CVE-2024-1164 — Cross-site Scripting in Brizy

Vendor	Product	Version range	Fixed in
brizy	brizy	< 2.4.44	2.4.44
themefusecom	brizy_page_builder	<= 2.4.43	—

GHSA

GHSA-fpmj-g9m4-j4hg: The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redi

ghsa_unreviewed·2024-06-05

CVE-2024-1164 [MEDIUM] CWE-79 GHSA-fpmj-g9m4-j4hg: The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redi The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied error messages. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Red Hat

kernel: net/mlx5: Fix missing lock on sync reset reload

vendor_redhat·2024-08-17·CVSS 5.5

CVE-2024-42268 [MEDIUM] CWE-617 kernel: net/mlx5: Fix missing lock on sync reset reload kernel: net/mlx5: Fix missing lock on sync reset reload In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlink_remote_reload_actions_performed() which results in triggering lock assert like the following: WARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261 devl_assert_locked+0x3e/0x50 … CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S W 6.10.0-rc2+ #116 Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015 Workqueue: mlx5_fw_reset_events mlx5_sync_reset_reload_work [mlx5_core] RIP: 0010:devl_assert_locked+0x3e/0x50 … Call Trace: ? __warn+0xa4/0x210 ? devl

Red Hat

kernel: Bluetooth: HCI: Remove HCI_AMP support

vendor_redhat·2024-06-20·CVSS 5.5

CVE-2024-38620 [MEDIUM] CWE-1164 kernel: Bluetooth: HCI: Remove HCI_AMP support kernel: Bluetooth: HCI: Remove HCI_AMP support In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of creating AMP controllers. Since we no longer need to differentiate between AMP and Primary controllers, as only HCI_PRIMARY is left, this also remove hdev->dev_type altogether. Package: kernel (Red Hat Enterprise Linux 6) - Not affected Package: kernel (Red Hat Enterprise Linux 7) - Not affected Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected Package: kernel (Red Hat Enterprise Linux 8) - Not affected Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected Package: kernel (Red Hat Enterprise Linux 9)

CVE-2024-1164: The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL…

Affected

CVSS provenance