AZL-47095 CVE-2024-42069 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix possible double free in error handling path When auxiliarydeviceadd returns error and then calls auxiliarydeviceuninit, callback function adevrelease calls kfreemadev. We shouldn't call kfreemadev again in the erro...

AZL-47137 CVE-2024-42067 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from setmemoryrox into account with bpfjitbinarylockro setmemoryrox can fail, leaving memory unprotected. Check return and bail out when bpfjitbinarylockro returns an error...

UBUNTU-CVE-2024-42068

In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from setmemoryro into account with bpfproglockro setmemoryro can fail, leaving memory unprotected. Check its return and take it into account as an error...

PT-2024-38142 · Totolink · Totolink A3600R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3600R version 4.1.2cu.5182 B20201102 Description: A critical vulnerability has been found in the setPortForwardRules function of the /cgi-bin/cstecgi.cgi file. The manipulation of the comment argument leads to a buffer overflow. Thi...

TOTOLINK A3600R 安全漏洞

TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3600R suffers from a buffer overflow vulnerability that originates from the comment parameter in the setWiFiAclAddConfig function of the /cgi-bin/cstecgi.cgi file that fails to correctly...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not checking the return value of the setmemoryro function when it is used, and when the function fails, memory m...

TOTOLINK A3600R 命令注入漏洞

TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3600R suffers from a command injection vulnerability that originates from improper handling of the telnetenabled parameter in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi file. An...

PT-2024-37732

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.19.3 Description A stored cross-site scripting XSS issue exists due to the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a warning when the GPIO controller needs to sleep when resetting GPIOs using the non-sleep gpiodsetvalue...

CVE-2024-7160

A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. It is possible to launch the attack remotely. The exploit has...

kernel: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkgiostatset after clearing in blkcgresetstats When blkgalloc is called to allocate a blkcggq structure with the associated blkgiostatset's, there are 2 fields within blkgiostatset that requires proper...

kernel: nftables: nft_set_rbtree skip end interval element from gc

A flaw was found in the Linux kernel’s Netfilter subsystem. This issue occurs in the nftsetrbtree. rbtree lazy gc on insert, which might collect an end interval element just added in a transaction and skip the end interval elements not yet active...

kernel: netfilter: nf_tables: use timestamp to check for set element timeout

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system...

PT-2024-31319

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue occurs when enabling access to the special register set in the Linux kernel, which can lead to Receiver time-out and RHR interrupts. The IRQ handler attempts to read from the...

CVE-2024-6964

CVE-2024-6964 affects Tenda O3 1.0.0.10, specifically the fromDhcpSetSer function where parameters dhcpEn/startIP/endIP/preDNS/altDNS/mask/gateway can be manipulated to trigger a stack-based overflow. This vulnerability is described as exploitable remotely with high impact (code execution/confide...

EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2024-2033)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a temporary file with...

CVE-2024-39962

D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21D240126 was discovered to contain a remote code execution RCE vulnerability in the ntpzoneval parameter at /goform/setntp. This vulnerability is exploited via a crafted HTTP request...

PT-2024-28754 · Unknown · Ax3000 Dual-Band Gigabit Wi-Fi 6 Router Ax9 +1

Name of the Vulnerable Software and Affected Versions: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 version V22.03.01.46 AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 version V1.0 V22.03.01.46 Description: The issue is related to an authenticated remote command execution via the macFilterType...

Tenda AC8 Out-of-Bounds Write Vulnerability

Tenda AC8 is a dual gigabit wireless router from Tenda designed for fiber optic homes up to 1000 megabytes, supporting IPv6 protocol with intelligent network management. The Tenda AC8 suffers from an out-of-bounds write vulnerability that stems from the presence of an sscanf issue where the last...

D-Link DAP-1325 Secondary DNS Command Injection Remote Code Execution Vulnerability

D-Link DAP-1325 is a wireless network extender made by D-Link, which is mainly used to extend the wireless network coverage, support the conversion of wired network and wireless network or connect to different wireless networks. The D-Link DAP-1325 suffers from a command injection remote code...