CVE-2022-49420 net: annotate races around sk->sk_bound_dev_if

In the Linux kernel, the following vulnerability has been resolved: net: annotate races around sk-skbounddevif UDP sendmsg is lockless, and reads sk-skbounddevif while this field can be changed by another thread. Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add...

CVE-2022-49291 ALSA: pcm: Fix races among concurrent hw_params and hw_free calls

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hwparams and hwfree calls Currently we have neither proper check nor protection against the concurrent calls of PCM hwparams and hwfree ioctls, which may result in a UAF. Since the existing P...

CVE-2022-49288 ALSA: pcm: Fix races among concurrent prealloc proc writes

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent prealloc proc writes We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the...

CVE-2022-49159

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Implement ref count for SRB The timeout handler and the done function are racing. When qla2x00asynciocbtimeout starts to run it can be preempted by the normal response path via the firmware?. qla24xxasyncgpscspdone...

CVE-2022-49072

In the Linux kernel, the following vulnerability has been resolved: gpio: Restrict usage of GPIO chip irq members before initialization GPIO chip irq members are exposed before they could be completely initialized and this leads to race conditions. One such issue was observed for the gc-irq.domai...

CVE-2022-49072

CVE-2022-49072 affects the Linux kernel GPIO subsystem: gpiochip irq members can be read before initialization, causing race conditions and a potential NULL pointer dereference via I2C (gpiochip_to_irq). The issue has been resolved in the kernel by restricting access to irq-related fields until a...

CVE-2022-49072 gpio: Restrict usage of GPIO chip irq members before initialization

In the Linux kernel, the following vulnerability has been resolved: gpio: Restrict usage of GPIO chip irq members before initialization GPIO chip irq members are exposed before they could be completely initialized and this leads to race conditions. One such issue was observed for the gc-irq.domai...

PT-2025-8736 · Unknown · Met One 3400+

Name of the Vulnerable Software and Affected Versions: MET ONE 3400+ version 1.0.41 Description: The issue concerns the temporary storage of credentials in plain text within the system under rare conditions. This data is not accessible to unauthenticated users. Recommendations: For version 1.0.41...

Linux io_uring Use-After-Free Exploit

The Linux kernel suffers from a use-after-free of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without waiting for the required grace period. Summary UAF of struct ioevfd because ioeventfddosignal frees an object when the refcount reaches zero without...

GHSA-2P94-8669-XG86 Vyper's sqrt doesn't define rounding behavior

Vyper's sqrt builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. the fix is tracked in https://github.com/vyperlang/vyper/pull/4486 Vulnerability Detai...

GHSA-MRQP-Q7VX-V2CX Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC

Summary / Details Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.0-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited coul...

ALPINE-CVE-2024-39355

Improper handling of physical or environmental conditions in some IntelR Processors may allow an authenticated user to enable denial of service via local access...

Intel Core Processors 安全漏洞

Intel Core Processors is an Intel Core family of central processing units CPUs from Intel Corporation USA. A security vulnerability exists in Intel Core Processors that arises from improper handling of physical or environmental conditions that could allow an authenticated user to enable denial of...

ABB Cylon FLXeon 9.3.4 Cross Site Request Forgery

ABB Cylon FLXeon version 9.3.4 suffers from a cross site request forgery vulnerability. However, exploitation is limited to specific conditions due to the server's CORS configuration. !-- ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery RCE Vendor: ABB Ltd. Product web page:...

Improper Check for Unusual or Exceptional Conditions

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions enabling the bypass of a security feature. Remediation There is no fixed version for...

Improper Check for Unusual or Exceptional Conditions

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions enabling the bypass of a security feature. Remediation Upgrade magento/community-edition to version 2.4.4-p12, 2.4.5-p1...

CVE-2024-53648

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V9.90, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V9.90, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V9.90, SIPROTEC 5 6MD89 CP300 All versions V9.90, SIPROTEC 5...

PT-2025-6664

Name of the Vulnerable Software and Affected Versions IntelR Processors affected versions not specified Description The issue is related to the improper handling of physical or environmental conditions in some IntelR Processors. This may allow an authenticated user to enable denial of service via...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2025-1187)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger...

EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2025-1134)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger...