Linux kernel dbgfs Target Disclosure

The vulnerability of the dbgfstargetidswrite function in the dbgfs component of the Linux operating system’s kernel is related to the issue of targetids being written multiple times without the monitoring and termination of DAMON. The number of references does not decrease, and memory for the...

CVE-2024-42285

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...

DEBIAN-CVE-2024-42285

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...

UBUNTU-CVE-2024-42285

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...

CVE-2024-42285

CVE-2024-42285 affects the Linux kernel RDMA/iwcm subsystem. The issue is a use-after-free involving destroying CM IDs: a newly allocated rdma_id_private (conn_id) is linked to an existing iw_cm_id (cm_id) and used to set cm_id->context and cm_id->cm_handler, while rdma_destroy_id() frees b...

CVE-2024-42285 RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...

Hackers Leak 1.4 Billion Tencent User Accounts Online

Massive data leak exposes 1.4 billion Tencent user accounts. Leaked data includes emails, phone numbers, and QQ IDs…...

A refresher on Talos’ open-source tools and the importance of the open-source community

Open-source software that is free to download, deploy and modify is a vital component in the fight for cyber security. Freely available software not only helps defend systems that would otherwise be unprotected, but it also allows people to learn and develop vital cybersecurity skills. In this...

PayPal,Credit Card and Debit Card Payment SQL注入漏洞

PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe individual developer. A SQL injection vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can use this vulnerability to send a specially crafted quer...

School Attendance Monitoring System和School Event Management System 跨站脚本漏洞

School Event Management System is a school event management system and School Attendance Monitoring System is a school attendance monitoring system. A cross-site scripting vulnerability exists in School Attendance Monitoring System and School Event Management System version 1.0. An attacker can...

CVE-2024-3827

The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

PT-2024-27908

Name of the Vulnerable Software and Affected Versions Spectra Pro plugin for WordPress versions up to, and including, 1.1.4 Description The issue is related to Stored Cross-Site Scripting via block ids due to insufficient input sanitization and output escaping on user-supplied attributes. This...

CVE-2024-3827: Improper Neutralization of Input During Web Page Generation

The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-41926

Mattermost server (github.com/mattermost/mattermost-server) is affected by CVE-2024-41926. Versions 9.9.x up to 9.9.0 and 9.5.x up to 9.5.6 fail to validate the source of sync messages, allowing a malicious remote to set arbitrary RemoteId values for synced users and thus claim a user was synced ...

About the security content of visionOS 1.3

About the security content of visionOS 1.3 This document describes the security content of visionOS 1.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

About the security content of iOS 16.7.9 and iPadOS 16.7.9

About the security content of iOS 16.7.9 and iPadOS 16.7.9 This document describes the security content of iOS 16.7.9 and iPadOS 16.7.9. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

About the security content of tvOS 17.6

About the security content of tvOS 17.6 This document describes the security content of tvOS 17.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

About the security content of iOS 17.6 and iPadOS 17.6

About the security content of iOS 17.6 and iPadOS 17.6 This document describes the security content of iOS 17.6 and iPadOS 17.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

About the security content of macOS Sonoma 14.6

About the security content of macOS Sonoma 14.6 This document describes the security content of macOS Sonoma 14.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...

CVE-2024-42029

xdg-desktop-portal-hyprland aka an XDG Desktop Portal backend for Hyprland before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment...