CVE-2024-45791 Apache HertzBeat: Exposure sensitive token via http GET method with query string

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue...

The vulnerability of the clk component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the clk component in the Linux operating system’s kernel is related to the assignment of the NULL pointer in the clkcoreget function. Exploiting this vulnerability can allow an attacker to cause a service failure...

Flagsmith 安全漏洞

Flagsmith is an open source, full-featured feature flags and remote configuration service from Flagsmith Open Source. A security vulnerability exists in Flagsmith versions prior to 2.134.1 that stems from the getdocument endpoint not being properly protected by permissions...

Exploit for Improper Neutralization in Dlink Dns-320_Firmware

CVE-2024-10914 - D-Link Remote Code Execution RCE Exploit T...

PT-2024-35472 · Flagsmith · Flagsmith

Name of the Vulnerable Software and Affected Versions: Flagsmith versions prior to 2.134.1 Description: The issue concerns the "get document" endpoint, which is not correctly protected by permissions. This could potentially allow unauthorized access. Recommendations: For versions prior to 2.134.1...

The vulnerability of D-Link DSL-2640U and DSL-2540U router microprogramming systems lies in the lack of measures to neutralize special elements used in the operating system’s command set, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DSL-2640U and DSL-2540U router microprogramming systems lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands using metasymbols within the...

The vulnerability of the nilfs2 component in the Linux operating system’s kernel, which allows a hacker to cause a service failure

The vulnerability of the nilfs2 component in the Linux operating system’s kernel is related to improper error handling in the nilfsgetblock function. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the WireGuard component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the WireGuard component in the Linux operating system’s kernel is related to the assignment of the NULL pointer in the getpeer function. Exploiting this vulnerability can allow a hacker to trigger a service failure...

The vulnerability of the binder component in the Linux operating system’s kernel allows a hacker to execute arbitrary code.

The vulnerability of the binder component in the Linux operating system’s kernel is related to errors at the bindergetobject function. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2024-50336

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

CVE-2024-50336

CVE-2024-50336 affects matrix-js-sdk up to version 34.11.0 and allows client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients to issue arbitrary authenticated GET requests to the user’s homeserver. The issue is fixed in matrix-js-sdk 34.11.1. Affected product:...

kernel: drm/amdgpu: change vm->task_info handling

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: change vm-taskinfo handling This patch changes the handling and lifecycle of vm-taskinfo object. The major changes are: - vm-taskinfo is a dynamically allocated ptr now, and its uasge is reference counted. - introduci...

kernel: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fix possible memory leak caused by missing pcidevput pcigetdevice will increase the reference count for the returned pcidev. We need to use pcidevput to decrease the reference count before amdprobe returns. There ...

kernel: mm/swapfile: add cond_resched() in get_swap_pages()

In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: add condresched in getswappages The softlockup still occurs in getswappages under memory pressure. 64 CPU cores, 64GB memory, and 28 zram devices, the disksize of each zram device is 50MB with same priority as si. Us...

kernel: KVM: s390: fix validity interception issue when gisa is switched off

Fix validity interception issue when gisa is switched off. If gisa has been disabled either via using kernel parameter "kvm.usegisa=0" or by setting the related sysfs attribute to N echo N /sys/module/kvm/parameters/usegisa. The validity is caused by an invalid value in the SIE control block's gi...

kernel: clk: Fix clk_core_get NULL dereference

In the Linux kernel, the following vulnerability has been resolved: clk: Fix clkcoreget NULL dereference It is possible for clkcoreget to dereference a NULL in the following sequence: clkcoreget ofclkgethwfromclkspec ofclkgethwfromprovider clkgethw clkgethw can return NULL which is dereferenced b...

kernel: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes

A flaw was found in the Linux kernel’s nouveau module. The return value of the drmmodeduplicate function is not checked in the nouveauconnectorgetmodes function in the drivers/gpu/drm/nouveau/nouveauconnector.c file, possibly causing a NULL pointer dereference and resulting in a denial of service...