3955 matches found
CVE-2024-50219
CVE-2024-50219: Linux kernel GFP_ATOMIC order-0 allocations can fail under memory pressure due to how highatomic reserves are used, enabling a potential page-alloc impairment. The issue is tied to the mm/page_alloc path and specifically the fall-back behavior when free pages exist but GFP_ATOMIC ...
MAL-2024-10423 Malicious code in bytepilot-0-0-15 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 608d6f9a817cfe14b72754d3b6b3dea5967d82b8932a06092b6ab752f0a42e02 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
MAL-2024-10357 Malicious code in bytekafka-0-15 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5080a4abcce26e927e9647316733cd5313eb9422fbdcd3f971e539e62f9ccfb2 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
Malicious code in bytekafka-0-15 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5080a4abcce26e927e9647316733cd5313eb9422fbdcd3f971e539e62f9ccfb2 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...
PT-2024-33950
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: The issue arises when a BIOS provides bad data in response to an ATIF method call, causing a NULL pointer dereference in the caller. This has been encountered on at least one system. The amdg...
SUSE CVE-2024-8975
Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1...
BIT-CILIUM-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...
ROS-20241023-01
A vulnerability in the HAProxy server software is related to the opening of a 0-RTT session with a spoofed IP address. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the the functionality of the allowed/blocked IP address list...
PT-2025-2103
Name of the Vulnerable Software and Affected Versions Drupal Monster Menus versions 0.0.0 through 9.3.3 Drupal Monster Menus versions 9.4.0 through 9.4.1 Description The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially enable a remote...
PT-2024-34058
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: The issue is related to a crash in the SPI driver when not using GPIO chip select. The problem occurs because a NULL pointer is passed to gpiod direction output when spi get csgpiod returns a...
CVE-2024-49993
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-47700 ext4: check stripe size compatibility on remount as well
In the Linux kernel, the following vulnerability has been resolved: ext4: check stripe size compatibility on remount as well We disable stripe size in ext4fillsuper if it is not a multiple of the cluster ratio however this check is missed when trying to remount. This can leave us with cases where...
CVE-2024-47700 ext4: check stripe size compatibility on remount as well
In the Linux kernel, the following vulnerability has been resolved: ext4: check stripe size compatibility on remount as well We disable stripe size in ext4fillsuper if it is not a multiple of the cluster ratio however this check is missed when trying to remount. This can leave us with cases where...
CVE-2024-47692
CVE-2024-47692 : Linux kernel NFS server (nfsd) vulnerability where namelen can be 0 if main.sqlite is corrupted, causing memdup_user() to return ZERO_SIZE_PTR and leading to NULL pointer dereference when accessing name.data in nfs4_client_to_reclaim(). The issue is resolved by adding a namelen v...
CVE-2024-48636: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...
DEBIAN-CVE-2024-47080
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...
CVE-2024-48948
A flaw was found in the Elliptic Node.js package. In certain versions, the ECDSA implementation does not correctly verify valid signatures if the hash contains at least 4 leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash. This issue can lead to valid...
CVE-2024-48948
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to...
CVE-2024-9977: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BRg5.61.11WVK.0b26. Affected is an unknown function of the file /cgi-bin/settings-firewall.cgi of the component Firewall Settings Page. The manipulation of the argument SrcInterface leads to os command injectio...