Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a blocking call issue in the ima component in the RCU read critical section...

CVE-2024-5679

CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-5680

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-5680

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-5679

CVE-2024-5679 is an Out-of-Bounds Write vulnerability in the Foxboro.sys driver. A local attacker with user access can craft a program/script using an IOCTL to trigger a local denial-of-service or kernel memory leak. Documented impact is local, with high severity (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:...

CVE-2024-5679

CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-5679

CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

Malicious code in sap-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ae3c2c5f325fdd688ce4d11cc5817769bd0f903c9d0df96c60c00cd96feb4639 The OpenSSF Package Analysis project identified 'sap-call' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7652 Malicious code in sap-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ae3c2c5f325fdd688ce4d11cc5817769bd0f903c9d0df96c60c00cd96feb4639 The OpenSSF Package Analysis project identified 'sap-call' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Schneider Electric EcoStruxure Foxboro DCS Input Validation Error Vulnerability

Schneider Electric EcoStruxure Foxboro DCS is an innovative fault-tolerant, highly available control component from Schneider Electric France. An input validation error vulnerability exists in Schneider Electric EcoStruxure Foxboro DCS Core Control Services version 9.8 and prior versions, which...

Schneider Electric EcoStruxure Foxboro DCS Input Validation Error Vulnerability

Schneider Electric EcoStruxure Foxboro DCS is an innovative fault-tolerant, highly available control component from Schneider Electric France. An input validation error vulnerability exists in Schneider Electric EcoStruxure Foxboro DCS Core Control Services version 9.8 and earlier, which stems fr...

CVE-2024-5680: Improper Validation of Array Index

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

PT-2024-30702

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the trampoline generation code in the Linux kernel when BPF TRAMP F CALL ORIG is set. The trampoline calls bpf tramp enter and bpf tramp exit functions, passing...

PT-2024-29222

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.0-rc5+ Description The issue is related to insufficient input validation in the netfilter component of the Linux kernel, specifically in the nf tables rule release, nft chain validate, nft chain validate...

CVE-2024-5679: Out-of-bounds Write

CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-5681: Improper Input Validation

CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

Django Path Traversal vulnerability

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generatefilename without replicating the file-path validations from the parent class, potentially allow directory traversal via certain...

UBUNTU-CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-39330

A directory traversal vulnerability exists in Django versions prior to 5.0.7 and 4.2.14. The root cause is that derived classes of the django.core.files.storage.Storage base class may allow traversal if they override the generate_filename() method without replicating the parent class's file-path ...

PT-2024-30730

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the handling of CEQEs in the interrupt handler, which can cause the CPU core to stay in interrupt context too long and lead to soft lockup under heavy load. To...