Log Injection

org.apache.nifi, nifi is vulnerable to Log Injection. The vulnerability is due to the optional debug logging feature, which allows an authorized administrator to enable detailed logging of Parameter Context values during flow synchronization...

Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005562 fixes several issues. The following security issues were fixed: CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool bsc1225429. CVE-2024-36904: tcp: Use refcountincnotzero in tcptwskunique bsc1225733. CVE-2024-43861: Fix memor...

PT-2025-25573 · Google · Chrome Os

Name of the Vulnerable Software and Affected Versions: Google ChromeOS versions 16063.45.2 and potentially others Description: The issue allows a local attacker to gain root code execution via exploiting a debug shell accessible through specific key combinations during developer mode entry and...

Security update for the Linux Kernel (Live Patch 3 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002317 fixes several issues. The following security issues were fixed: CVE-2024-43861: Fix memory leak for not ip packets bsc1229553. CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks bsc1229273. CVE-2023-52752: smb: client: fix...

SUSE CVE-2024-53128

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fix objectisonstack for KASAN tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the obj pointer,...

The vulnerability of the qedf component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the qedf component in the Linux operating system’s kernel is related to the operation of writing data beyond the buffer boundaries in the qedfdbgdebugcmdwrite function. Exploiting this vulnerability can allow an attacker to cause a system failure...

AZL-54277 CVE-2024-53128 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fix objectisonstack for KASAN tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the obj pointer,...

DEBIAN-CVE-2024-53128

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fix objectisonstack for KASAN tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the obj pointer,...

UBUNTU-CVE-2024-53128

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fix objectisonstack for KASAN tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the obj pointer,...

CVE-2024-53128

The CVE-2024-53128 issue is in the Linux kernel’s sched/task_stack path: when CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, object_is_on_stack() may yield incorrect results because tagged pointers in the object could differ from the untagged stack pointer. The result can trigger warnin...

kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation

A denial of service vulnerability was found in the Linux kernel. When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set, then entrySYSENTERcompat uses CLEARBRANCHHISTORY and calls the clearbhbloop before the TF flag is cleared. This causes the DB handler excdebugkernel to iss...

kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation

A denial of service vulnerability was found in the Linux kernel. When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set, then entrySYSENTERcompat uses CLEARBRANCHHISTORY and calls the clearbhbloop before the TF flag is cleared. This causes the DB handler excdebugkernel to iss...

kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation

A denial of service vulnerability was found in the Linux kernel. When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set, then entrySYSENTERcompat uses CLEARBRANCHHISTORY and calls the clearbhbloop before the TF flag is cleared. This causes the DB handler excdebugkernel to iss...

PT-2024-10666 · Unknown · /Proc/Driver/Wmt Dbg

Name of the Vulnerable Software and Affected Versions: /proc/driver/wmt dbg driver affected versions not specified Description: The issue concerns the /proc/driver/wmt dbg driver, where several possible out of bounds writes could lead to local escalation of privilege. System execution privileges...

PT-2024-10667 · Gt1151 · Gt1151

Name of the Vulnerable Software and Affected Versions: GT1151 affected versions not specified Description: The issue is related to a possible out of bounds write due to a missing bounds check in the gt1x debug write proc and gt1x tool write functions of the gt1x generic.c and gt1x tools.c files...

Cisco Small Business SPA300 and SPA500 Series IP Phones Local Code Execution (CVE-2014-3312)

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435...

AZL-53970 CVE-2024-53257 affecting package vitess for versions less than 19.0.4-7

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

AZL-53977 CVE-2024-53257 affecting package vitess for versions less than 17.0.7-7

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

Vitess 安全漏洞

Vitess is a database clustering system for horizontally scaling MySQL from the Vitess open source. A security vulnerability exists in Vitess that stems from the /debug/querylogz and /debug/env pages of vtgate and vttablet not properly escaping user input...

The vulnerability of the Intel Server Debug and Provisioning Tool (Intel SDP) in managing and operating server infrastructure affects Windows operating systems. This vulnerability stems from insufficient access control mechanisms, allowing attackers to increase their privileges.

The vulnerability of the Intel Server Debug and Provisioning Tool Intel SDP for operating systems running on Windows relates to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...