Nixpkgs Security Tracker

Permalink CVE-2024-25096

10.0 CRITICAL

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): CHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 6 months ago

WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.

References

https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-… vdb-entry
https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-… vdb-entry
https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-… vdb-entry
https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-… x_transferred vdb-entry

Affected products

canto

=<3.0.7

Matching in nixpkgs

pkgs.cantoolz

Black-box CAN network analysis framework

nixos-unstable -
- nixpkgs-unstable 3.7.0

pkgs.canto-curses

Ncurses-based console Atom/RSS feed reader

nixos-unstable -
- nixpkgs-unstable 0.9.9

pkgs.canto-daemon

Daemon for the canto Atom/RSS feed reader

nixos-unstable -
- nixpkgs-unstable 0.9.8

pkgs.kdePackages.cantor

Front end to powerful mathematics and statistics packages

nixos-unstable -
- nixpkgs-unstable 25.08.1

pkgs.python312Packages.cantools

Tools to work with CAN bus

nixos-unstable -
- nixpkgs-unstable 40.5.0

pkgs.python313Packages.cantools