software--Beyond Compare
 
A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The real existence of this vulnerability is still doubted at the moment. NOTE: The vendor explains that a system must be breached before exploiting this issue.2024-08-16



 
SECOM--Dr.ID Access control system
 
Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.2024-08-14


 
SECOM--Dr.ID Attendance system
 
Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.2024-08-14


 
Sender--Sender Newsletter, SMS and Email Marketing Automation for WooCommerce
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sender Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce allows Reflected XSS.This issue affects Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.14.2024-08-12

 
siemens -- location_intelligence
 
A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.2024-08-13

 
siemens -- sinec_nms
 
A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command queue. This could allow an authenticated attacker to execute OS commands with elevated privileges.2024-08-13

 
siemens -- sinec_nms
 
A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and elevate their privileges on the application.2024-08-13

 
siemens -- sinec_nms
 
A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges.2024-08-13

 
siemens -- sinec_traffic_analyzer
 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts the container's root filesystem with read and write privileges. This could allow an attacker to alter the container's filesystem leading to unauthorized modifications and data corruption.2024-08-13

 
siemens -- sinec_traffic_analyzer
 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate user credentials or keys.2024-08-13

 
Siemens--JT2Go
 
The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.2024-08-12


 
Siemens--NX
 
A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.2024-08-13

 
Siemens--RUGGEDCOM RM1224 LTE(4G) EU
 
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly validate input in specific VPN configuration fields. This could allow an authenticated remote attacker to execute arbitrary code on the device.2024-08-13

 
Siemens--RUGGEDCOM RM1224 LTE(4G) EU
 
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices.2024-08-13

 
skyportlabs--skyportd
 
Skyport Daemon (skyportd) is the daemon for the Skyport Panel. By making thousands of folders & files (easy due to skyport's lack of rate limiting on createFolder. createFile), skyportd in a lot of cases will cause 100% CPU usage and an OOM, probably crashing the system. This is fixed in 0.2.2.2024-08-12

 
solarwinds -- web_help_desk
 
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.   However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.2024-08-13


 
SourceCodester--Simple Online Bidding System
 
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Simple Online Bidding System
 
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
TagDiv--tagDiv Opt-In Builder
 
The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'create_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-08-17


 
TagDiv--tagDiv Opt-In Builder
 
The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-08-17


 
tc39--ecma262
 
ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants. The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section. ## References - https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://issues.chromium.org/issues/346692561 - https://www.cve.org/CVERecord?id=CVE-2024-76522024-08-15










 
Team Johnlong software--Raiden MAILD Remote Management System
 
Raiden MAILD Remote Management System from Team Johnlong Software has a Relative Path Traversal vulnerability, allowing unauthenticated remote attackers to read arbitrary file on the remote server.2024-08-12


 
TeamT5--ThreatSonar Anti-Ransomware
 
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.2024-08-12


 
TECNO--com.transsion.carlcare
 
Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks.2024-08-12


 
tenda -- fh1201_firmware
 
An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the Go parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the mit_pptpusrpw parameter in the fromWizardHandle function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tenda -- fh1206_firmware
 
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the modino parameter in the fromPptpUserAdd function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
Tenda--FH1206
 
A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12




 
Tenda--FH1206
 
A vulnerability was found in Tenda FH1206 1.2.0.8(8155). It has been classified as critical. Affected is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12




 
Tenda--FH1206
 
A vulnerability was found in Tenda FH1206 1.2.0.8. It has been declared as critical. Affected by this vulnerability is the function fromSafeClientFilter/fromSafeMacFilter/fromSafeUrlFilter. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12




 
Tenda--FH1206
 
A vulnerability was found in Tenda FH1206 02.03.01.35 and classified as critical. Affected by this issue is the function formSafeEmailFilter of the file /goform/SafeEmailFilter of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-13




 
tendacn -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tendacn -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromAddressNat function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tendacn -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tendacn -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPW parameter in the fromWizardHandle function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
tendacn -- fh1201_firmware
 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.2024-08-15

 
Themewinter--WPCafe
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through 2.2.28.2024-08-13

 
thiagosf--Skitter Slideshow
 
The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.2024-08-17



 
Tosei--Online Store Management System 
 
A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17




 
totolink -- a3002r_firmware
 
TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.2024-08-12

 
totolink -- a3100r_firmware
 
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.2024-08-12

 
totolink -- a3100r_firmware
 
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.2024-08-12

 
totolink -- a3700r_firmware
 
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.2024-08-12

 
totolink -- a3700r_firmware
 
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.2024-08-12

 
totolink -- lr350_firmware
 
Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.2024-08-15

 
totolink -- n350rt_firmware
 
Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.2024-08-15

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-13

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-13

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-13

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
totolink -- x5000r_firmware
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-12

 
veribase -- order_management
 
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection.This issue affects Veribase Order Management: before v4.010.2.2024-08-12

 
Vonets--VAR1200-H
 
Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated remote attacker to execute arbitrary code.2024-08-12

 
Vonets--VAR1200-H
 
Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters.2024-08-12

 
Vonets--VAR1200-H
 
Improper check or handling of exceptional conditions vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated remote attacker to cause a denial of service. A specially-crafted HTTP request to pre-authentication resources can crash the service.2024-08-12

 
Vonets--VAR1200-H
 
Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication and factory reset the device via unprotected goform endpoints.2024-08-12

 
Vonets--VAR1200-H
 
An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session.2024-08-12

 
Vonets--VAR1200-H
 
A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to read arbitrary files and bypass authentication.2024-08-12

 
wanglongcn--ltcms
 
A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-13




 
wanglongcn--ltcms
 
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-13




 
wanglongcn--ltcms
 
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-13




 
WofficeIO--Woffice
 
Improper Privilege Management vulnerability in WofficeIO Woffice allows Privilege Escalation.This issue affects Woffice: from n/a through 5.4.10.2024-08-13

 
WP Swings--Wallet System for WooCommerce
 
Missing Authorization vulnerability in WP Swings Wallet System for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wallet System for WooCommerce: from n/a through 2.5.13.2024-08-13

 
WPFactory--Products, Order & Customers Export for WooCommerce
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPFactory Products, Order & Customers Export for WooCommerce allows Reflected XSS.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.11.2024-08-12

 
WPWeb--Docket (WooCommerce Collections / Wishlist / Watchlist)
 
Incorrect Authorization vulnerability in WPWeb Docket (WooCommerce Collections / Wishlist / Watchlist) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket (WooCommerce Collections / Wishlist / Watchlist): from n/a before 1.7.0.2024-08-13

 
WPWeb--WooCommerce - Social Login
 
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.2024-08-12


 
WPWeb--WooCommerce PDF Vouchers
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.2024-08-13

 
wurmlab -- sequenceserver
 
SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.2024-08-14


 
xpeedstudio--MetForm Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
 
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending with a benign extension, which may make remote code execution possible in some configurations.2024-08-17



 
xwikisas--xwiki-pro-macros
 
Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1.2024-08-12



 
Zabbix--Zabbix
 
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.2024-08-12

 
Zabbix--Zabbix
 
Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.2024-08-12

 
Zabbix--Zabbix
 
The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.2024-08-12

 
Zabbix--Zabbix
 
Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system.2024-08-12

 
zimbra -- collaboration
 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.2024-08-12


 
zimbra -- collaboration
 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory.2024-08-12


 
zohocorp -- manageengine_adaudit_plus
 
Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.2024-08-12

 
zohocorp -- manageengine_adaudit_plus
 
Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.2024-08-12

 
zohocorp -- manageengine_adaudit_plus
 
Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option.2024-08-12

 
zohocorp -- manageengine_adaudit_plus
 
Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration.2024-08-12

 
ZoneMinder--zoneminder
 
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.2024-08-12





 
ZoneMinder--zoneminder
 
ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.2024-08-12



 
Zoom Communications Inc.--Zoom Workplace Apps and Rooms Clients
 
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps and SDKs
 
Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.2024-08-14

 

Back to top

Medium Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
2j-slideshow--Slideshow, Image Slider by 2J
 
The Slideshow, Image Slider by 2J plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in versions up to, and including, 1.3.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-08-17


 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- acrobat
 
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor unauthorised actions on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation of this issue requires user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- commerce
 
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to an application denial-of-service condition. An attacker could exploit this vulnerability to render the application unresponsive or terminate its execution. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- illustrator
 
Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- substance_3d_sampler
 
Substance3D - Sampler versions 4.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- substance_3d_sampler
 
Substance3D - Sampler versions 4.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- substance_3d_sampler
 
Substance3D - Sampler versions 4.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
adobe -- substance_3d_sampler
 
Substance3D - Sampler versions 4.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Bridge
 
Bridge versions 13.0.8, 14.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Dimension
 
Dimension versions 3.4.11 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Dimension
 
Dimension versions 3.4.11 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--Dimension
 
Dimension versions 3.4.11 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a DoS condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
Adobe--InDesign Desktop
 
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-08-14

 
aio-libs--aiohttp
 
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.2024-08-12





 
airveda -- pm2.5_pm10_monitor_firmware
 
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this vulnerability could allow the attacker to cause Evil Twin attack on the targeted system.2024-08-12

 
algoritmika--Download Plugins and Themes in ZIP from Dashboard
 
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This makes it possible for unauthenticated attackers to download arbitrary themes from the website via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. In versions prior to 1.8.6 it was possible to download the entire sites files.2024-08-16


 
AMD--AMD EPYC 7001 Processors
 
Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access to AMD signing keys to c006Frrupt the return address, causing a stack-based buffer overrun, potentially leading to a denial of service.2024-08-13

 
AMD--AMD EPYC 7001 Series Processors
 
Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution privilege in ASP to extract ASP cryptographic keys, potentially resulting in loss of confidentiality and integrity.2024-08-13

 
AMD--AMD EPYC 7003 Series Processors
 
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to read or modify hypervisor memory, potentially resulting in loss of confidentiality, integrity, and availability.2024-08-13

 
AMD--AMD EPYC 7003 Processors
 
IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest integrity.2024-08-13

 
AMD--AMD EPYC 7003 Processors
 
Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, potentially resulting in loss of data integrity.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set temperature input selection" command, potentially resulting in a loss of integrity and/or availability.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
An insufficient DRAM address validation in PMFW may allow a privileged attacker to read from an invalid DRAM address to SRAM, potentially resulting in data corruption or denial of service.2024-08-13

 
AMD--AMD Ryzen 5000 Series Desktop Processor with Radeon Graphics
 
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to a loss of integrity and availability.2024-08-13


 
AMD--Zynq UltraScale+ MPSoC/RFSoC
 
Improper input validation in ARM® Trusted Firmware used in AMD's Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, potentially resulting in data leakage and denial of service.2024-08-13

 
Antoine Hurkmans--Football Pool
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.9.2024-08-12

 
Antoine Hurkmans--Football Pool
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.10.2024-08-12

 
Averta--Depicter Slider
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.1.2.2024-08-12

 
AxtonYao--MDx
 
The MDx theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdx_list_item' shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-12



 
basecamp--trix
 
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event's `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn't have a `text/html` content type. Trix then uses the attachment content to set the attachment element's `innerHTML`. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.2024-08-14






 
bdthemes--Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
 
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.2024-08-12


 
bdthemes--Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
 
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-12


 
bdthemes--Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
 
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Gallery and Countdown widgets in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-13








 
binhnguyenplus--LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing
 
The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.2024-08-17




 
Blockspare--Blockspare
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Blockspare allows Stored XSS.This issue affects Blockspare: from n/a through 3.2.0.2024-08-12

 
bPlugins--StreamCast
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins StreamCast allows Stored XSS.This issue affects StreamCast: from n/a through 2.2.3.2024-08-12

 
Brainstorm Force--Spectra
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Spectra allows Stored XSS.This issue affects Spectra: from n/a through 2.14.1.2024-08-12

 
Brainstorm Force--Ultimate Addons for Beaver Builder Lite
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder - Lite allows Stored XSS.This issue affects Ultimate Addons for Beaver Builder - Lite: from n/a through 1.5.9.2024-08-12

 
Bricks Builder--Bricks
 
The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'reset_settings' function. This makes it possible for unauthenticated attackers to reset the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-17


 
Bricks Builder--Bricks
 
The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'save_settings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including enabling a setting which allows lower-privileged users such as contributors to perform code execution, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-17


 
cilium--cilium
 
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.2024-08-15



 
cilium--cilium
 
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could lead to Gateway resources being able to access secrets for longer than intended, or to Routes having the ability to forward traffic to backends in other namespaces for longer than intended. This issue has been patched in Cilium v1.15.8 and v1.16.1. As a workaround, any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (for example, adding any label to any of these resources) will trigger a reconciliation of ReferenceGrants on an affected cluster.2024-08-16



 
cilium--cilium
 
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue.2024-08-15



 
codersaiful--Sheet to Table Live Sync for Google Sheet
 
The Sheet to Table Live Sync for Google Sheet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STWT_Sheet_Table shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-14




 
coffee2code--Linkify Text
 
The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own and requires another vulnerability to be present for damage to an affected website.2024-08-12


 
coffee2code--No Update Nag
 
The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-12


 
coffee2code--Obfuscate Email
 
The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-12


 
coffee2code--Reveal Template
 
The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-12


 
contrid--Newsletters
 
The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing direct access to the /vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-15



 
CORDEA--oauth
 
In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected resources. While `state` isn't exactly a cryptographic value, it should be generated in a cryptographically secure way. `generateState` should be using a CSPRNG. Version 0.11 modifies the `generateState` function to generate `state` values of at least 128 bits of entropy while using a CSPRNG.2024-08-15


 
CORDEA--oauth
 
In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the `state` parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the `state` parameter using a regular `if` statement or `doAssert` instead of relying on a plain `assert`. `doAssert` will achieve the desired behavior even if `-d:danger` or `--assertions:off` is set.2024-08-15



 
CreativeMindsSolutions--CM Tooltip Glossary
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.7.2024-08-12

 
Crocoblock--JetBlocks for Elementor
 
The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-16


 
Crocoblock--JetElements
 
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-16


 
Crocoblock--JetSearch
 
The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-16


 
cservit--affiliate-toolkit WordPress Affiliate Plugin
 
The affiliate-toolkit - WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due display_errors being set to true . This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-12


 
cyberfoxdigital--Christmasify!
 
