PT-2024-25544 · Weblizar · Weblizar School Management Pro

Name of the Vulnerable Software and Affected Versions: Weblizar School Management Pro versions through 10.3.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation...

CVE-2024-27053

A flaw was found in the Linux kernel's Wi-Fi hif.c driver, where RCU-protected data is accessed without correctly managing the required RCU read-side critical section. This can lead to synchronization issues, including race conditions and use-after-free errors when accessing this data. This...

Exploit for Code Injection in Crushftp

CVE-2024-4040: CrushFTP File Read Vulnerability Overview...

DEBIAN-CVE-2024-27053

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ 333 N...

CVE-2024-27053

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ 333 N...

CVE-2024-27053 wifi: wilc1000: fix RCU usage in connect path

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ 333 N...

CVE-2024-27053

CVE-2024-27053 affects the Linux kernel WiFi Wilc1000 driver in the connect path. The root cause is incorrect RCU usage in wilc1000/hif.c during target BSS parameter parsing in the cfg80211 connect flow, which can dereference an RCU pointer outside an RCU critical section. A fix moves the RCU-der...

CVE-2024-27053

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ 333 N...

CVE-2024-27053 wifi: wilc1000: fix RCU usage in connect path

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ 333 N...

DEBIAN-CVE-2024-26943

In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: handle kcalloc allocation failure The kcalloc in nouveaudmemevictchunk will return null if the physical memory has run out. As a result, if we dereference srcpfns, dstpfns or dmaaddrs, the null pointer dereference...

CVE-2024-26984 nouveau: fix instmem race condition around ptr stores

In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address:...

Tinyproxy 资源管理错误漏洞

Tinyproxy is a lightweight HTTP/HTTPS proxy server that is primarily used to forward HTTP requests across a computer network. A memory misreference vulnerability exists in Tinyproxy HTTP header handling, which is caused by post-release usage in HTTP connection header parsing. An attacker could...

RIOT RIOT-OS 缓冲区错误漏洞

RIOT RIOT-OS is an operating system for applications in the Internet of Things IoT space. A security vulnerability exists in RIOT RIOT-OS that stems from a lack of proper input checking and may result in a RIOT buffer overflow via assert...

[SECURITY] [DLA 3804-1] nghttp2 security update

Debian LTS Advisory DLA-3804-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin April 30, 2024 https://wiki.debian.org/LTS Package : nghttp2 Version : 1.36.0-2+deb10u3 CVE ID : CVE-2024-28182 Debian Bug : 1068415 Bartek Nowotarskis discovered that nghttp2, a set of...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

bind9: Parsing large DNS messages may cause excessive CPU load

A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service...

kernel: mm/sparsemem: fix race in accessing memory_section->usage

A race condition was found on a PFN in the Linux Kernel, which can fall into the device memory region with the system memory configuration. Normal zone start and end PFNs contain the device memory PFNs as well, and the compaction triggered will try on the device memory PFNs and end up in NOP. Thi...

Important: nghttp2

Issue Overview: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage ...

Amazon Linux 2 : nghttp2 (ALAS-2024-2523)

The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2523 advisory. nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps...

Debian dla-3804 : libnghttp2-14 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3804 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3804-1 [email protected] https://www.debian.org/lts/security/...