CVE-2024-50145

In the Linux kernel, the following vulnerability has been resolved: octeonep: Add SKB allocation failures handling in octepoqprocessrx buildskb returns NULL in case of a memory allocation failure so handle it inside octepoqprocessrx to avoid NULL pointer dereference. octepoqprocessrx is called...

CVE-2024-50160 ALSA: hda/cs8409: Fix possible NULL dereference

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If sndhdagenaddkctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line. Since dolphinfixups function is a hdafixup function which i...

CVE-2024-50160 ALSA: hda/cs8409: Fix possible NULL dereference

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If sndhdagenaddkctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line. Since dolphinfixups function is a hdafixup function which i...

CVE-2024-50160

In CVE-2024-50160, the Linux kernel ALSA hda/cs8409 driver could dereference NULL if snd_hda_gen_add_kctl failed to allocate memory, leading to a NULL pointer dereference. The fix adds a pre-dereference check in the dolphin_fixups hda_fixup path (which is not supposed to return errors) and ignore...

CVE-2024-50145

Summary: CVE-2024-50145 concerns the Linux kernel octeon_ep driver. The root cause is the possibility that build_skb() returns NULL on memory allocation failure during RX processing in __octep_oq_process_rx(). The documented fix handles such skb allocation failures inside __octep_oq_process_rx():...

CVE-2024-50145 octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()

In the Linux kernel, the following vulnerability has been resolved: octeonep: Add SKB allocation failures handling in octepoqprocessrx buildskb returns NULL in case of a memory allocation failure so handle it inside octepoqprocessrx to avoid NULL pointer dereference. octepoqprocessrx is called...

CVE-2024-50145 octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()

In the Linux kernel, the following vulnerability has been resolved: octeonep: Add SKB allocation failures handling in octepoqprocessrx buildskb returns NULL in case of a memory allocation failure so handle it inside octepoqprocessrx to avoid NULL pointer dereference. octepoqprocessrx is called...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Crowd Data Center and Server

This High severity org.apache.tomcat:tomcat-coyote Dependency vulnerability was introduced in versions 5.2.0, 5.3.0, and 6.0.0 of Crowd Data Center and Server. This org.apache.tomcat:tomcat-coyote Dependency vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of...

Security Bulletin: IBM Sterling Control Center is affected by vulnerability in Apache Tomcat

Summary OSS Scan Vulnerability - Apache Tomcat 8.5.70 & Apache Tomcat 8.5.75 with multiple CVEs and affecting Sterling Control Center v6.2.1. Vulnerability Details CVEID:CVE-2021-42340 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by a memory leak flaw in WebSocket...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM Java Buffer overflow in GC

Summary IBM Java: Buffer overflow in GC when using the -Xgc:concurrentScavenge option on IBM Z is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-3933 DESCRIPTION: Eclipse Openj9 could allow a local authenticated attacker to bypass security restrictions,...

PT-2024-7918

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.21 Bitbucket Data Center and Server versions 8.6.0 through 8.19.0 Bitbucket Data Center and Server versions 9.0.0 through 9.4.0 Bitbucket Data Center and Server version 8.9.0 through 8.9.23 Bitbucket Data Center a...

XSS (Cross Site Scripting) DOMPurify Dependency in Jira Core Data Center and Server

|Please see our updated fixed version guidance for this CVE, as the fix issued in our November 2024 Security Bulletin was incomplete. This vulnerability has now been mitigated in Jira Software and the correct fixed versions have been added to this ticket. We apologize for any inconvenience our...

CVE-2024-20540

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists...

CVE-2024-20540

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists...

CVE-2024-20540 Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists...

CVE-2024-20540 Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists...

CVE-2024-20484 Cisco Enterprise Chat and Email Denial of Service Vulnerability

A vulnerability in the External Agent Assignment Service EAAS feature of Cisco Enterprise Chat and Email ECE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient validation of Media Routing...

CVE-2024-20484 Cisco Enterprise Chat and Email Denial of Service Vulnerability

A vulnerability in the External Agent Assignment Service EAAS feature of Cisco Enterprise Chat and Email ECE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient validation of Media Routing...

Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists...

Path Traversal org.springframework:spring-webmvc Dependency in Confluence Data Center and Server

This High severity org.springframework:spring-webmvc Dependency vulnerability was introduced in versions 3.0 of Confluence Data Center and Server. This org.springframework:spring-webmvc Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...