CVE-2024-34455

CVE-2024-34455 affects Buildroot prior to version 0b2967e, due to missing sticky bit on /dev/shm. The issue is fixed in 2024.02.2; affected users should update to 2024.02.2 or later. Public sources (Red Hat, NVD, OSV, CVE lists) corroborate the description of the vulnerability and the fix. The CV...

Security advisory: QStringConverter

QStringConverter has an invalid pointer being passed as a callback which can allow modification of the stack and has been assigned the CVE id CVE-2024-33861. Qt itself is not vulnerable to remote attack however an application using QStringDecoder either directly or indirectly can be vulnerable...

CVE-2024-27063

CVE-2024-27063 affects the Linux kernel LED subsystem for leds: trigger: netdev. The issue stems from a refactor where the trigger_data’s dev could reference the old net_dev while a new net_dev is being established, causing get_device_state() to operate on an invalid net_dev and potentially trigg...

CVE-2024-27013

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

DEBIAN-CVE-2024-26935

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 "scsi: core: Remove the /proc/scsi/$procname directory earlier" fixed a bug related to modules loading/unloading, by adding a call to scsiprochostdirr...

CVE-2024-27013

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

CVE-2024-27013 tun: limit printing rate when illegal packet received by tun dev

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

CVE-2024-27013 tun: limit printing rate when illegal packet received by tun dev

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

CVE-2024-27013

CVE-2024-27013 affects the Linux kernel tun subsystem. When vhost_worker calls tun callbacks to receive packets, excessive illegal packets trigger tun_do_read to dump packet contents, causing high CPU usage and potential soft lockups. The advisory notes using the net_ratelimit mechanism to cap su...

CVE-2024-27013

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

CVE-2024-4238

A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched...

Nginx 1.25.5 Host Header Validation Vulnerability

Nginx versions 1.25.5 and below appear to have a host header filtering validation bug that could possibly be used for malice. Nginx = 1.25.5 $host variable validation bug Intro: In the "Host" header sent to Nginx web server you can't just insert a dot or something like that, because a filtering...

MAL-2024-1298 Malicious code in dev-ansi-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f94d1245201dda16c5e1caf199f60981cb4f4cd6042c46b7d591baa6309190f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dev-ansi-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f94d1245201dda16c5e1caf199f60981cb4f4cd6042c46b7d591baa6309190f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Hummingbird Plugin <= 3.7.3 is vulnerable to Broken Access Control

Software Hummingbird Type Plugin Vulnerable versions = 3.7.3 Fixed in 3.7.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32792 Patch priority Low CVSS severity Low 4.3 Developer WPMU DEV PSID 9b701eb20e44 Credits Peng Zhou Required privilege...

SUSE CVE-2024-26862

In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignoreoutgoing ignoreoutgoing is read locklessly from devqueuexmitnit and packetgetsockopt Add appropriate READONCE/WRITEONCE annotations. syzbot reported: BUG: KCSAN: data-race in devqueuexmitn...

PT-2024-26845

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A vulnerability has been resolved in the Linux kernel, specifically in the ax25 module, which handles Amateur Radio AX.25 packet protocol. The issue is related to a netdev refcount problem. Whe...

CVE-2023-41864

Cross-Site Request Forgery CSRF vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0...

CVE-2023-41864

Technical details for CVE-2023-41864 are not provided in the supplied documents; no affected products/versions or mitigations are specified here—monitor for updates.

AZL-40085 CVE-2024-26898 affecting package kernel for versions less than 6.6.29.1-3

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmdcfgpkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet AoE driver in the Linux kernel. The aoecmdcfgpkts function...