CVE-2024-55407: Improper Validation of Specified Quantity in Input

An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the org.apache.commons.io.input.XmlStreamReader class.

Summary Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-crafted URL request containing dot dot sequences /../ to view arbitrary files on the system...

CVE-2024-53837

Google Android devices are vulnerable to an out-of-bounds write caused by an integer overflow in the prepare_response function of the lwis_periodic_io.c file within the lwis component. This vulnerability could allow an attacker to achieve local escalation of privilege without needing additional e...

Google Android 安全漏洞

Google Android is an open source cell phone operating system developed by Google. Google Android suffers from an out-of-bounds write vulnerability that originates from an integer overflow in the prepareresponse function of the lwisperiodicio.c file, which can be exploited by an attacker to achiev...

Arbitrary Code Execution (ACE)

filippo.io/age is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to improper validation or sanitization of plugin names, identities, or recipients, allows malicious input to be introduced and will execute arbitrary code or binaries...

PT-2025-5650 · Opencv · Opencv

Name of the Vulnerable Software and Affected Versions: OpenCV affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash occurs in the cv::PngDecoder module, specifically in the read from io, read chunk, and readHeader functions. Recommendations:...

PT-2025-40084

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel’s kasan populate vmalloc function and its helpers did not correctly respect the caller’s gfp mask, always using GFP KERNEL instead. This inconsistency with vmalloc, whic...

PT-2026-2878

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's block layer related to request queue freezing within sysfs store callbacks. Freezing the request queue during these callbacks can lead to a deadlock...

PT-2026-20417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the raid1 reshape function related to managing RAID arrays via sysfs. Specifically, the issue arises from calling freeze array before and after...

CVE-2024-56686

In the Linux kernel, the following vulnerability has been resolved: ext4: fix race in bufferhead read fault injection When I enabled ext4 debug for fault injection testing, I encountered the following warning: EXT4-fs error device sda: ext4readinodebitmap:201: comm fsstress: Cannot read inode...

SUSE CVE-2024-56709

In the Linux kernel, the following vulnerability has been resolved: iouring: check if iowq is killed before queuing task work can be executed after the task has gone through iouring termination, whether it's the final taskwork run or the fallback path. In this case, task work will find -iowq bein...

SUSE CVE-2024-56740

In the Linux kernel, the following vulnerability has been resolved: nfs/localio: must clear res.replen in nfslocalreaddone Otherwise memory corruption can occur due to NFSv3 LOCALIO reads leaving garbage in res.replen: - nfs3readdone copies that into server-readhdrsize; from there nfs3procreadset...

AZL-68550 CVE-2024-56709 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring: check if iowq is killed before queuing task work can be executed after the task has gone through iouring termination, whether it's the final taskwork run or the fallback path. In this case, task work will find -iowq bein...

CVE-2024-56686

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2024-56689

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' If platformgetresourcebyname fails and returns NULL because DT lacks an 'mmio' property for the MHI endpoint, dereferencing res-start will cause a NULL pointer...

SUSE CVE-2024-53166

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfqlimitdepth Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd-lock, however bfqlimitdepth is deferencing bfqq from bic without the lock, this can lead to UAF if t...

SUSE CVE-2024-53196

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't retire aborted MMIO instruction Returning an abort to the guest for an unsupported MMIO access is a documented feature of the KVM UAPI. Nevertheless, it's clear that this plumbing has seen limited testing, since...

SUSE CVE-2024-53219

In the Linux kernel, the following vulnerability has been resolved: virtiofs: use pages instead of pointer for kernel direct IO When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------ cut here ------------ WARNING: CPU: ...

CVE-2024-56509 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read LFR or path traversal attacks. These vulnerabilities occur when user input is...

AZL-54868 CVE-2024-56670 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: userial: Fix the issue that gsstartio crashed due to accessing null pointer Considering that in some extreme cases, when userial driver is accessed by multiple threads, Thread A is executing the open operation and...