The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-12


 
D-Link--DI-8100
 
A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter.asp. The manipulation of the argument path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
David Maucher--Send Users Email
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Maucher Send Users Email allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Send Users Email: from n/a through 1.5.1.2024-08-13

 
Dell--Dell Client Platform BIOS
 
Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.2024-08-14

 
Devikia--DevikaAI
 
A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input.2024-08-14

 
Directus--Directus
 
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.2024-08-15


 
Directus--Directus
 
Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.2024-08-15


 
edgarrojas--PDF Builder for WPForms
 
The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-12



 
elabftw--elabftw
 
eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one might disallow user creation except for by system administrators, administrators and trusted services. If administrators are allowed to create new users (which is the default), the vulnerability allows any user to create new users in teams where they are members. The new users are automatically validated and administrators are not notified. This can allow a user with permanent or temporary access to a user account or API key to maintain persistence in an eLabFTW system. Additionally, it allows the user to create separate account under a different name, and produce misleading revision histories. No additional privileges are granted to the new user. Users should upgrade to version 5.0.0 to receive a patch. As a workaround, disabling both options that allow *administrators* to create users will provide a mitigation.2024-08-15

 
Ericsson--Ericsson RAN Compute Basebands (all BB variants)
 
Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code execution, for example to obtain a Linux Shell with the same privileges as the attacker. The attacker would require elevated privileges for example a valid OAM user having the system administrator role to exploit the vulnerability.2024-08-16

 
esthertyler--My Custom CSS PHP & ADS
 
The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file displaying/generating the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-12


 
f1logic--Insert PHP Code Snippet
 
The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactivate and delete code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-15



 
F5--BIG-IP
 
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
F5--BIG-IP
 
Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
F5--BIG-IP Next Central Manager
 
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
F5--BIG-IP Next Central Manager
 
When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
F5--NGINX Open Source
 
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.2024-08-14

 
Firewalla--Box Software
 
Multiple authenticated operating system (OS) command injection vulnerabilities exist in Firewalla Box Software versions before 1.979. A physically close attacker that is authenticated to the Bluetooth Low-Energy (BTLE) interface can use the network configuration service to inject commands in various configuration parameters including networkConfig.Interface.Phy.Eth0.Extra.PingTestIP, networkConfig.Interface.Phy.Eth0.Extra.DNSTestDomain, and networkConfig.Interface.Phy.Eth0.Gateway6. Additionally, because the configuration can be synced to the Firewalla cloud, the attacker may be able to persist access even after hardware resets and firmware re-flashes.2024-08-12

 
fish-shop--syntax-check
 
fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.2024-08-12



 
FIWARE--FIWARE Keyrock
 
Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link.2024-08-12

 
FIWARE--FIWARE Keyrock
 
Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.2024-08-12

 
Fortinet--FortiDDoS
 
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.2024-08-13

 
Fortinet--FortiManager
 
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.2024-08-13

 
Fortinet--FortiOS
 
An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system.2024-08-13

 
Fortinet--FortiSOAR
 
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web script or HTML via the Communications module.2024-08-13

 
Fortra--GoAnywhere MFT
 
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.2024-08-14

 
freebsd -- freebsd
 
When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir(3) and related functions to return filesystem entries with names containing additional path components. The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.2024-08-12

 
Fujian--mwcms
 
A vulnerability was found in Fujian mwcms 1.0.0. It has been declared as critical. Affected by this vulnerability is the function uploadeditor of the file /uploadeditor.html?action=uploadimage of the component Image Upload. The manipulation of the argument upfile leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12




 
Fujian--mwcms
 
A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12




 
gfazioli--WP Bannerize Pro
 
The WP Bannerize Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via banner alt data in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-08-13


 
gilacms -- gila_cms
 
A vulnerability classified as problematic was found in Gila CMS 1.10.9. This vulnerability affects unknown code of the file /cm/update_rows/page?id=2 of the component HTTP POST Request Handler. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12



 
gncchome -- gncc_c2_firmware
 
Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root password for all similar devices2024-08-15


 
gncchome -- gncc_c2_firmware
 
Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugging Port.2024-08-15


 
gncchome -- gncc_c2_firmware
 
Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Port.2024-08-15


 
gravitymaster97--Custom Field For WP Job Manager
 
The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.2024-08-16


 
HashiCorp--Nomad
 
In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.2024-08-15

 
humanityco--Cookie Notice & Compliance for GDPR / CCPA
 
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookie_notice_options[refuse_code_head]' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected /wp-admin/admin.php?page=cookie-notice page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-08-16


 
iberezansky--3D FlipBook PDF Flipbook Viewer, Flipbook Image Gallery
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iberezansky 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery allows Stored XSS.This issue affects 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through 1.15.6.2024-08-12

 
ibm -- infosphere_information_server
 
IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM X-Force ID: 298279.2024-08-15


 
ibm -- infosphere_information_server
 
IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. IBM X-Force ID: 298277.2024-08-15


 
IBM--Aspera Shares
 
IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574.2024-08-12

 
IBM--Common Licensing
 
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 350348.2024-08-13


 
IBM--Db2 for Linux, UNIX and Windows
 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. IBM X-Force ID: 292639.2024-08-14


 
IBM--Db2 for Linux, UNIX and Windows
 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. IBM X-Force ID: 294295.2024-08-14


 
IBM--Db2 for Linux, UNIX and Windows
 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287614.2024-08-14


 
IBM--Db2 for Linux, UNIX and Windows
 
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 291307.2024-08-14


 
IBM--QRadar Network Packet Capture
 
IBM QRadar Network Packet Capture 7.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 289858.2024-08-15


 
IBM--QRadar Suite Software
 
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430.2024-08-15


 
IBM--QRadar Suite Software
 
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly during back-end commands which may result in the unexpected disclosure of this information. IBM X-Force ID: 287173.2024-08-14


 
IBM--QRadar Suite Software
 
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another user to obtain sensitive information. IBM X-Force ID: 233672.2024-08-13


 
IBM--QRadar Suite Software
 
IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request. This information could be used in further attacks against the system. IBM X-Force ID: 272201.2024-08-16


 
IBM--SDK, Java Technology Edition
 
The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads. IBM X-Force ID: 284573.2024-08-14


 
IBM--WebSphere Application Liberty
 
IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274713.2024-08-14


 
IBM--WebSphere Application Server
 
IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714.2024-08-14


 
Igor Beni--Recipe Maker For Your Food Blog from Zip Recipes
 
Missing Authorization vulnerability in Igor Benić Recipe Maker For Your Food Blog from Zip Recipes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.2.6.2024-08-13

 
Iqonic Design--Graphina
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Iqonic Design Graphina allows Stored XSS.This issue affects Graphina: from n/a through 1.8.10.2024-08-12

 
itsourcecode--Vehicle Management System
 
A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file mybill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-14




 
Jeroen Sormani--WP Dashboard Notes
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XSS.This issue affects WP Dashboard Notes: from n/a through 1.0.11.2024-08-12

 
JetBrains--TeamCity
 
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page2024-08-16

 
JetBrains--TeamCity
 
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin2024-08-16

 
jfarthing84--Theme My Login
 
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances.2024-08-16


 
kaizencoders--Short URL
 
The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configuration_page function. This makes it possible for unauthenticated attackers to add and import redirects, including comments containing cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-17


 
krut1--LOGIN AND REGISTRATION ATTEMPTS LIMIT
 
The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.2024-08-17


 
LA-Studio--LA-Studio Element Kit for Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.9.2.2024-08-12

 
Lenovo--Printers
 
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer communications until the system is rebooted.2024-08-16

 
Lenovo--Printers
 
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to disrupt the printer's functionality until a manual system reboot occurs.2024-08-16

 
Lenovo--Printers
 
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printing capabilities until the system is rebooted.2024-08-16

 
Lenovo--Printers
 
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to prevent printer services from being reachable until the system is rebooted.2024-08-16

 
Lenovo--Printers
 
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connections until the system is rebooted.2024-08-16

 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") didn't work for x86_32 [1]. It is because x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT. !CONFIG_64BIT should cover all 32 bit machines. [1] https://lore.kernel.org/linux-mm/CAHbLzkr1LwH3pcTgM+aGQ31ip2bKqiqEQ8=FQB+t2c3dhNKNHA@mail.gmail.com/2024-08-12




 
MagePeople Team--Event Manager for WooCommerce
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.2024-08-13

 
mayurik -- best_house_rental_management_system
 
A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote attackers to execute arbitrary code via "House_no" and "Description" parameter fields.2024-08-12


 
mayurik -- best_house_rental_management_system
 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0.2024-08-12


 
MBE Worldwide S.p.A.--MBE eShip
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MBE Worldwide S.P.A. MBE eShip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MBE eShip: from n/a through 2.1.2.2024-08-13

 
Mediavine--Mediavine Control Panel
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mediavine Mediavine Control Panel allows Stored XSS.This issue affects Mediavine Control Panel: from n/a through 2.10.4.2024-08-12

 
Merkulove--Selection Lite
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Merkulove Selection Lite allows Stored XSS.This issue affects Selection Lite: from n/a through 1.11.2024-08-12

 
microsoft -- .net
 
.NET and Visual Studio Information Disclosure Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft Outlook Remote Code Execution Vulnerability2024-08-13

 
microsoft -- 365_apps
 
Microsoft Office Spoofing Vulnerability2024-08-12

 
microsoft -- teams
 
Microsoft Teams for iOS Spoofing Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Mark of the Web Security Feature Bypass Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Initial Machine Configuration Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows Kernel Information Disclosure Vulnerability2024-08-13

 
microsoft -- windows_10_1507
 
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability2024-08-13

 
microsoft -- windows_10_1809
 
Windows Mobile Broadband Driver Remote Code Execution Vulnerability2024-08-13

 
microsoft -- windows_10_1809
 
Security Center Broker Information Disclosure Vulnerability2024-08-13

 
microsoft -- windows_11_22h2
 
Windows Compressed Folder Tampering Vulnerability2024-08-13

 
microsoft -- windows_11_24h2
 
Windows Bluetooth Driver Information Disclosure Vulnerability2024-08-13

 
microsoft -- windows_server_2008
 
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability2024-08-13

 
Microsoft--Microsoft Edge (Chromium-based)
 
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability2024-08-12

 
Microsoft--Microsoft Edge (Chromium-based)
 
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability2024-08-16

 
mongodb -- mongodb
 
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.32024-08-13

 
msaari--Relevanssi A Better Search
 
The Relevanssi - A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 via the relevanssi_do_query() due to insufficient limitations on the posts that are returned when searching. This makes it possible for unauthenticated attackers to extract potentially sensitive information from password protected posts.2024-08-16


 
n/a--3rd Generation Intel(R) Xeon(R) Scalable Processors
 
Mirrored regions with different values in 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.2024-08-14

 
n/a--3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors
 
Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--BMRA software
 
Inadequate encryption strength for some BMRA software before version 22.08 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--EMON software
 
Uncontrolled search path in some EMON software before version 11.44 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Flexlm License Daemons for Intel(R) FPGA software
 
Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--InnoCMS
 
A vulnerability, which was classified as critical, has been found in InnoCMS 0.3.1. This issue affects some unknown processing of the file /panel/pages/1/edit of the component Backend. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17




 
n/a--installation software for Intel(R) Ethernet Adapter Driver Pack
 
Uncontrolled search path element in some installation software for Intel(R) Ethernet Adapter Driver Pack before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel Unite(R) Client Extended Display Plugin software installers
 
Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Advisor software
 
Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) AMT and Intel(R) Standard Manageability
 
Improper buffer restrictions in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable denial of service via network access.2024-08-14

 
n/a--Intel(R) Arc(TM) & Iris(R) Xe Graphics software
 
Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) CIP software
 
Improper access control for some Intel(R) CIP software before version 2.4.10717 may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) Connectivity Performance Suite software installers
 
Incorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) CSME
 
Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege via physical access.2024-08-14

 
n/a--Intel(R) CSME
 
Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) CSME
 
Integer overflow in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable denial of service via adjacent access.2024-08-14

 
n/a--Intel(R) Data Center GPU Max Series 1100 and 1550 products
 
Improper conditions check in some Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow a privileged user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) Distribution for GDB software
 
Uncontrolled search path in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Distribution for GDB software
 
Incorrect default permissions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Distribution for GDB software
 
Improper buffer restrictions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) Ethernet Connection I219-LM install software
 
Uncontrolled search path in some Intel(R) Ethernet Connection I219-LM install software may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters E810 Series
 
Protection mechanism failure in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 28.3 may allow an unauthenticated user to potentially enable denial of service via network access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters E810 Series
 
Protection mechanism failure in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 4.4 may allow an unauthenticated user to potentially enable denial of service via network access.2024-08-14

 
n/a--Intel(R) Ethernet Network Controllers and Adapters E810 Series
 
Improper conditions check in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 28.3 may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) FPGA SDK for OpenCL(TM) software technology
 
Uncontrolled search path in some Intel(R) FPGA SDK for OpenCL(TM) software technology may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) GPA software
 
Uncontrolled search path in some Intel(R) GPA software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) HID Event Filter software installers
 
Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) High Level Synthesis Compiler software
 
Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) IPP Cryptography software
 
Uncontrolled search path for some Intel(R) IPP Cryptography software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) IPP software
 
Uncontrolled search path in some Intel(R) IPP software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) ISH software installers
 
Incorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) License Manager for FLEXlm product software
 
Uncontrolled search path for some Intel(R) License Manager for FLEXlm product software before version 11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) MAS (GUI)
 
Incorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--Intel(R) MPI Library software
 
Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) oneAPI Compiler software
 
Uncontrolled search path for some Intel(R) oneAPI Compiler software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) oneAPI Math Kernel Library software
 
Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Quartus(R) Prime Pro Edition Design Software
 
Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Server Platforms
 
Out of bounds read in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.15-0, bhs-0.27 may allow a privileged user to potentially enable information disclosure via local access.2024-08-14

 
n/a--Intel(R) Server Platforms
 
Uncaught exception in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.14-0, bhs-0.27 may allow an authenticated user to potentially enable denial of service via network access.2024-08-14

 
n/a--Intel(R) Simics Package Manager software
 
Uncontrolled search path for some Intel(R) Simics Package Manager software before version 1.8.3 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) TDX module software
 
Incomplete filtering of special elements in Intel(R) TDX module software before version TDX_1.5.01.00.592 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Trace Analyzer and Collector software
 
Uncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) VROC software
 
Uncontrolled search path for some Intel(R) VROC software before version 8.6.0.1191 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) VTune(TM) Profiler software
 
Uncontrolled search path in some Intel(R) VTune(TM) Profiler software before versions 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.2024-08-14

 
n/a--Intel(R) Xeon Processors
 
Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--n/a
 
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter.2024-08-15


 
n/a--n/a
 
Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to arbitrarily delete categories.2024-08-12


 
n/a--n/a
 
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.2024-08-12



 
n/a--n/a
 
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an unauthenticated attacker with physical access to the phone to conduct an argument injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.2024-08-13

 
n/a--n/a
 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.2024-08-13

 
n/a--n/a
 
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.2024-08-16


 
n/a--n/a
 
Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the /WebSet/DlgGridSet.html component.2024-08-15

 
n/a--n/a
 
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.2024-08-12


 
n/a--OcoMon
 
A vulnerability, which was classified as problematic, has been found in OcoMon 4.0RC1/4.0/5.0RC1. This issue affects some unknown processing of the file /includes/common/require_access_recovery.php of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.1 and 5.0 is able to address this issue. It is recommended to upgrade the affected component.2024-08-13





 
nissan-global -- blind_spot_detection_sensor_ecu_firmware
 
* Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger denial-of-service (DoS) by unauthorized access to the ECU's programming session. * No preconditions implemented for ECU management functionality through UDS session in the Blind Spot Detection Sensor ECU in Nissan Altima (2022) allows attackers to disrupt normal ECU operations by triggering a control command without authentication.2024-08-15

