CVE-2024-39291

CVE-2024-39291 (Linux kernel) affects the amdgpu path in gfx_v9_4_3.c. The vulnerable code path is gfx_v9_4_3_init_microcode() and related rlc/mec microcode init, where the ucode_prefix buffer was too small, risking truncation when writing strings like amdgpu/%s_rlc.bin or amdgpu/%s_mec.bin with ...

Advisory ROSA-SA-2024-2434

Software: giflib 5.2.1 OS: ROSA-CHROME packageevrstring: giflib-5.2.1-4 CVE-ID: CVE-2023-39742 BDU-ID: 2023-05863 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the getarg.c component of the GIFLIB library for handling GIF files is related to a segmentation error. Exploitation of the vulnerabilit...

CVE-2024-5128

CVE-2024-5128 affects lunary-ai/lunary up to version 1.2.2, with an IDOR in dataset management endpoints that lets unauthorized users view, update, or delete any dataset_prompt or dataset_prompt_variation. Root cause: insufficient access control checks via direct object IDs. Impact is information...

CVE-2024-36930 spi: fix null pointer dereference within spi_sync

In the Linux kernel, the following vulnerability has been resolved: spi: fix null pointer dereference within spisync If spisync is called with the non-empty queue and the same spimessage is then reused, the complete callback for the message remains set while the context is cleared, leading to a...

CVE-2024-3584

qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the /collections/name/snapshots/upload endpoint. By manipulating the name parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as /root/poc.txt...

CVE-2023-52837

In CVE-2023-52837, the Linux kernel fixed a use-after-free in nbd_open triggered when a disk is opened after nbd_put() because disk->private_data could still reference freed memory. The fix adds a dedicated ->free_disk hook that frees the private data as part of disk cleanup (blk_cleanup_di...

CVE-2023-52831

CVE-2023-52831 (Linux kernel) : The issue resides in cpu/hotplug logic when CPUs are isolated with isolcpus=. Offline-ing the last non-isolated (housekeeping) CPU can cause a WARN_ON in build_sched_domains and a subsequent panic due to an empty CPU mask in partition_sched_domains_locked(), leadin...

CVE-2021-47372

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use after free on rmmod platdev-dev-platformdata is released by platformdeviceunregister, use of pclk and hclk is a use-after-free. Since device unregister won't need a clk device we adjust the function call sequen...

CVE-2021-47373

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In itsvpeirqdomainalloc, when itsvpeinit returns an error, there is an off-by-one in the number of VPEs to be freed. Fix it by simply passing the number of VPEs allocated, which...

CVE-2024-34710 Wiki.js Stored XSS through Client Side Template Injection

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection ...

CVE-2024-35849

CVE-2024-35849 affects the Linux kernel btrfs_ioctl_logical_to_ino path. The issue is an information leak: a struct btrfs_data_container allocated with kvmalloc() is copied back to user space without zero-filling, exposing uninitialized memory (Bytes 40-65535) to user-space. The root cause is lac...

CVE-2024-32655 Npgsql Vulnerable to SQL Injection via Protocol Message Size Overflow

Npgsql is the .NET data provider for PostgreSQL. The WriteBind method in src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs uses int variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This cause...

CVE-2024-31456

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15...

CVE-2024-34078

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

CVE-2022-48702 ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()

In the Linux kernel, the following vulnerability has been resolved: ALSA: emu10k1: Fix out of bounds access in sndemu10k1pcmchannelalloc The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however sndemu10k1pcmchannelalloc accesses the newly...

CVE-2024-27033 f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to remove unnecessary f2fsbugon to avoid panic verifyblkaddr will trigger panic once we inject fault into f2fsisvalidblkaddr, fix to remove this unnecessary f2fsbugon...

CVE-2023-50363 QTS, QuTS hero

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnerability in the following versions: QTS...

CVE-2024-32764 myQNAPcloud Link

A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud...

CVE-2024-32478

The CVE-2024-32478 entry refers to Git Credential Manager (GCM). Affected component: Debian package of GCM prior to version 2.5.0. Root-ownership not set on installed files, enabling a local multi-user attacker to replace the binary and potentially escalate privileges. Impact is described as priv...

CVE-2023-50260 Wazuh's vulnerability in host_deny AR script allows arbitrary command execution

Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the hostdeny script allows to write any string in the hosts.deny file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active...