kernel: Linux kernel: Denial of Service due to memory leak in mmc: vub300 module

A flaw was found in the Linux kernel's mmc: vub300 module. An incorrect return value check for mmcaddhost and a missing call to mmcfreehost when usbcontrolmsg fails can lead to memory leaks. A local attacker could exploit this vulnerability, causing the kernel to crash and resulting in a Denial o...

kernel: mmc: alcor: fix return value check of mmc_add_host()

A flaw was found in the Linux kernel's Alcor Micro MMC card reader driver. When mmcaddhost fails, its return value is not checked, causing memory allocated by mmcallochost to leak. Additionally, the remove path may attempt to delete a device that was never added, leading to a kernel crash...

kernel: mmc: via-sdmmc: fix return value check of mmc_add_host()

A flaw was found in the VIA SD/MMC host controller driver. When mmcaddhost fails, the error is not checked, leading to memory leaks and potential null pointer dereference during driver removal...

kernel: scsi: mpi3mr: Sanitise num_phys

A vulnerability was found in the Linux kernel's mpi3mr driver in the mpi3mrsasportadd function, where a lack of proper checks could lead to values that are larger than what the defined size of the numphys field in the mrsasnode structure being inserted, causing the field to be overwritten and...

MAL-2024-10656 Malicious code in eslint-plugin-add-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8efa7275ffd4613db923c31dba516fc3434fb3fecb4ccfbd1e1cb929399a6b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-add-display-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8efa7275ffd4613db923c31dba516fc3434fb3fecb4ccfbd1e1cb929399a6b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Teachers Record Management System add-teacher.php File SQL Injection Vulnerability

Teachers Record Management System is a teacher record management system. Teachers Record Management System is vulnerable to a SQL injection vulnerability that stems from the presence of a SQL injection vulnerability in the add-teacher.php file via a cell phone number or email parameter. No detail...

CVE-2024-10265

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for...

driver core: Fix a potential null-ptr-deref in module_add_driver()

...

net: do not delay dst_entries_add() in dst_release()

...

CVE-2024-10683

CVE-2024-10683 affects the WordPress plugin Contact Form 7 – PayPal & Stripe Add-on, due to unsafe use of add_query_arg/remove_query_arg without proper escaping. The issue is Reflected XSS, exploitable by unauthenticated actors who can trick a user into clicking a manipulated link, with exploitat...

WordPress Contact Form 7 - PayPal & Stripe Add-on plugin <= 2.3.1 - Reflected Cross-Site Scripting vulnerability

WordPress Contact Form 7 - PayPal & Stripe Add-on plugin = 2.3.1 - Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.3.1...

CVE-2024-50966

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/doAdminAction.php?act=addAdmin...

The vulnerability of the iommufd component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the iommufd component in the Linux operating system’s kernel is related to improper release of resources in the ioptaddaccess function. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2024-40628 · Git +1 · Krb5

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves the k5 hashtab add and insert entry functions in the fuzz...

PT-2024-34476 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/doAdminAction.php?act=addAdmin component. This allows for attacker-controlled admin creation, resulting in unauthorized privileged...

Mars: unauthorized access and add user and change personal information all users

The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...

CVE-2024-43425 Moodle: remote code execution via calculated question types

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

UBUNTU-CVE-2024-50159

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix the double free in scmidebugfscommonsetup Clang static checkerscan-build throws below warning： | drivers/firmware/armscmi/driver.c:line 2915, column 2 | Attempt to free released memory. When...

CVE-2024-50140 sched/core: Disable page allocation in task_tick_mm_cid()

In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in tasktickmmcid With KASAN and PREEMPTRT enabled, calling taskworkadd in tasktickmmcid may cause the following splat. 63.696416 BUG: sleeping function called from invalid context at...