 
NVIDIA--NVIDIA CV-CUDA
 
NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption issue by a long running CV-CUDA Python process. A successful exploit of this vulnerability may lead to denial of service and data loss.2024-08-12

 
Olive Themes--Olive One Click Demo Import
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Olive Themes Olive One Click Demo Import allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Olive One Click Demo Import: from n/a through 1.1.2.2024-08-13

 
open-telemetry--opentelemetry-collector-contrib
 
OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time comparison in 0.107.02024-08-13



 
openhab--openhab-webui
 
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.2024-08-12


 
openhab--openhab-webui
 
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.2024-08-12



 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. This vulnerability affects the function save_package of the file admin/packages/manag_package.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is the function update_settings_info of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument contact/address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=save_package. The manipulation of the argument name/description/training_duration leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability, which was classified as critical, has been found in SourceCodester Car Driving School Management System 1.0. Affected by this issue is some unknown functionality of the file view_package.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability, which was classified as critical, was found in SourceCodester Car Driving School Management System 1.0. This affects the function delete_users of the file User.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability has been found in SourceCodester Car Driving School Management System 1.0 and classified as critical. This vulnerability affects the function delete_package of the file Master.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in SourceCodester Car Driving School Management System 1.0 and classified as critical. This issue affects the function delete_enrollment of the file Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability was found in Sourcecodester Car Driving School Management System 1.0. It has been classified as critical. Affected is the function save_package of the file /classes/Master.php?f=save_package. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability classified as critical has been found in SourceCodester Car Driving School Management System 1.0. Affected is an unknown function of the file view_details.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- car_driving_school_management_system
 
A vulnerability classified as critical was found in SourceCodester Car Driving School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_package.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
oretnom23 -- clinics_patient_management_system
 
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /update_medicine.php. The manipulation of the argument medicine_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-14




 
oretnom23 -- clinics_patient_management_system
 
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file users.php of the component User Page. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
Patrick Posner--Filr Secure document library
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Patrick Posner Filr - Secure document library allows Stored XSS.This issue affects Filr - Secure document library: from n/a through 1.2.4.2024-08-12

 
Pepperl+Fuchs--ICDM-RX/TCP-DB9/RJ45-DIN
 
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.2024-08-13

 
phpgurukul -- old_age_home_management_system
 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the "searchdata" parameter.2024-08-12

 
phpgurukul -- old_age_home_management_system
 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the Contact Us page "message" parameter.2024-08-12

 
PickPlugins--ComboBlocks
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins ComboBlocks allows Stored XSS.This issue affects ComboBlocks: from n/a through 2.2.86.2024-08-12

 
pickplugins--Gutenberg Blocks, Page Builder ComboBlocks
 
The Gutenberg Blocks, Page Builder - ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion block in all versions up to, and including, 2.2.87 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-14


 
pkp--ojs
 
A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signOut. The manipulation of the argument source with the input .example.com leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17



 
princeahmed--Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress
 
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.2024-08-17




 
princeahmed--Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress
 
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.2024-08-17




 
princeahmed--Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress
 
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_settings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings.2024-08-17




 
projectsend -- projectsend
 
A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.2024-08-12





 
PTC--Kepware ThingWorx Kepware Server
 
When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not configured correctly, could deliver a response leading to unrestricted or unregulated resource allocation. This could cause a denial-of-service condition and crash the Kepware application. By default, these functions are turned off, yet they remain accessible for users who recognize and require their advantages.2024-08-16


 
Pylons--webob
 
WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.2024-08-14


 
QNAP Systems Inc.--QTS
 
A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QuTS hero h5.1.8.2823 build 20240712 and later2024-08-12

 
Rashid87--WPSection
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8.2024-08-13

 
Red Hat--Red Hat Enterprise Linux 6
 
A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.2024-08-12




 
Red Hat--Red Hat Satellite 6
 
A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.2024-08-12


 
rems -- accounts_manager_app
 
A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function of the file /endpoint/add-account.php. The manipulation of the argument account_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-13




 
rems -- file_manager_app
 
A vulnerability has been found in SourceCodester File Manager App 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Add File Handler. The manipulation of the argument File Title/Uploaded By leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
rems -- leads_manager_tool
 
A vulnerability was found in SourceCodester Leads Manager Tool 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/add-leads.php of the component Add Leads Handler. The manipulation of the argument leads_name/phone_number leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
reputeinfosystems--ARMember Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
 
The ARMember - Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.2024-08-17




 
SAP_SE--SAP BusinessObjects Business Intelligence Platform
 
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.2024-08-13


 
SAP_SE--SAP Commerce
 
In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability2024-08-13


 
SAP_SE--SAP Commerce Backoffice
 
SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application.2024-08-13


 
SAP_SE--SAP CRM ABAP (Insights Management)
 
SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.2024-08-13


 
SAP_SE--SAP Document Builder
 
SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application.2024-08-13


 
SAP_SE--SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server
 
Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.2024-08-13


 
SAP_SE--SAP NetWeaver Application Server ABAP
 
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.2024-08-13


 
SAP_SE--SAP NetWeaver Application Server ABAP and ABAP Platform
 
Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.2024-08-13


 
SAP_SE--SAP Permit to Work
 
Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application.2024-08-13


 
SAP_SE--SAP Shared Service Framework
 
SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exploitation, an attacker can cause a high impact on confidentiality of the application.2024-08-13


 
SAP_SE--SAP Shared Service Framework
 
SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries into a non-sensitive table, causing low impact on integrity of the application2024-08-13


 
SAP_SE--SAP Student Life Cycle Management (SLcM)
 
SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to delete non-sensitive report variants that are typically restricted, causing minimal impact on the integrity of the application.2024-08-13


 
siemens -- location_intelligence
 
A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated remote attacker to conduct brute force attacks against legitimate user passwords.2024-08-13

 
siemens -- location_intelligence
 
A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords.2024-08-13

 
siemens -- sinec_nms
 
A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and modify settings in the application without authorization.2024-08-13

 
siemens -- sinec_traffic_analyzer
 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control for accessing the files. This could allow an authenticated attacker with low privilege's to get access to sensitive information.2024-08-13

 
siemens -- sinec_traffic_analyzer
 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cacheable HTTP responses in the web service. This could allow an attacker to read and modify data stored in the local cache.2024-08-13

 
siemens -- sinec_traffic_analyzer
 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missing general HTTP security headers in the web server. This could allow an attacker to make the servers more prone to clickjacking attack.2024-08-13

 
Siemens--LOGO! 12/24RCE
 
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). Affected devices store user passwords in plaintext without proper protection. This could allow a physical attacker to retrieve them from the embedded storage ICs.2024-08-13

 
Siemens--RUGGEDCOM RM1224 LTE(4G) EU
 
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices insert sensitive information about the generation of 2FA tokens into log files. This could allow an authenticated remote attacker to forge 2FA tokens of other users.2024-08-13

 
smub--Easy Digital Downloads eCommerce Payments and Subscriptions made easy
 
The Easy Digital Downloads - Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-08-12


 
Soliloquy Team--Slider by Soliloquy
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by Soliloquy allows Cross-Site Scripting (XSS).This issue affects Slider by Soliloquy: from n/a through 2.7.6.2024-08-12

 
SourceCodester--Clinics Patient Management System
 
A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System 1.0. This vulnerability affects unknown code of the file /pms/ajax/check_user_name.php. The manipulation of the argument user_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Daily Expenses Monitoring App
 
A vulnerability classified as critical has been found in SourceCodester Daily Expenses Monitoring App 1.0. This affects an unknown part of the file /endpoint/delete-expense.php. The manipulation of the argument expense leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Online Graduate Tracer System
 
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tracking/admin/view_itprofile.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Online Graduate Tracer System
 
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /tracking/admin/fetch_it.php. The manipulation of the argument request leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-16




 
SourceCodester--Online Graduate Tracer System
 
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /tracking/nbproject/. The manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Online Graduate Tracer System
 
A vulnerability, which was classified as problematic, has been found in SourceCodester Online Graduate Tracer System 1.0. This issue affects some unknown processing of the file /tracking/admin/export_it.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Online Graduate Tracer System
 
A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the file /tracking/admin/exportcs.php. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Prison Management System
 
A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Simple Online Bidding System
 
A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=delete_product. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Simple Online Bidding System
 
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Task Progress Tracker
 
A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been classified as critical. Affected is an unknown function of the file /endpoint/delete-task.php. The manipulation of the argument task leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-14




 
SourceCodester--Yoga Class Registration System
 
A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Users.php?f=save of the component Add User Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-16




 
SourceCodester--Yoga Class Registration System
 
A vulnerability was found in SourceCodester Yoga Class Registration System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=categories/view_category. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-16




 
sprecher-automation -- sprecon-e_cp-2500_firmware
 
Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection assignments.2024-08-12

 
steve-community -- steve
 
SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface.2024-08-12




 
symphony-cms -- symphony_cms
 
A Cross Site Scripting (XSS) vulnerability in Symphony CMS 2.7.10 allows remote attackers to inject arbitrary web script or HTML by editing note.2024-08-13

 
symphony-cms -- symphony_cms
 
symphonycms <=2.7.10 is vulnerable to Cross Site Scripting (XSS) in the Comment component for articles.2024-08-13

 
Techeshta--Card Elements for Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Card Elements for Elementor allows Stored XSS.This issue affects Card Elements for Elementor: from n/a through 1.2.2.2024-08-12

 
ThemeLooks--Enter Addons
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.7.2024-08-12

 
ThemeSphere--SmartMag
 
Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in ThemeSphere SmartMag allows Excavation, Accessing Functionality Not Properly Constrained by ACLs.This issue affects SmartMag: from n/a through 9.3.0.2024-08-12

 
Themeum--Tutor LMS
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.3.2024-08-12

 
Themify--Themify Shortcodes
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through 2.1.1.2024-08-12

 
ThimPress--LearnPress
 
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LearnPress: from n/a through 4.2.6.8.2.2024-08-13

 
Tosei--Online Store Management System 
 
A vulnerability was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cgi-bin/p1_ftpserver.php. The manipulation of the argument adr_txt leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17




 
Tosei--Online Store Management System 
 
A vulnerability classified as critical has been found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This affects an unknown part of the file /cgi-bin/tosei_kikai.php. The manipulation of the argument kikaibangou leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17




 
typora -- typora
 
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.2024-08-12

 
typora -- typora
 
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.2024-08-12

 
Unknown--Category Posts Widget
 
The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-08-12

 
Unknown--Generate Images
 
The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-08-13

 
Unknown--wp-cart-for-digital-products
 
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin2024-08-12

 
Unknown--wp-cart-for-digital-products
 
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin2024-08-12

 
Unknown--wp-cart-for-digital-products
 
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks2024-08-12

 
vim--vim
 
The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.2024-08-16


 
wanglongcn--ltcms
 
A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-13




 
WappPress Team--WappPress
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WappPress Team WappPress allows Stored XSS.This issue affects WappPress: from n/a through 6.0.4.2024-08-12

 
WC Product Table--WooCommerce Product Table Lite
 
Improper Control of Generation of Code ('Code Injection') vulnerability in WC Product Table WooCommerce Product Table Lite allows Code Injection.This issue affects WooCommerce Product Table Lite: from n/a through 3.5.1.2024-08-13

 
Weaver--e-cology
 
A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-12




 
Weblizar--Coming Soon
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming Soon: from n/a through 1.6.3.2024-08-13

 
WP Table Builder--WP Table Builder WordPress Table Plugin
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder - WordPress Table Plugin allows Stored XSS.This issue affects WP Table Builder - WordPress Table Plugin: from n/a through 1.4.15.2024-08-12

 
Wp2speed--WP2Speed Faster
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP2Speed Faster: from n/a through 1.0.1.2024-08-12

 
wp_media--BackWPup WordPress Backup & Restore Plugin
 
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.2024-08-17





 
WPDeveloper--BetterDocs
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.2024-08-13

 
WPDeveloper--BetterDocs
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper BetterDocs allows Stored XSS.This issue affects BetterDocs: from n/a through 3.5.8.2024-08-12

 
wpdevteam--Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders
 
The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_more_items_text' parameter in all versions up to, and including, 5.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-13






 
wpfeedback--Visual Website Collaboration, Feedback & Project Management Atarim
 
The Visual Website Collaboration, Feedback & Project Management - Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_wpfeedback_misc_options() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings which can also be leveraged to gain access to the plugin's settings.2024-08-12



 
wpmet--ElementsKit Pro
 
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-15


 
wpmet--ElementsKit Pro
 
The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' function. This can allow authenticated attackers, with Contributor-level permissions and above, to extract sensitive data including private, future, and draft posts.2024-08-15


 
wpopal--Opal Membership
 
The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-12


 
wpopal--Opal Membership
 
The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access and above, to view private notes via recent comments that should be restricted to just administrators.2024-08-12



 
Xpro--Xpro Elementor Addons
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.4.2.2024-08-12

 
Xyzscripts--Insert PHP Code Snippet
 
Cross-Site Request Forgery (CSRF) vulnerability in Xyzscripts Insert PHP Code Snippet.This issue affects Insert PHP Code Snippet: from n/a through 1.3.6.2024-08-15

 
yogeshojha--rengine
 
reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3.2024-08-16


 
Yuri Baranov--YaMaps for WordPress
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress allows Stored XSS.This issue affects YaMaps for WordPress: from n/a through 0.6.27.2024-08-12

 
yzane--vscode-markdown-pdf
 
A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-13





 
Zabbix--Zabbix
 
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.2024-08-12

 
Zabbix--Zabbix
 
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.2024-08-12

 
zimbra -- collaboration
 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.2024-08-12


 
zimbra -- collaboration
 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file and crafting a URL containing its location in the packages parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.2024-08-12


 
zimbra -- collaboration
 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in the res parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.2024-08-12


 
Zoho Campaigns--Zoho Campaigns
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho Campaigns allows Cross-Site Scripting (XSS).This issue affects Zoho Campaigns: from n/a through 2.0.8.2024-08-13

 
ZoneMinder--zoneminder
 
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61.2024-08-12



 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
 
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS
 
Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
 
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.2024-08-14

 
Zoom Communications Inc.--Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
 
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.2024-08-14

 
zvijerka--Admission AppManager
 
The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-08-17


 

Low Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
AMD--AMD EPYC 7001 Series Processors
 
Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity.2024-08-13


 
AMD--AMD EPYC 7002 Series Processors
 
Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service.2024-08-13



 
AMD--AMD EPYC 9004 Series Processors
 
Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality.2024-08-13


 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) to send a malformed message, potentially resulting in a denial of service.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)     to modify the PCIe® lane count and speed, potentially leading to a loss of availability.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug information leakage.2024-08-13

 
AMD--AMD Radeon RX 6000 Series Graphics Cards
 
Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to reuse IV values to reverse-engineer debug data, potentially resulting in information disclosure.2024-08-13

 
AMD--Prof Tool
 
Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service.2024-08-13

 
CodeAstro--Online Railway Reservation System
 
A vulnerability, which was classified as problematic, was found in CodeAstro Online Railway Reservation System 1.0. Affected is an unknown function of the file /admin/admin-add-employee.php of the component Add Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-15



 
CodeAstro--Online Railway Reservation System
 
A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-update-employee.php of the component Update Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
Fortinet--FortiPAM
 
An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.2024-08-13

 
JetBrains--TeamCity
 
In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin2024-08-16

 
JetBrains--TeamCity
 
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page2024-08-16

 
N-able--Ecosystem Agent
 
Ecosystem Agent version 4 < 4.5.1.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position.2024-08-12



 
n/a--FastCMS
 
A vulnerability, which was classified as problematic, was found in FastCMS up to 0.1.5. Affected is an unknown function of the component New Article Category Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-13



 
n/a--Intel(R) CSME
 
Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable information disclosure via local access.2024-08-14

 
n/a--Intel(R) Distribution for GDB software
 
Improper input validation for some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access.2024-08-14

 
n/a--LimeSurvey
 
A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17




 
n/a--Scada-LTS
 
A vulnerability has been found in Scada-LTS 2.7.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/app.shtm#/alarms/Scada of the component Message Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17



 
Red Hat--Red Hat Enterprise Linux 6
 
A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.2024-08-12




 
SAP_SE--SAP BusinessObjects Business Intelligence Platform
 
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.2024-08-13


 
SAP_SE--SAP BusinessObjects Business Intelligence Platform
 
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.2024-08-13


 
siemens -- sinec_nms
 
A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application contains a path traversal vulnerability. This could allow an authenticated attacker it to delete arbitrary certificate files on the drive SINEC NMS is installed on.2024-08-13

 
smub--Easy Digital Downloads eCommerce Payments and Subscriptions made easy
 
The Easy Digital Downloads - Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-08-12


 
SourceCodester--Best House Rental Management System
 
A vulnerability classified as problematic was found in SourceCodester Best House Rental Management System 1.0. This vulnerability affects unknown code of the file /rental_0/rental/ajax.php?action=save_tenant of the component POST Parameter Handler. The manipulation of the argument lastname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Kortex Lite Advocate Office Management System
 
A vulnerability classified as problematic has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected is an unknown function of the file addcase_stage.php. The manipulation of the argument cname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
SourceCodester--Kortex Lite Advocate Office Management System
 
A vulnerability classified as problematic was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this vulnerability is an unknown functionality of the file add_act.php. The manipulation of the argument aname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
SourceCodester--Kortex Lite Advocate Office Management System
 
A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file adds.php. The manipulation of the argument name/dob/email/mobile/address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
SourceCodester--Kortex Lite Advocate Office Management System
 
A vulnerability, which was classified as problematic, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file register_case.php. The manipulation of the argument title/description/opposite_lawyer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-12




 
SourceCodester--Online Graduate Tracer System
 
A vulnerability has been found in SourceCodester Online Graduate Tracer System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /tracking/admin/add_acc.php. The manipulation of the argument name/user/position leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-15




 
SourceCodester--Task Progress Tracker
 
A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-task.php. The manipulation of the argument task_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-14




 
SourceCodester--Yoga Class Registration System
 
A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-16




 
xiaohe4966--TpMeCMS
 
A vulnerability, which was classified as problematic, was found in xiaohe4966 TpMeCMS 1.3.3.2. Affected is an unknown function of the file /h.php/general/config?ref=addtabs of the component Basic Configuration Handler. The manipulation of the argument Site Name/Beian/Contact address/copyright/technical support leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-17





 
yzane--vscode-markdown-pdf
 
A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.2024-08-13





 
Zabbix--Zabbix
 
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.2024-08-12

 
Zabbix--Zabbix
 
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.2024-08-12

 

Severity Not Yet Assigned

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
Apache Software Foundation--Apache Answer
 
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.2024-08-12not yet calculated

 
Apache Software Foundation--Apache Answer
 
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked. Users are recommended to upgrade to version 1.3.6, which fixes the issue.2024-08-12not yet calculated

 
Apache Software Foundation--Apache DolphinScheduler
 
File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.2024-08-12not yet calculated

 
Apache Software Foundation--Apache MINA SSHD
 
Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.2024-08-12not yet calculated


 
AVEVA--Historian Web Server
 
AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL.2024-08-15not yet calculated

 
AVEVA--SuiteLink Server
 
If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack.2024-08-13not yet calculated

 
B&R Industrial Automation--Automation Runtime
 
Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to decrypt the SSL/TLS communication.2024-08-12not yet calculated

 
B&R Industrial Automation--Automation Runtime
 
Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filtering.2024-08-12not yet calculated

 
Celsius Benelux--ComfortKey
 
A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retrieve sensitive information about the underlying system. The vulnerability has been remediated in version 24.1.2.2024-08-14not yet calculated


 
Concrete CMS--Concrete CMS
 
Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.0 with a vector of AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator  and a CVSS v4 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N  Thanks, m3dium for reporting.2024-08-12not yet calculated




 
Concrete CMS--Concrete CMS
 
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 1.8 with vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA: N. Versions below 9 are not affected.  Thanks, m3dium for reporting.2024-08-12not yet calculated


 
Elastic--Elastic Agent
 
An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs.2024-08-12not yet calculated

 
Enphase--Envoy
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225.2024-08-12not yet calculated



 
Enphase--Envoy
 
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched.2024-08-12not yet calculated



 
Enphase--Envoy
 
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.2024-08-12not yet calculated



 
Enphase--Envoy
 
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x2024-08-12not yet calculated



 
Enphase--Envoy
 
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x2024-08-12not yet calculated



 
Enphase--IQ Gateway
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225.2024-08-12not yet calculated



 
FreeBSD--FreeBSD
 
In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation (NS) can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to match the state created by the Neighbor Discovery and allow replies to be generated. ICMPv6 packets with identifier value of zero bypass firewall rules written on the assumption that the incoming packets are going to create a state in the state table.2024-08-12not yet calculated

 
Google--Android
 
In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15not yet calculated


 
Google--Android
 
In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enabled. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15not yet calculated


 
Google--Android
 
In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15not yet calculated


 
Google--Android
 
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-15not yet calculated


 
GST Electronics--inohom Nova Panel N7
 
Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that the product is not supported.2024-08-12not yet calculated

 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix null pointer deref when receiving skb during sock creation The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set. BUG: kernel NULL pointer dereference, address: 000000000000004c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020 RIP: 0010:aa_label_next_confined+0xb/0x40 Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2 RSP: 0018:ffffa92940003b08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002 R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? aa_label_next_confined+0xb/0x40 apparmor_secmark_check+0xec/0x330 security_sock_rcv_skb+0x35/0x50 sk_filter_trim_cap+0x47/0x250 sock_queue_rcv_skb_reason+0x20/0x60 raw_rcv+0x13c/0x210 raw_local_deliver+0x1f3/0x250 ip_protocol_deliver_rcu+0x4f/0x2f0 ip_local_deliver_finish+0x76/0xa0 __netif_receive_skb_one_core+0x89/0xa0 netif_receive_skb+0x119/0x170 ? __netdev_alloc_skb+0x3d/0x140 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] __napi_poll+0x28/0x1b0 net_rx_action+0x2a4/0x380 __do_softirq+0xd1/0x2c8 __irq_exit_rcu+0xbb/0xf0 common_interrupt+0x86/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:apparmor_socket_post_create+0xb/0x200 Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48 RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286 RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748 ? __pfx_apparmor_socket_post_create+0x10/0x10 security_socket_post_create+0x4b/0x80 __sock_create+0x176/0x1f0 __sys_socket+0x89/0x100 __x64_sys_socket+0x17/0x20 do_syscall_64+0x5d/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. [Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)2024-08-14not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the performance extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind. (cherry picked from commit a546b7e4d73c23838d7e4d2c92882b3ca902d213)2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the timestamp extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind. (cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3)2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the performance extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm_syncobj_put. Fix it by exporting and using a common cleanup helper. (cherry picked from commit 484de39fa5f5b7bd0c5f2e2c5265167250ef7501)2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the timestamp extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm_syncobj_put. Fix it by exporting and using a common cleanup helper. (cherry picked from commit 753ce4fea62182c77e1691ab4f9022008f25b62e)2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into. (cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb)2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfs_folio_end_all_writers(). If the folio has been unlocked (note that we check the PageLocked bit at the start of __extent_writepage()), this results in an assert panic like this one from syzbot: BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871 Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89 RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246 RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __extent_writepage fs/btrfs/extent_io.c:1597 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline] btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373 do_writepages+0x359/0x870 mm/page-writeback.c:2656 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] __filemap_fdatawrite mm/filemap.c:436 [inline] filemap_flush+0xdf/0x130 mm/filemap.c:463 btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:222 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:877 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f075b70c9 Code: Unable to access opcode bytes at 0x7f5f075b709f. I was hitting the same issue by doing hundreds of accelerated runs of generic/475, which also hits IO errors by design. I instrumented that reproducer with bpftrace and found that the undesirable folio_unlock was coming from the following callstack: folio_unlock+5 __process_pages_contig+475 cow_file_range_inline.constprop.0+230 cow_file_range+803 btrfs_run_delalloc_range+566 writepage_delalloc+332 __extent_writepage # inlined in my stacktrace, but I added it here extent_write_cache_pages+622 Looking at the bisected-to pa ---truncated---2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly kill the process and we don't BUG() the kernel.2024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlink_remote_reload_actions_performed() which results in triggering lock assert like the following: WARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261 devl_assert_locked+0x3e/0x50 ¦ CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S W 6.10.0-rc2+ #116 Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015 Workqueue: mlx5_fw_reset_events mlx5_sync_reset_reload_work [mlx5_core] RIP: 0010:devl_assert_locked+0x3e/0x50 ¦ Call Trace: <TASK> ? __warn+0xa4/0x210 ? devl_assert_locked+0x3e/0x50 ? report_bug+0x160/0x280 ? handle_bug+0x3f/0x80 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? devl_assert_locked+0x3e/0x50 devlink_notify+0x88/0x2b0 ? mlx5_attach_device+0x20c/0x230 [mlx5_core] ? __pfx_devlink_notify+0x10/0x10 ? process_one_work+0x4b6/0xbb0 process_one_work+0x4b6/0xbb0 2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id], but the function is exposed to user space before the entry is allocated via register_pernet_subsys(). Let's call register_pernet_subsys() before xt_register_template().2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). We had a report that iptables-restore sometimes triggered null-ptr-deref at boot time. [0] The problem is that iptable_nat_table_init() is exposed to user space before the kernel fully initialises netns. In the small race window, a user could call iptable_nat_table_init() that accesses net_generic(net, iptable_nat_net_id), which is available only after registering iptable_nat_net_ops. Let's call register_pernet_subsys() before xt_register_template(). [0]: bpfilter: Loaded bpfilter_umh pid 11702 Started bpfilter BUG: kernel NULL pointer dereference, address: 0000000000000013 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page PGD 0 P4D 0 PREEMPT SMP NOPTI CPU: 2 PID: 11879 Comm: iptables-restor Not tainted 6.1.92-99.174.amzn2023.x86_64 #1 Hardware name: Amazon EC2 c6i.4xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat Code: 10 4c 89 f6 48 89 ef e8 0b 19 bb ff 41 89 c4 85 c0 75 38 41 83 c7 01 49 83 c6 28 41 83 ff 04 75 dc 48 8b 44 24 08 48 8b 0c 24 <48> 89 08 4c 89 ef e8 a2 3b a2 cf 48 83 c4 10 44 89 e0 5b 5d 41 5c RSP: 0018:ffffbef902843cd0 EFLAGS: 00010246 RAX: 0000000000000013 RBX: ffff9f4b052caa20 RCX: ffff9f4b20988d80 RDX: 0000000000000000 RSI: 0000000000000064 RDI: ffffffffc04201c0 RBP: ffff9f4b29394000 R08: ffff9f4b07f77258 R09: ffff9f4b07f77240 R10: 0000000000000000 R11: ffff9f4b09635388 R12: 0000000000000000 R13: ffff9f4b1a3c6c00 R14: ffff9f4b20988e20 R15: 0000000000000004 FS: 00007f6284340000(0000) GS:ffff9f51fe280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000013 CR3: 00000001d10a6005 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259) ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259) ? xt_find_table_lock (net/netfilter/x_tables.c:1259) ? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420) ? page_fault_oops (arch/x86/mm/fault.c:727) ? exc_page_fault (./arch/x86/include/asm/irqflags.h:40 ./arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1470 arch/x86/mm/fault.c:1518) ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:570) ? iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat xt_find_table_lock (net/netfilter/x_tables.c:1259) xt_request_find_table_lock (net/netfilter/x_tables.c:1287) get_info (net/ipv4/netfilter/ip_tables.c:965) ? security_capable (security/security.c:809 (discriminator 13)) ? ns_capable (kernel/capability.c:376 kernel/capability.c:397) ? do_ipt_get_ctl (net/ipv4/netfilter/ip_tables.c:1656) ? bpfilter_send_req (net/bpfilter/bpfilter_kern.c:52) bpfilter nf_getsockopt (net/netfilter/nf_sockopt.c:116) ip_getsockopt (net/ipv4/ip_sockglue.c:1827) __sys_getsockopt (net/socket.c:2327) __x64_sys_getsockopt (net/socket.c:2342 net/socket.c:2339 net/socket.c:2339) do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:81) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) RIP: 0033:0x7f62844685ee Code: 48 8b 0d 45 28 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 09 RSP: 002b:00007ffd1f83d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007ffd1f83d680 RCX: 00007f62844685ee RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000004 R08: 00007ffd1f83d670 R09: 0000558798ffa2a0 R10: 00007ffd1f83d680 R11: 0000000000000246 R12: 00007ffd1f83e3b2 R13: 00007f6284 ---truncated---2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path (or it is already removed / never existed). This needs to be done with atomic compare and swap, otherwise there is a small window where iucv_sock_close() will try to work with a path that has already been severed and freed by iucv_callback_connrej() called by iucv_tasklet_fn(). Example: [452744.123844] Call Trace: [452744.123845] ([<0000001e87f03880>] 0x1e87f03880) [452744.123966] [<00000000d593001e>] iucv_path_sever+0x96/0x138 [452744.124330] [<000003ff801ddbca>] iucv_sever_path+0xc2/0xd0 [af_iucv] [452744.124336] [<000003ff801e01b6>] iucv_sock_close+0xa6/0x310 [af_iucv] [452744.124341] [<000003ff801e08cc>] iucv_sock_release+0x3c/0xd0 [af_iucv] [452744.124345] [<00000000d574794e>] __sock_release+0x5e/0xe8 [452744.124815] [<00000000d5747a0c>] sock_close+0x34/0x48 [452744.124820] [<00000000d5421642>] __fput+0xba/0x268 [452744.124826] [<00000000d51b382c>] task_work_run+0xbc/0xf0 [452744.124832] [<00000000d5145710>] do_notify_resume+0x88/0x90 [452744.124841] [<00000000d5978096>] system_call+0xe2/0x2c8 [452744.125319] Last Breaking-Event-Address: [452744.125321] [<00000000d5930018>] iucv_path_sever+0x90/0x138 [452744.125324] [452744.125325] Kernel panic - not syncing: Fatal exception in interrupt Note that bh_lock_sock() is not serializing the tasklet context against process context, because the check for sock_owned_by_user() and corresponding handling is missing. Ideas for a future clean-up patch: A) Correct usage of bh_lock_sock() in tasklet context, as described in Re-enqueue, if needed. This may require adding return values to the tasklet functions and thus changes to all users of iucv. B) Change iucv tasklet into worker and use only lock_sock() in af_iucv.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtable_lookup() is not using the padding bytes which are not initialized. BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline] BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 rht_ptr_rcu include/linux/rhashtable.h:376 [inline] __rhashtable_lookup include/linux/rhashtable.h:607 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425 tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488 tcf_action_add net/sched/act_api.c:2061 [inline] tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118 rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2597 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651 __sys_sendmsg net/socket.c:2680 [inline] __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687 x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable key created at: tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:14082024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid mkdir /mnt/test/comp f2fs_io setflags compression /mnt/test/comp dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1 truncate --size 13 /mnt/test/comp/testfile In the above scenario, we can get a BUG_ON. kernel BUG at fs/f2fs/segment.c:3589! Call Trace: do_write_page+0x78/0x390 [f2fs] f2fs_outplace_write_data+0x62/0xb0 [f2fs] f2fs_do_write_data_page+0x275/0x740 [f2fs] f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs] f2fs_write_multi_pages+0x1e5/0xae0 [f2fs] f2fs_write_cache_pages+0xab1/0xc60 [f2fs] f2fs_write_data_pages+0x2d8/0x330 [f2fs] do_writepages+0xcf/0x270 __writeback_single_inode+0x44/0x350 writeback_sb_inodes+0x242/0x530 __writeback_inodes_wb+0x54/0xf0 wb_writeback+0x192/0x310 wb_workfn+0x30d/0x400 The reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the page was set the gcing flag by set_cluster_dirty().2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") removed the process context workqueue from amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove its overhead. With RME Fireface 800, this lead to a regression since Kernels 5.14.0, causing an AB/BA deadlock competition for the substream lock with eventual system freeze under ALSA operation: thread 0: * (lock A) acquire substream lock by snd_pcm_stream_lock_irq() in snd_pcm_status64() * (lock B) wait for tasklet to finish by calling tasklet_unlock_spin_wait() in tasklet_disable_in_atomic() in ohci_flush_iso_completions() of ohci.c thread 1: * (lock B) enter tasklet * (lock A) attempt to acquire substream lock, waiting for it to be released: snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed() in update_pcm_pointers() in process_ctx_payloads() in process_rx_packets() of amdtp-stream.c ? tasklet_unlock_spin_wait </NMI> <TASK> ohci_flush_iso_completions firewire_ohci amdtp_domain_stream_pcm_pointer snd_firewire_lib snd_pcm_update_hw_ptr0 snd_pcm snd_pcm_status64 snd_pcm ? native_queued_spin_lock_slowpath </NMI> <IRQ> _raw_spin_lock_irqsave snd_pcm_period_elapsed snd_pcm process_rx_packets snd_firewire_lib irq_target_callback snd_firewire_lib handle_it_packet firewire_ohci context_tasklet firewire_ohci Restore the process context work queue to prevent deadlock AB/BA deadlock competition for ALSA substream lock of snd_pcm_stream_lock_irq() in snd_pcm_status64() and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed(). revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") Replace inline description to prevent future deadlock.2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix error code in drm_client_buffer_vmap_local() This function accidentally returns zero/success on the failure path. It leads to locking issues and an uninitialized *map_copy in the caller.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en() dom->sdev is equal to NULL, which leads to null dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE.2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ASoC: TAS2781: Fix tasdev_load_calibrated_data() This function has a reversed if statement so it's either a no-op or it leads to a NULL dereference.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer While transmitting with rx_len == 0, the RX FIFO is not going to be emptied in the interrupt handler. A subsequent transfer could then read crap from the previous transfer out of the RX FIFO into the start RX buffer. The core provides a register that will empty the RX and TX FIFOs, so do that before each transfer.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp).2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a segment issue when downgrading gso_size Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2].2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling Move the freeing of the dummy net_device from mtk_free_dev() to mtk_remove(). Previously, if alloc_netdev_dummy() failed in mtk_probe(), eth->dummy_dev would be NULL. The error path would then call mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev was allocated (but it was not), potentially causing a NULL pointer dereference. By moving free_netdev() to mtk_remove(), we ensure it's only called when mtk_probe() has succeeded and dummy_dev is fully allocated. This addresses a potential NULL pointer dereference detected by Smatch[1].2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity): # ip nexthop add id 1 dev lo # ip nexthop add id 101 group 1 # strace -e recvmsg ip nexthop get id 101 ... recvmsg(... [{nla_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure.2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvme_local_port correctly The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 1 PREEMPT_RT SMP NOPTI RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0 RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034 R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000 FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x16f/0x4a0 ? do_user_addr_fault+0x174/0x7f0 ? exc_page_fault+0x69/0x1a0 ? asm_exc_page_fault+0x22/0x30 ? dma_direct_unmap_sg+0x51/0x1e0 ? preempt_count_sub+0x96/0xe0 qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx] qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx] __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx] The command completion was done early while aborting the commands in driver unload path but outside lock to avoid the WARN_ON condition of performing dma_free_attr within the lock. However this caused race condition while command completion via multiple paths causing system crash. Hence complete the command early in unload path but within the lock to avoid race condition.2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix for possible memory corruption Init Control Block is dereferenced incorrectly. Correctly dereference ICB2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. For all these stale I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but I/Os could not complete while vport delete is in process of deleting. BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Workqueue: qla2xxx_wq qla_do_work [qla2xxx] RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0 RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8 R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0 Call Trace: <TASK> qla2xxx_qpair_sp_free_dma+0x417/0x4e0 ? qla2xxx_qpair_sp_compl+0x10d/0x1a0 ? qla2x00_status_entry+0x768/0x2830 ? newidle_balance+0x2f0/0x430 ? dequeue_entity+0x100/0x3c0 ? qla24xx_process_response_queue+0x6a1/0x19e0 ? __schedule+0x2d5/0x1140 ? qla_do_work+0x47/0x60 ? process_one_work+0x267/0x440 ? process_one_work+0x440/0x440 ? worker_thread+0x2d/0x3d0 ? process_one_work+0x440/0x440 ? kthread+0x156/0x180 ? set_kthread_struct+0x50/0x50 ? ret_from_fork+0x22/0x30 </TASK> Send out async logout explicitly for all the ports during vport delete.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: irqchip/imx-irqsteer: Handle runtime power management correctly The power domain is automatically activated from clk_prepare(). However, on certain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes sleeping functions, which triggers the 'scheduling while atomic' bug in the context switch path during device probing: BUG: scheduling while atomic: kworker/u13:1/48/0x00000002 Call trace: __schedule_bug+0x54/0x6c __schedule+0x7f0/0xa94 schedule+0x5c/0xc4 schedule_preempt_disabled+0x24/0x40 __mutex_lock.constprop.0+0x2c0/0x540 __mutex_lock_slowpath+0x14/0x20 mutex_lock+0x48/0x54 clk_prepare_lock+0x44/0xa0 clk_prepare+0x20/0x44 imx_irqsteer_resume+0x28/0xe0 pm_generic_runtime_resume+0x2c/0x44 __genpd_runtime_resume+0x30/0x80 genpd_runtime_resume+0xc8/0x2c0 __rpm_callback+0x48/0x1d8 rpm_callback+0x6c/0x78 rpm_resume+0x490/0x6b4 __pm_runtime_resume+0x50/0x94 irq_chip_pm_get+0x2c/0xa0 __irq_do_set_handler+0x178/0x24c irq_set_chained_handler_and_data+0x60/0xa4 mxc_gpio_probe+0x160/0x4b0 Cure this by implementing the irq_bus_lock/sync_unlock() interrupt chip callbacks and handle power management in them as they are invoked from non-atomic context. [ tglx: Rewrote change log, added Fixes tag ]2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ice: Add a per-VF limit on number of FDIR filters While the iavf driver adds a s/w limit (128) on the number of FDIR filters that the VF can request, a malicious VF driver can request more than that and exhaust the resources for other VFs. Add a similar limit in ice.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: kobject_uevent: Fix OOB access within zap_modalias_env() zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix lockless walks with static and dynamic page-table folding Lina reports random oopsen originating from the fast GUP code when 16K pages are used with 4-level page-tables, the fourth level being folded at runtime due to lack of LPA2. In this configuration, the generic implementation of p4d_offset_lockless() will return a 'p4d_t *' corresponding to the 'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range(). This is normally fine, but when the fourth level of page-table is folded at runtime, pud_offset_lockless() will offset from the address of the 'p4d_t' to calculate the address of the PUD in the same page-table page. This results in a stray stack read when the 'p4d_t' has been allocated on the stack and can send the walker into the weeds. Fix the problem by providing our own definition of p4d_offset_lockless() when CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table pointer rather than the address of the local stack variable.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between sd_remove & sd_release Our test report the following hung task: [ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds. [ 2538.459427] Call trace: [ 2538.459430] __switch_to+0x174/0x338 [ 2538.459436] __schedule+0x628/0x9c4 [ 2538.459442] schedule+0x7c/0xe8 [ 2538.459447] schedule_preempt_disabled+0x24/0x40 [ 2538.459453] __mutex_lock+0x3ec/0xf04 [ 2538.459456] __mutex_lock_slowpath+0x14/0x24 [ 2538.459459] mutex_lock+0x30/0xd8 [ 2538.459462] del_gendisk+0xdc/0x350 [ 2538.459466] sd_remove+0x30/0x60 [ 2538.459470] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459474] device_release_driver+0x18/0x28 [ 2538.459478] bus_remove_device+0x15c/0x174 [ 2538.459483] device_del+0x1d0/0x358 [ 2538.459488] __scsi_remove_device+0xa8/0x198 [ 2538.459493] scsi_forget_host+0x50/0x70 [ 2538.459497] scsi_remove_host+0x80/0x180 [ 2538.459502] usb_stor_disconnect+0x68/0xf4 [ 2538.459506] usb_unbind_interface+0xd4/0x280 [ 2538.459510] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459514] device_release_driver+0x18/0x28 [ 2538.459518] bus_remove_device+0x15c/0x174 [ 2538.459523] device_del+0x1d0/0x358 [ 2538.459528] usb_disable_device+0x84/0x194 [ 2538.459532] usb_disconnect+0xec/0x300 [ 2538.459537] hub_event+0xb80/0x1870 [ 2538.459541] process_scheduled_works+0x248/0x4dc [ 2538.459545] worker_thread+0x244/0x334 [ 2538.459549] kthread+0x114/0x1bc [ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds. [ 2538.461014] Call trace: [ 2538.461016] __switch_to+0x174/0x338 [ 2538.461021] __schedule+0x628/0x9c4 [ 2538.461025] schedule+0x7c/0xe8 [ 2538.461030] blk_queue_enter+0xc4/0x160 [ 2538.461034] blk_mq_alloc_request+0x120/0x1d4 [ 2538.461037] scsi_execute_cmd+0x7c/0x23c [ 2538.461040] ioctl_internal_command+0x5c/0x164 [ 2538.461046] scsi_set_medium_removal+0x5c/0xb0 [ 2538.461051] sd_release+0x50/0x94 [ 2538.461054] blkdev_put+0x190/0x28c [ 2538.461058] blkdev_release+0x28/0x40 [ 2538.461063] __fput+0xf8/0x2a8 [ 2538.461066] __fput_sync+0x28/0x5c [ 2538.461070] __arm64_sys_close+0x84/0xe8 [ 2538.461073] invoke_syscall+0x58/0x114 [ 2538.461078] el0_svc_common+0xac/0xe0 [ 2538.461082] do_el0_svc+0x1c/0x28 [ 2538.461087] el0_svc+0x38/0x68 [ 2538.461090] el0t_64_sync_handler+0x68/0xbc [ 2538.461093] el0t_64_sync+0x1a8/0x1ac T1: T2: sd_remove del_gendisk __blk_mark_disk_dead blk_freeze_queue_start ++q->mq_freeze_depth bdev_release mutex_lock(&disk->open_mutex) sd_release scsi_execute_cmd blk_queue_enter wait_event(!q->mq_freeze_depth) mutex_lock(&disk->open_mutex) SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in this scenario. This is a classic ABBA deadlock. To fix the deadlock, make sure we don't try to acquire disk->open_mutex after freezing the queue.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle inconsistent state in nilfs_btnode_create_block() Syzbot reported that a buffer state inconsistency was detected in nilfs_btnode_create_block(), triggering a kernel bug. It is not appropriate to treat this inconsistency as a bug; it can occur if the argument block address (the buffer index of the newly created block) is a virtual block number and has been reallocated due to corruption of the bitmap used to manage its allocation state. So, modify nilfs_btnode_create_block() and its callers to treat it as a possible filesystem error, rather than triggering a kernel bug.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_convert_inline_inode() If device is readonly, make f2fs_convert_inline_inode() return EROFS instead of zero, otherwise it may trigger panic during writeback of inline inode's dirty page as below: f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888 f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline] f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369 do_writepages+0x359/0x870 mm/page-writeback.c:2634 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788 f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276 generic_write_sync include/linux/fs.h:2806 [inline] f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977 call_write_iter include/linux/fs.h:2114 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to don't dirty inode for readonly filesystem syzbot reports f2fs bug as below: kernel BUG at fs/f2fs/inode.c:933! RIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 dispose_list fs/inode.c:697 [inline] evict_inodes+0x5f8/0x690 fs/inode.c:747 generic_shutdown_super+0x9d/0x2c0 fs/super.c:675 kill_block_super+0x44/0x90 fs/super.c:1667 kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894 deactivate_locked_super+0xc1/0x130 fs/super.c:484 cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256 task_work_run+0x24a/0x300 kernel/task_work.c:180 ptrace_notify+0x2cd/0x380 kernel/signal.c:2399 ptrace_report_syscall include/linux/ptrace.h:411 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline] syscall_exit_work kernel/entry/common.c:251 [inline] syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296 do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b The root cause is: - do_sys_open - f2fs_lookup - __f2fs_find_entry - f2fs_i_depth_write - f2fs_mark_inode_dirty_sync - f2fs_dirty_inode - set_inode_flag(inode, FI_DIRTY_INODE) - umount - kill_f2fs_super - kill_block_super - generic_shutdown_super - sync_filesystem : sb is readonly, skip sync_filesystem() - evict_inodes - iput - f2fs_evict_inode - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE)) : trigger kernel panic When we try to repair i_current_depth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fs_evict_inode().2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page().2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: erofs: fix race in z_erofs_get_gbuf() In z_erofs_get_gbuf(), the current task may be migrated to another CPU between `z_erofs_gbuf_id()` and `spin_lock(&gbuf->lock)`. Therefore, z_erofs_put_gbuf() will trigger the following issue which was found by stress test: <2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58! .. <4>[772156.435007] <4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017 <4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) <4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. <6>[772156.445958] stress (3127): drop_caches: 1 <4>[772156.446120] Call trace: <4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] <4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] ..2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed. Below is the stack trace I encountered during the actual issue: [ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm: QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2 [ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp [ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024 [ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace: [ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0 [ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20 [ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc [ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38 [ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event occurred. To do so, it polls the config space of the first child device on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel to oops. That's because pci_bridge_wait_for_secondary_bus() neglects to hold a reference on the child device. Before v6.3, the function was only called on resume from system sleep or on runtime resume. Holding a reference wasn't necessary back then because the pciehp IRQ thread could never run concurrently. (On resume from system sleep, IRQs are not enabled until after the resume_noirq phase. And runtime resume is always awaited before a PCI device is removed.) However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset"), which introduced that, failed to appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a reference on the child device because dpc_handler() and pciehp may indeed run concurrently. The commit was backported to v5.10+ stable kernels, so that's the oldest one affected. Add the missing reference acquisition. Abridged stack trace: BUG: unable to handle page fault for address: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() pcie_do_recovery() dpc_handler()2024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: media: imx-pxp: Fix ERR_PTR dereference in pxp_probe() devm_regmap_init_mmio() can fail, add a check and bail out in case of error.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dx_root before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: <TASK> make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4_rename fs/ext4/namei.c:3936 [inline] ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214 [...] ============================================ The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue. do_split unsigned split dx_make_map count = 1 split = count/2 = 0; continued = hash2 == map[split - 1].hash; ---> map[4294967295] The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called. But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows: bus dentry1 hole dentry2 free |xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024 So when renaming dentry1 increases its name_len length by 1, neither hole nor free is sufficient to hold the new dentry, and make_indexed_dir() is called. In make_indexed_dir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1. Therefore add the ext4_check_dx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not.2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 init_cifs() error: we previously assumed 'serverclose_wq' could be null (see line 1895) The patch which introduced the serverclose workqueue used the wrong oredering in error paths in init_cifs() for freeing it on errors.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for NULL pointer [why & how] Need to make sure plane_state is initialized before accessing its members. (cherry picked from commit 295d91cbc700651782a60572f83c24861607b648)2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.2024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our extent map reference.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential deadlock on __exfat_get_dentry_set When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array is allocated in __exfat_get_entry_set. The problem is that the bh-array is allocated with GFP_KERNEL. It does not make sense. In the following cases, a deadlock for sbi->s_lock between the two processes may occur. CPU0 CPU1 ---- ---- kswapd balance_pgdat lock(fs_reclaim) exfat_iterate lock(&sbi->s_lock) exfat_readdir exfat_get_uniname_from_ext_entry exfat_get_dentry_set __exfat_get_dentry_set kmalloc_array ... lock(fs_reclaim) ... evict exfat_evict_inode lock(&sbi->s_lock) To fix this, let's allocate bh-array with GFP_NOFS.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix div-by-zero in vmpressure_calc_level() evict_folios() uses a second pass to reclaim folios that have gone through page writeback and become clean before it finishes the first pass, since folio_rotate_reclaimable() cannot handle those folios due to the isolation. The second pass tries to avoid potential double counting by deducting scan_control->nr_scanned. However, this can result in underflow of nr_scanned, under a condition where shrink_folio_list() does not increment nr_scanned, i.e., when folio_trylock() fails. The underflow can cause the divisor, i.e., scale=scanned+reclaimed in vmpressure_calc_level(), to become zero, resulting in the following crash: [exception RIP: vmpressure_work_fn+101] process_one_work at ffffffffa3313f2b Since scan_control->nr_scanned has no established semantics, the potential double counting has minimal risks. Therefore, fix the problem by not deducting scan_control->nr_scanned in evict_folios().2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71 ("mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray"). However, it's possible to have 512MB page cache in the huge memory's collapsing path on ARM64 system whose base page size is 64KB. 512MB page cache is breaking the limitation and a warning is raised when the xarray entry is split as shown in the following example. [root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize KernelPageSize: 64 kB [root@dhcp-10-26-1-207 ~]# cat /tmp/test.c : int main(int argc, char **argv) { const char *filename = TEST_XFS_FILENAME; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret = 0; if (pgsize != 0x10000) { fprintf(stdout, "System with 64KB base page size is required!\n"); return -EPERM; } system("echo 0 > /sys/devices/virtual/bdi/253:0/read_ahead_kb"); system("echo 1 > /proc/sys/vm/drop_caches"); /* Open the xfs file */ fd = open(filename, O_RDONLY); assert(fd > 0); /* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0); assert(buf != (void *)-1); fprintf(stdout, "mapped buffer at 0x%p\n", buf); /* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE); assert(ret == 0); ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ); assert(ret == 0); /* Collapse VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); assert(ret == 0); ret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE); if (ret) { fprintf(stdout, "Error %d to madvise(MADV_COLLAPSE)\n", errno); goto out; } /* Split xarray entry. Write permission is needed */ munmap(buf, TEST_MEM_SIZE); buf = (void *)-1; close(fd); fd = open(filename, O_RDWR); assert(fd > 0); fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); out: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd); return ret; } [root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test [root@dhcp-10-26-1-207 ~]# /tmp/test ------------[ cut here ]------------ WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse \ xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net \ sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : xas_split_alloc+0xf8/0x128 lr : split_huge_page_to_list_to_order+0x1c4/0x780 sp : ffff8000ac32f660 x29: ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0 x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000 x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8 x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40 x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000 Call trace: xas_split_alloc+0xf8/0x128 split_huge_page_to_list_to_order+0x1c4/0x780 truncate_inode_partial_folio+0xdc/0x160 truncate_inode_pages_range+0x1b4/0x4a8 truncate_pagecache_range+0x84/0xa ---truncated---2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on cred_transfer When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost. This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself. Fix it by adding a cred_transfer hook that does the same thing as the existing cred_prepare hook. (Implemented by having hook_cred_prepare() call hook_cred_transfer() so that the two functions are less likely to accidentally diverge in the future.)2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() When mtk-cmdq unbinds, a WARN_ON message with condition pm_runtime_get_sync() < 0 occurs. According to the call tracei below: cmdq_mbox_shutdown mbox_free_channel mbox_controller_unregister __devm_mbox_controller_unregister ... The root cause can be deduced to be calling pm_runtime_get_sync() after calling pm_runtime_disable() as observed below: 1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe() to bind the cmdq device to the mbox_controller, so devm_mbox_controller_unregister() will automatically unregister the device bound to the mailbox controller when the device-managed resource is removed. That means devm_mbox_controller_unregister() and cmdq_mbox_shoutdown() will be called after cmdq_remove(). 2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after devm_mbox_controller_register(), so that devm_pm_runtime_disable() will be called after cmdq_remove(), but before devm_mbox_controller_unregister(). To fix this problem, cmdq_probe() needs to move devm_mbox_controller_register() after devm_pm_runtime_enable() to make devm_pm_runtime_disable() be called after devm_mbox_controller_unregister().2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix error checks in dasd_copy_pair_store() dasd_add_busid() can return an error via ERR_PTR() if an allocation fails. However, two callsites in dasd_copy_pair_store() do not check the result, potentially resulting in a NULL pointer dereference. Fix this by checking the result with IS_ERR() and returning the error up the stack.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE The following splat is easy to reproduce upstream as well as in -stable kernels. Florian Westphal provided the following commit: d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net") but this complementary fix has been also suggested by Willem de Bruijn and it can be easily backported to -stable kernel which consists in using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat given __skb_get_hash() is used by the nftables tracing infrastructure to to identify packets in traces. [69133.561393] ------------[ cut here ]------------ [69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/ [...] [69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379 [69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0 [69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8 [69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246 [69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19 [69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418 [69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000 [69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400 [69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28 [69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0 [69133.562040] Call Trace: [69133.562044] <IRQ> [69133.562049] ? __warn+0x9f/0x1a0 [ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860 [...] [ 1211.841496] ? bpf_flow_dissect+0x160/0x160 [ 1211.841753] __skb_get_hash+0x97/0x280 [ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230 [ 1211.841776] ? mod_find+0xbf/0xe0 [ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0 [ 1211.841798] ? bpf_ksym_find+0x56/0xe0 [ 1211.841807] ? __rcu_read_unlock+0x2a/0x70 [ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables] [ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables] [ 1211.841964] ? get_stack_info+0x2b/0x80 [ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables] [ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables]2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ipvs: properly dereference pe in ip_vs_add_service Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - Ensure payload is zero when using key slot We could leak stack memory through the payload field when running AES with a key from one of the hardware's key slots. Fix this by ensuring the payload field is set to 0 in such cases. This does not affect the common use case when the key is supplied from main memory via the descriptor payload.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages On big endian architectures, it is possible to run into a memory out of bounds pointer dereference when FCP targets are zoned. In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is referencing a little endian formatted sgl->sge_len value. So, the memcpy can cause big endian systems to crash. Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are referring to a little endian formatted data structure. And, update the routine with proper le32_to_cpu macro usages.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net: missing check virtio Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again 1. After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help. 2. The struct sk_buff and struct virtio_net_hdr members must be mathematically related. (gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder. offset+2 (4191) > skb_headlen() (1116) WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Found by Linux Verification Center (linuxtesting.org) with Syzkaller2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: Adjust error handling in case of absent codec device acpi_get_first_physical_node() can return NULL in several cases (no such device, ACPI table error, reference count drop to 0, etc). Existing check just emit error message, but doesn't perform return. Then this NULL pointer is passed to devm_acpi_dev_add_driver_gpios() where it is dereferenced. Adjust this error handling by adding error code return. Found by Linux Verification Center (linuxtesting.org) with SVACE.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: kvm: s390: Reject memory region operations for ucontrol VMs This change rejects the KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM. This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and would thus result in a null pointer dereference further in. Memory management needs to be performed in userspace and using the ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP. Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2. [[email protected]: commit message spelling fix, subject prefix fix]2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume rm-raid devices will occasionally trigger the following warning when being resumed after a table load because DM_RECOVERY_RUNNING is set: WARNING: CPU: 7 PID: 5660 at drivers/md/dm-raid.c:4105 raid_resume+0xee/0x100 [dm_raid] The failing check is: WARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)); This check is designed to make sure that the sync thread isn't registered, but md_check_recovery can set MD_RECOVERY_RUNNING without the sync_thread ever getting registered. Instead of checking if MD_RECOVERY_RUNNING is set, check if sync_thread is non-NULL.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix a possible null pointer dereference In function lpfc_xcvr_data_show, the memory allocation with kmalloc might fail, thereby making rdp_context a null pointer. In the following context and functions that use this pointer, there are dereferencing operations, leading to null pointer dereference. To fix this issue, a null pointer check should be added. If it is null, use scnprintf to notify the user and return len.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe() The value "-ENOMEM" was assigned to the local variable "ret" in one if branch after a devm_kzalloc() call failed at the beginning. This error code will trigger then a pcmdevice_remove() call with a passed null pointer so that an undesirable dereference will be performed. Thus return the appropriate error code directly.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges() will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return check. Found by Linux Verification Center (linuxtesting.org) with SVACE.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log]2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: iio: Fix the sorting functionality in iio_gts_build_avail_time_table The sorting in iio_gts_build_avail_time_table is not working as intended. It could result in an out-of-bounds access when the time is zero. Here are more details: 1. When the gts->itime_table[i].time_us is zero, e.g., the time sequence is `3, 0, 1`, the inner for-loop will not terminate and do out-of-bound writes. This is because once `times[j] > new`, the value `new` will be added in the current position and the `times[j]` will be moved to `j+1` position, which makes the if-condition always hold. Meanwhile, idx will be added one, making the loop keep running without termination and out-of-bound write. 2. If none of the gts->itime_table[i].time_us is zero, the elements will just be copied without being sorted as described in the comment "Sort times from all tables to one and remove duplicates". For more details, please refer to https://lore.kernel.org/all/[email protected].2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: nfs: pass explicit offset/count to trace events nfs_folio_length is unsafe to use without having the folio locked and a check for a NULL ->f_mapping that protects against truncations and can lead to kernel crashes. E.g. when running xfstests generic/065 with all nfs trace points enabled. Follow the model of the XFS trace points and pass in an explÑ–cit offset and length. This has the additional benefit that these values can be more accurate as some of the users touch partial folio ranges.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check before access structs In enable_phantom_plane, we should better check null pointer before accessing various structs.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem!2024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/qxl: Add check for drm_cvt_mode Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference.2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate() Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback. Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data. Move the device_remove_groups() call to before deactivate() to close this race window. This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups().2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Handle invalid decoder vsi Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi is valid for future use.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix NULL pointer dereference in adding ancillary links In v4l2_async_create_ancillary_links(), ancillary links are created for lens and flash sub-devices. These are sub-device to sub-device links and if the async notifier is related to a V4L2 device, the source sub-device of the ancillary link is NULL, leading to a NULL pointer dereference. Check the notifier's sd field is non-NULL in v4l2_async_create_ancillary_links(). [Sakari Ailus: Reword the subject and commit messages slightly.]2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: xdp: fix invalid wait context of page_pool_destroy() If the driver uses a page pool, it creates a page pool with page_pool_create(). The reference count of page pool is 1 as default. A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count. When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect(). This function internally acquires mutex_lock(). If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model(). The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool. Now the reference count is 2. To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model(). The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count. If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning. Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock(). The page_pool_destroy() internally acquires mutex_lock(). Splat looks like: ============================= [ BUG: Invalid wait context ] 6.10.0-rc6+ #4 Tainted: G W ----------------------------- ethtool/1806 is trying to lock: ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this: context-{5:5} 3 locks held by ethtool/1806: stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20 To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock(). Using xa without rcu_read_lock() here is safe. xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove(). The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0. The xa is already protected by the reference count mechanism well in the control plane. So removing rcu_read_lock() for page_pool_destroy() is safe.2024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: pse-pd: Fix possible null-deref Fix a possible null dereference when a PSE supports both c33 and PoDL, but only one of the netlink attributes is specified. The c33 or PoDL PSE capabilities are already validated in the ethnl_set_pse_validate() call.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT When loading a EXT program without specifying `attr->attach_prog_fd`, the `prog->aux->dst_prog` will be null. At this time, calling resolve_prog_type() anywhere will result in a null pointer dereference. Example stack trace: [ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 8.108262] Mem abort info: [ 8.108384] ESR = 0x0000000096000004 [ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.108722] SET = 0, FnV = 0 [ 8.108827] EA = 0, S1PTW = 0 [ 8.108939] FSC = 0x04: level 0 translation fault [ 8.109102] Data abort info: [ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000 [ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000 [ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 8.112783] Modules linked in: [ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1 [ 8.113230] Hardware name: linux,dummy-virt (DT) [ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0 [ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8 [ 8.113798] sp : ffff80008283b9f0 [ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001 [ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000 [ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000 [ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff [ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720 [ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 [ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4 [ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f [ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c [ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000 [ 8.114126] Call trace: [ 8.114159] may_access_direct_pkt_data+0x24/0xa0 [ 8.114202] bpf_check+0x3bc/0x28c0 [ 8.114214] bpf_prog_load+0x658/0xa58 [ 8.114227] __sys_bpf+0xc50/0x2250 [ 8.114240] __arm64_sys_bpf+0x28/0x40 [ 8.114254] invoke_syscall.constprop.0+0x54/0xf0 [ 8.114273] do_el0_svc+0x4c/0xd8 [ 8.114289] el0_svc+0x3c/0x140 [ 8.114305] el0t_64_sync_handler+0x134/0x150 [ 8.114331] el0t_64_sync+0x168/0x170 [ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403) [ 8.118672] ---[ end trace 0000000000000000 ]--- One way to fix it is by forcing `attach_prog_fd` non-empty when bpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type` API broken which use verifier log to probe prog type and will log nothing if we reject invalid EXT prog before bpf_check(). Another way is by adding null check in resolve_prog_type(). The issue was introduced by commit 4a9c7bbe2ed4 ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") which wanted to correct type resolution for BPF_PROG_TYPE_TRACING programs. Before that, the type resolution of BPF_PROG_TYPE_EXT prog actually follows the logic below: prog->aux->dst_prog ? prog->aux->dst_prog->type : prog->type; It implies that when EXT program is not yet attached to `dst_prog`, the prog type should be EXT itself. This code worked fine in the past. So just keep using it. Fix this by returning `prog->type` for BPF_PROG_TYPE_EXT if `dst_prog` is not present in resolve_prog_type().2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: bpf: fix overflow check in adjust_jmp_off() adjust_jmp_off() incorrectly used the insn->imm field for all overflow check, which is incorrect as that should only be done or the BPF_JMP32 | BPF_JA case, not the general jump instruction case. Fix it by using insn->off for overflow check in the general case.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there. For '%d' specifiers, assume that they require: * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8 * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX is 16 And replace sprintf with snprintf. Detected using the static analysis tool - Svace.2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0. The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: avoid reporting connection success with wrong SSID When user issues a connection with a different SSID than the one virt_wifi has advertised, the __cfg80211_connect_result() will trigger the warning: WARN_ON(bss_not_found). The issue is because the connection code in virt_wifi does not check the SSID from user space (it only checks the BSSID), and virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS even if the SSID is different from the one virt_wifi has advertised. Eventually cfg80211 won't be able to find the cfg80211_bss and generate the warning. Fixed it by checking the SSID (from user space) in the connection code.2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size. But then 'rate->he_gi' is used as array index instead of 'status->he_gi'. This can lead to go beyond array boundaries in case of 'rate->he_gi' is not equal to 'status->he_gi' and is bigger than array size. Looks like "copy-paste" mistake. Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'. Found by Linux Verification Center (linuxtesting.org) with SVACE.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix out-of-bounds issue when preparing trampoline image We get the size of the trampoline image during the dry run phase and allocate memory based on that size. The allocated image will then be populated with instructions during the real patch phase. But after commit 26ef208c209a ("bpf: Use arch_bpf_trampoline_size"), the `im` argument is inconsistent in the dry run and real patch phase. This may cause emit_imm in RV64 to generate a different number of instructions when generating the 'im' address, potentially causing out-of-bounds issues. Let's emit the maximum number of instructions for the "im" address during dry run to fix this problem.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: wow: fix GTK offload H2C skbuff issue We mistakenly put skb too large and that may exceed skb->end. Therefore, we fix it. skbuff: skb_over_panic: text:ffffffffc09e9a9d len:416 put:204 head:ffff8fba04eca780 data:ffff8fba04eca7e0 tail:0x200 end:0x140 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 4747 Comm: kworker/u4:44 Tainted: G O 6.6.30-02659-gc18865c4dfbd #1 86547039b47e46935493f615ee31d0b2d711d35e Hardware name: HP Meep/Meep, BIOS Google_Meep.11297.262.0 03/18/2021 Workqueue: events_unbound async_run_entry_fn RIP: 0010:skb_panic+0x5d/0x60 Code: c6 63 8b 8f bb 4c 0f 45 f6 48 c7 c7 4d 89 8b bb 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 c8 00 00 00 e8 27 5f 23 00 48 83 c4 20 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 RSP: 0018:ffffaa700144bad0 EFLAGS: 00010282 RAX: 0000000000000089 RBX: 0000000000000140 RCX: 14432c5aad26c900 RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: 0000000000000001 RBP: ffffaa700144bae0 R08: 0000000000000000 R09: ffffaa700144b920 R10: 00000000ffffdfff R11: ffffffffbc28fbc0 R12: ffff8fba4e57a010 R13: 0000000000000000 R14: ffffffffbb8f8b63 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8fba7bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007999c4ad1000 CR3: 000000015503a000 CR4: 0000000000350ee0 Call Trace: <TASK> ? __die_body+0x1f/0x70 ? die+0x3d/0x60 ? do_trap+0xa4/0x110 ? skb_panic+0x5d/0x60 ? do_error_trap+0x6d/0x90 ? skb_panic+0x5d/0x60 ? handle_invalid_op+0x30/0x40 ? skb_panic+0x5d/0x60 ? exc_invalid_op+0x3c/0x50 ? asm_exc_invalid_op+0x16/0x20 ? skb_panic+0x5d/0x60 skb_put+0x49/0x50 rtw89_fw_h2c_wow_gtk_ofld+0xbd/0x220 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5] rtw89_wow_resume+0x31f/0x540 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5] rtw89_ops_resume+0x2b/0xa0 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5] ieee80211_reconfig+0x84/0x13e0 [mac80211 818a894e3b77da6298269c59ed7cdff065a4ed52] ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] ? dev_printk_emit+0x51/0x70 ? _dev_info+0x6e/0x90 ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] wiphy_resume+0x89/0x180 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] dpm_run_callback+0x3c/0x140 device_resume+0x1f9/0x3c0 ? __pfx_dpm_watchdog_handler+0x10/0x10 async_resume+0x1d/0x30 async_run_entry_fn+0x29/0xd0 process_scheduled_works+0x1d8/0x3d0 worker_thread+0x1fc/0x2f0 kthread+0xed/0x110 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x38/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Modules linked in: ccm 8021q r8153_ecm cdc_ether usbnet r8152 mii dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc uinput rfcomm cmac algif_hash rtw89_8922ae(O) algif_skcipher rtw89_8922a(O) af_alg rtw89_pci(O) rtw89_core(O) btusb(O) snd_soc_sst_bxt_da7219_max98357a btbcm(O) snd_soc_hdac_hdmi btintel(O) snd_soc_intel_hda_dsp_common snd_sof_probes btrtl(O) btmtk(O) snd_hda_codec_hdmi snd_soc_dmic uvcvideo videobuf2_vmalloc uvc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_sof_pci_intel_apl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation snd_sof_intel_hda_mlink soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp mac80211 snd_soc_acpi_intel_match snd_soc_acpi snd_sof snd_sof_utils soundwire_bus snd_soc_max98357a snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_intel_dspcfg snd_intel_sdw_acpi snd_soc_da7219 snd_hda_codec snd_hwdep snd_hda_core veth ip6table_nat xt_MASQUERADE xt_cgroup fuse bluetooth ecdh_generic cfg80211 ecc gsmi: Log Shutdown ---truncated---2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: udf: Fix bogus checksum computation in udf_rename() Syzbot reports uninitialized memory access in udf_rename() when updating checksum of '..' directory entry of a moved directory. This is indeed true as we pass on-stack diriter.fi to the udf_update_tag() and because that has only struct fileIdentDesc included in it and not the impUse or name fields, the checksumming function is going to checksum random stack contents beyond the end of the structure. This is actually harmless because the following udf_fiiter_write_fi() will recompute the checksum from on-disk buffers where everything is properly included. So all that is needed is just removing the bogus calculation.2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: lib: objagg: Fix general protection fault The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not supported. Aggregation happens in two cases: Without and with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects. Nesting is not possible in the first case due to a check that prevents it, but in the second case there is no check because the assumption is that nesting cannot happen when creating objects based on hints. The violation of this assumption leads to various warnings and eventually to a general protection fault [1]. Before fixing the root cause, error out when nesting happens and warn. [1] general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>2024-08-17not yet calculated







 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid memory access while processing fragmented packets The monitor ring and the reo reinject ring share the same ring mask index. When the driver receives an interrupt for the reo reinject ring, the monitor ring is also processed, leading to invalid memory access. Since monitor support is not yet enabled in ath12k, the ring mask for the monitor ring should be removed. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-12024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix TTLM teardown work The worker calculates the wrong sdata pointer, so if it ever runs, it'll crash. Fix that.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: protect locator_addr with the main mutex If the service locator server is restarted fast enough, the PDR can rewrite locator_addr fields concurrently. Protect them by placing modification of those fields under the main pdr->lock.2024-08-17not yet calculated






 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove The following warning is seen during bwmon_remove due to refcount imbalance, fix this by releasing the OPPs after use. Logs: WARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158 Hardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT) ... Call trace: _opp_table_kref_release+0x150/0x158 dev_pm_opp_remove_table+0x100/0x1b4 devm_pm_opp_of_table_release+0x10/0x1c devm_action_release+0x14/0x20 devres_release_all+0xa4/0x104 device_unbind_cleanup+0x18/0x60 device_release_driver_internal+0x1ec/0x228 driver_detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 platform_driver_unregister+0x14/0x20 bwmon_driver_exit+0x18/0x524 [icc_bwmon] __arm64_sys_delete_module+0x184/0x264 invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0xc8/0xe8 do_el0_svc+0x20/0x2c el0_svc+0x34/0xdc el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 --[ end trace 0000000000000000 ]---2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: rename cpu_number1 to dummy_cpu_number The per cpu variable cpu_number1 is passed to xlnx_event_handler as argument "dev_id", but it is not used in this function. So drop the initialization of this variable and rename it to dummy_cpu_number. This patch is to fix the following call trace when the kernel option CONFIG_DEBUG_ATOMIC_SLEEP is enabled: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 preempt_count: 1, expected: 0 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53 Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT) Call trace: dump_backtrace+0xd0/0xe0 show_stack+0x18/0x40 dump_stack_lvl+0x7c/0xa0 dump_stack+0x18/0x34 __might_resched+0x10c/0x140 __might_sleep+0x4c/0xa0 __kmem_cache_alloc_node+0xf4/0x168 kmalloc_trace+0x28/0x38 __request_percpu_irq+0x74/0x138 xlnx_event_manager_probe+0xf8/0x298 platform_probe+0x68/0xd82024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc2991) re-order conditions to fix off by one bug LTC2991_T_INT_CH_NR is 4. The st->temp_en[] array has LTC2991_MAX_CHANNEL (4) elements. Thus if "channel" is equal to LTC2991_T_INT_CH_NR then we have read one element beyond the end of the array. Flip the conditions around so that we check if "channel" is valid before using it as an array index.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Prevent UAF in proc_cpuset_show() An UAF can happen when /proc/cpuset is read as reported in [1]. This can be reproduced by the following methods: 1.add an mdelay(1000) before acquiring the cgroup_lock In the cgroup_path_ns function. 2.$cat /proc/<pid>/cpuset repeatly. 3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/ $umount /sys/fs/cgroup/cpuset/ repeatly. The race that cause this bug can be shown as below: (umount) | (cat /proc/<pid>/cpuset) css_release | proc_cpuset_show css_release_work_fn | css = task_get_css(tsk, cpuset_cgrp_id); css_free_rwork_fn | cgroup_path_ns(css->cgroup, ...); cgroup_destroy_root | mutex_lock(&cgroup_mutex); rebind_subsystems | cgroup_free_root | | // cgrp was freed, UAF | cgroup_path_ns_locked(cgrp,..); When the cpuset is initialized, the root node top_cpuset.css.cgrp will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated &cgroup_root.cgrp. When the umount operation is executed, top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp. The problem is that when rebinding to cgrp_dfl_root, there are cases where the cgroup_root allocated by setting up the root for cgroup v1 is cached. This could lead to a Use-After-Free (UAF) if it is subsequently freed. The descendant cgroups of cgroup v1 can only be freed after the css is released. However, the css of the root will never be released, yet the cgroup_root should be freed when it is unmounted. This means that obtaining a reference to the css of the root does not guarantee that css.cgrp->root will not be freed. Fix this problem by using rcu_read_lock in proc_cpuset_show(). As cgroup_root is kfree_rcu after commit d23b5c577715 ("cgroup: Make operations on the cgroup root_list RCU safe"), css->cgroup won't be freed during the critical section. To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to replace task_get_css with task_css. [1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For PI metadata this is limited to the app tag that isn't used by kernel generated metadata, but for non-PI metadata the entire buffer leaks kernel memory. Fix this by adding the __GFP_ZERO flag to allocations for writes.2024-08-17not yet calculated





 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: md: fix deadlock between mddev_suspend and flush bio Deadlock occurs when mddev is being suspended while some flush bio is in progress. It is a complex issue. T1. the first flush is at the ending stage, it clears 'mddev->flush_bio' and tries to submit data, but is blocked because mddev is suspended by T4. T2. the second flush sets 'mddev->flush_bio', and attempts to queue md_submit_flush_data(), which is already running (T1) and won't execute again if on the same CPU as T1. T3. the third flush inc active_io and tries to flush, but is blocked because 'mddev->flush_bio' is not NULL (set by T2). T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc by T3. T1 T2 T3 T4 (flush 1) (flush 2) (third 3) (suspend) md_submit_flush_data mddev->flush_bio = NULL; . . md_flush_request . mddev->flush_bio = bio . queue submit_flushes . . . . md_handle_request . . active_io + 1 . . md_flush_request . . wait !mddev->flush_bio . . . . mddev_suspend . . wait !active_io . . . submit_flushes . queue_work md_submit_flush_data . //md_submit_flush_data is already running (T1) . md_handle_request wait resume The root issue is non-atomic inc/dec of active_io during flush process. active_io is dec before md_submit_flush_data is queued, and inc soon after md_submit_flush_data() run. md_flush_request active_io + 1 submit_flushes active_io - 1 md_submit_flush_data md_handle_request active_io + 1 make_request active_io - 1 If active_io is dec after md_handle_request() instead of within submit_flushes(), make_request() can be called directly intead of md_handle_request() in md_submit_flush_data(), and active_io will only inc and dec once in the whole flush process. Deadlock will be fixed. Additionally, the only difference between fixing the issue and before is that there is no return error handling of make_request(). But after previous patch cleaned md_write_start(), make_requst() only return error in raid5_make_request() by dm-raid, see commit 41425f96d7aa ("dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape)". Since dm always splits data and flush operation into two separate io, io size of flush submitted by dm always is 0, make_request() will not be called in md_submit_flush_data(). To prevent future modifications from introducing issues, add WARN_ON to ensure make_request() no error is returned in this context.2024-08-17not yet calculated




 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b032024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null reference error when checking end of zone This patch fixes a potentially null pointer being accessed by is_end_zone_blkaddr() that checks the last block of a zone when f2fs is mounted as a single device.2024-08-17not yet calculated


 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix array-index-out-of-bounds in diFree2024-08-17not yet calculated








 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate preallocated blocks in f2fs_file_open() chenyuwen reports a f2fs bug as below: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011 fscrypt_set_bio_crypt_ctx+0x78/0x1e8 f2fs_grab_read_bio+0x78/0x208 f2fs_submit_page_read+0x44/0x154 f2fs_get_read_data_page+0x288/0x5f4 f2fs_get_lock_data_page+0x60/0x190 truncate_partial_data_page+0x108/0x4fc f2fs_do_truncate_blocks+0x344/0x5f0 f2fs_truncate_blocks+0x6c/0x134 f2fs_truncate+0xd8/0x200 f2fs_iget+0x20c/0x5ac do_garbage_collect+0x5d0/0xf6c f2fs_gc+0x22c/0x6a4 f2fs_disable_checkpoint+0xc8/0x310 f2fs_fill_super+0x14bc/0x1764 mount_bdev+0x1b4/0x21c f2fs_mount+0x20/0x30 legacy_get_tree+0x50/0xbc vfs_get_tree+0x5c/0x1b0 do_new_mount+0x298/0x4cc path_mount+0x33c/0x5fc __arm64_sys_mount+0xcc/0x15c invoke_syscall+0x60/0x150 el0_svc_common+0xb8/0xf8 do_el0_svc+0x28/0xa0 el0_svc+0x24/0x84 el0t_64_sync_handler+0x88/0xec It is because inode.i_crypt_info is not initialized during below path: - mount - f2fs_fill_super - f2fs_disable_checkpoint - f2fs_gc - f2fs_iget - f2fs_truncate So, let's relocate truncation of preallocated blocks to f2fs_file_open(), after fscrypt_file_open().2024-08-17not yet calculated



 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_rproc: Skip over memory region when node value is NULL In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts number of phandles. But phandles may be empty. So of_parse_phandle() in the parsing loop (0 < a < nph) may return NULL which is later dereferenced. Adjust this issue by adding NULL-return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. [Fixed title to fit within the prescribed 70-75 charcters]2024-08-17not yet calculated








 
Meddiff Technologies--InstaRISPACS
 
This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerable parameter to perform reflected Cross Site Scripting (XSS) attacks on the targeted system.2024-08-13not yet calculated

 
MediaTek, Inc.--MT6765, MT6768, MT6779, MT6785, MT8321, MT8385, MT8666, MT8667, MT8755, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798
 
In venc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08810810 / ALPS08805789; Issue ID: MSV-1502.2024-08-14not yet calculated

 
Microsoft--Windows 10
 
A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugCheckEx function.2024-08-12not yet calculated

 
mintplex-labs--mintplex-labs/anything-llm
 
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of the existing `anythingllm.db` file. By exploiting this vulnerability, attackers can serve malicious data to users or collect information about them. The vulnerability stems from the application's failure to properly restrict access to the data-import functionality, allowing unauthorized database manipulation.2024-08-12not yet calculated


 
n/a--n/a
 
In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware that allow persistent arbitrary code execution with Linux kernel privileges. A failure to correctly handle the return value of the setenv command can be used to override the kernel command-line parameters and ultimately bypass the Secure Boot implementation. This affects PLAY5 gen 2, PLAYBASE, PLAY:1, One, One SL, and Amp.2024-08-12not yet calculated

 
n/a--n/a
 
A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on.2024-08-15not yet calculated


 
n/a--n/a
 
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.2024-08-15not yet calculated


 
n/a--n/a
 
A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.2024-08-16not yet calculated


 
n/a--n/a
 
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature.2024-08-15not yet calculated


 
n/a--n/a
 
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature.2024-08-15not yet calculated


 
n/a--n/a
 
Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.2024-08-15not yet calculated



 
n/a--n/a
 
The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.2024-08-13not yet calculated

 
n/a--n/a
 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attackers to execute arbitrary code via "rname" and "email" parameter fields2024-08-12not yet calculated


 
n/a--n/a
 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remote attackers to execute arbitrary code via membershipType parameter.2024-08-12not yet calculated


 
n/a--n/a
 
An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.2024-08-12not yet calculated

 
n/a--n/a
 
An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload2024-08-13not yet calculated


 
n/a--n/a
 
H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.2024-08-16not yet calculated


 
n/a--n/a
 
H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.2024-08-16not yet calculated


 
n/a--n/a
 
An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nssys/common/filehandle. Aspx component2024-08-15not yet calculated

 
n/a--n/a
 
SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the/ajax/Login.ashx component.2024-08-15not yet calculated

 
n/a--n/a
 
An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark.2024-08-15not yet calculated

 
n/a--n/a
 
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.2024-08-15not yet calculated

 
n/a--n/a
 
Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page.2024-08-15not yet calculated

 
n/a--n/a
 
A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.2024-08-16not yet calculated




 
n/a--n/a
 
Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php.2024-08-15not yet calculated

 
n/a--n/a
 
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.2024-08-16not yet calculated


 
n/a--n/a
 
A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.2024-08-16not yet calculated


 
n/a--n/a
 
A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/ask_edit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. When a user visits the ask/show_{newsid}.html page, the injected script is executed in the context of the user's browser, leading to potential theft of cookies, session tokens, or other sensitive information.2024-08-16not yet calculated


 
n/a--n/a
 
A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities.2024-08-16not yet calculated


 
n/a--n/a
 
An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to delete arbitrary files on the server. This can lead to the deletion of critical files, potentially disrupting the normal operation of the system.2024-08-16not yet calculated


 
n/a--n/a
 
Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.2024-08-16not yet calculated


 
Ocean Data Systems--Dream Report 2023
 
In Ocean Data Systems Dream Report, a path traversal vulnerability could allow an attacker to perform remote code execution through the injection of a malicious dynamic-link library (DLL).2024-08-13not yet calculated

 
Ocean Data Systems--Dream Report 2023
 
In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service.2024-08-13not yet calculated

 
Palo Alto Networks--Cortex XSOAR CommonScripts
 
A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container.2024-08-14not yet calculated

 
Palo Alto Networks--GlobalProtect App
 
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.2024-08-14not yet calculated

 
Palo Alto Networks--PAN-OS
 
An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.2024-08-14not yet calculated

 
Rockwell Automation--CompactLogix 5380 (5069 L3z)
 
CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.2024-08-14not yet calculated

 
Rockwell Automation--CompactLogix 5380 (5069-L3z)
 
CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fault in the controller.2024-08-14not yet calculated

 
Rockwell Automation--ControlLogix 5580
 
CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.2024-08-14not yet calculated

 
Rockwell Automation--DataMosaix
 
CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the account of a legitimate user. The malicious user would be able to view and modify data stored in the cloud.2024-08-14not yet calculated

 
Rockwell Automation--Emulate3D
 
A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application loads shared libraries, which are readable and writable by any user. If exploited, a malicious user could leverage a malicious dll and perform a remote code execution attack.2024-08-13not yet calculated

 
Rockwell Automation--FactoryTalk View Site Edition
 
CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions.2024-08-14not yet calculated

 
Rockwell Automation--Pavilion8
 
CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality.2024-08-14not yet calculated

 
Rockwell Automation--PLC - Micro850/870 (2080 -L50E/2080 -L70E)
 
A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus communication may be disrupted for short duration.2024-08-13not yet calculated

 
streamlit--streamlit
 
Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.2024-08-12not yet calculated


 
Traccar--Server
 
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by the authentication mechanism.  These transactions could have an impact on any sensitive aspect of the platform, including Confidentiality, Integrity and Availability.2024-08-13not yet calculated

 
Unknown--Grow by Tradedoubler
 
The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.2024-08-16not yet calculated

 
Unknown--News Element Elementor Blog Magazine
 
The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.2024-08-17not yet calculated

 
upKeeper Solutions--upKeeper Manager
 
Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through 5.1.9.2024-08-16not yet calculated

 
upKeeper Solutions--upKeeper Manager
 
Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.2024-08-16not yet calculated

 
upKeeper Solutions--upKeeper Manager
 
Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.2024-08-16not yet calculated

 
upKeeper Solutions--upKeeper Manager
 
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.2024-08-16not yet calculated

 
upKeeper Solutions--upKeeper Manager
 
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.2024-08-16not yet calculated

 
Xpdf--Xpdf
 
In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow.2024-08-15not yet calculated

 
Xpdf--Xpdf
 
In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero.2024-08-15not yet calculated

 
Xpdf--Xpdf
 
In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.2024-08-15not yet calculated

 
ZoneMinder--zoneminder
 
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61.2024-08-12not yet calculated



 

Please share your thoughts

We recently updated our anonymous product survey ; we’d welcome your feedback.

COMMENTS

  1. How To Write Your Undergraduate Personal Statement

    What's a personal statement? An undergraduate personal statement is a chance to get noticed for the unique talents and experiences you have. It's an important part of the application process as it's an opportunity to talk about yourself and your passions, outside of your grades.

  2. Introducing the personal statement builder

    What is the personal statement builder? The personal statement builder in the UCAS Hub is designed to help you think about what to include in your personal statement, and how to lay it all out. It also counts how many characters you've used, so it's easy to see when you're close to the 4,000 character limit.

  3. Personal statements for 2026 entry onwards

    What is changing with personal statements? Personal statements are changing from one longer piece of text to three separate sections, each with a different question to help shape the focus for students' answers. Each section will have a minimum character count of 350 characters, which is clearly labelled on the question boxes, along with an overall character counter, to ensure students know if ...

  4. How to Write a UCAS Personal Statement [With Examples]

    The character limit which UCAS sets for the personal statement is very strict - up to 4,000 characters of text. This means that students have to express themselves in a clear and concise way; it's also important that they don't feel the need to fill the available space needlessly. Planning and redrafting of a personal statement is essential.

  5. How to write a UCAS personal statement

    UCAS personal statement word limit. Your personal statement length can be up to 4,000 characters long. This may sound a lot, but it's a word limit of around 550-1000 words with spaces and only about 1 side of typed A4 paper. You need to keep it concise and make sure it's clear and easy to read.

  6. Choose & Send

    Your personal ID is: 153-354-8461. Your personal statement is too long to be saved. Click 'save' within 19 minutes so that your work is not lost. Your statement is 1 line (s) over the 47 limit, based on the preview. Your completed statement must be between 1,000 and 4,000 characters (maximum 47 lines) including spaces.

  7. Choose & Send

    Your personal ID is: 153-354-8461. Your personal statement is too long to be saved. Click 'save' within 19 minutes so that your work is not lost. Your statement is 1 line (s) over the 47 limit, based on the preview. Your completed statement must be between 1,000 and 4,000 characters (maximum 47 lines) including spaces.

  8. UCAS Personal Statement Length Checker

    How to use our UCAS personal statement checker. To use our tool simply copy and paste your personal statement into the text-box above. At the top, you will see two metrics displayed. The first metric on the left is the total characters you've typed out of the limit of 4,000 characters. The second metric on the right is the number of lines your ...

  9. Writing an Effective Personal Statement

    A PERSONAL STATEMENT? Your personal statement outlines why you want to study a particular course at university and is an opportunity for you to demonstrate that you have the skills, knowledge and experience to succeed on this course. of your UCAS application to university. It is submitted online, and can be a maximum of 47 lines or 4000

  10. UCAS Personal Statement and Examples

    WHAT IS THE UCAS PERSONAL STATEMENT? The Universities and Colleges Admissions Service (UCAS) Personal Statement is the main essay for your application to colleges and universities in Great Britain. UCAS gives a nice explanation here, but in short, this is your chance to stand out against the crowd and show your knowledge and enthusiasm for your chosen area of study. You've got 4,000 ...

  11. Personal statement dos and don'ts

    The personal statement is your opportunity to talk about you, and why you want to enrol on a particular course. Use these easy-to-digest bullet points to help you decide what you should and shouldn't include in your personal statement.

  12. How to write your personal statement

    It can be hard to know where to begin when writing your UCAS personal statement. Here are some top tips on how to make a great impression.

  13. UCAS Personal Statement Advice

    The maximum size of your UCAS personal statement is 47 lines - that's around 500-550 words, size 12 font. The maximum number of characters is 4000, and this includes spaces.

  14. The Ultimate Guide To Writing A Winning UCAS Personal Statement

    Mastering the UCAS Personal Statement. When applying through UCAS, your personal statement is your singular opportunity to impress multiple universities. It's more than just an essay—it's a strategic tool to make a memorable impact. With a strict limit of 4,000 characters, or about 600 words, every sentence must count.

  15. How to write a great UCAS personal statement

    How to write a great UCAS personal statement The personal statement is the most important part of the UCAS process. It is your opportunity to explain why you have picked the subject you want to study and demonstrate your personality, passion and knowledge about your chosen subject.

  16. Personal statement secrets

    Make the word count count. Your personal statement has a strict limit of 4,000 characters (including spaces) or 47 lines of 95 characters (including spaces); whichever is shorter. Exceed this and Ucas Hub will immediately cut you off and could leave your personal statement dangling in the middle of an unfinished sentence.

  17. Personal statement FAQs

    The university application personal statement is changing in 2025. University admissions service Ucas has announced that a new style of personal statement will be launched in 2025. This will affect anyone making a university application from autumn 2025 onwards. Find out more about how the Ucas personal statement is changing in 2025 here.

  18. A guide to using AI and ChatGPT with your personal statement

    The personal statement builder in the UCAS Hub is designed to help you think about what to include in your personal statement, and how to lay it all out. It also counts how many characters you've used, so it's easy to see when you're close to the 4,000 character limit.

  19. Minimum acceptable length of personal statement?

    My personal statement currently stands at 2729 characters (with spaces) and I believe the maximum is 4000? I can't really think of much else to put in it so would it be okay to submit one of this length?

  20. UCAS Personal Statement: Format, Guidelines, and Samples

    UCAS personal statement word limit should not exceed 4,000 characters. Your personal statement should consist of your thoughts about the course. Your skills and achievements in both academic and professional fields. Your work experience and future plans.

  21. Personal statement length checker

    Your personal statement will be shown formatted according to UCAS's requirements, and the length and character limit calculated to check it's length.

  22. Writing your personal statement

    How to write a personal statement for a conservatoire. The personal statement is your opportunity to talk about you, and why you want to enrol on a particular course. You should describe the ambitions, skills, and experience that'll make you suitable for the course.

  23. Personal Statement FAQs

    Our personal statement FAQs will help ease the pain of writing a personal statement for your UCAS form, with information on when and what to write, and more.

  24. PDF Secrets to a powerful personal statement

    Secrets to a powerful personal statement. Helps you stand out from others with similar grades. Show you are motivated and dedicated. Show you have relevant knowledge and experience. Understand the demands of the course. Show you will fit into the university environment. Tell them why you want to study the course.

  25. Vulnerability Summary for the Week of August 12, 2024

    High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source & Patch Info