The vulnerability in the `arch/s390/boot/decompressor.c` component of the Linux operating system, related to copying buffers without checking the input data, allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the arch/s390/boot/decompressor.c component of the Linux operating system involves copying buffers without checking the input data. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the stbi__load_gif_main component in the C/C++ Libstb library, related to the repeated release of memory, allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the stbiloadgifmain component in the C/C++ Libstb library is related to the repeated release of memory. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and even cause service failures through the use of a...

The vulnerability in the Firefox web browser, related to the absence of a handler that prevents unauthorized access to confidential data, allows attackers to compromise the integrity of such data and cause service interruptions.

The vulnerability in the Firefox web browser is related to the absence of a handler. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service interruptions...

The vulnerability of the WebRTC component in the Firefox web browser, related to memory usage after it is freed, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WebRTC component in the Firefox web browser relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service interruptions...

The vulnerability of the dtSearch component in the Linux operating system’s kernel, which leads to uncontrolled resource consumption, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the dtSearch component in the Linux operating system’s kernel is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the GIMP graphic editor arises from the possibility of an operation exceeding the buffer boundaries in memory. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the GIMP graphic editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures due to the malicious file...

The vulnerability of the Linux operating system’s kernel, related to uncontrolled resource consumption, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Linux operating system’s kernel is related to uncontrolled resource consumption. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures...

ROS-20240902-01

A vulnerability in Intel Microcode processor microcode is related to the possibility of unauthorized bug injection. Exploitation of the vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause a denial of service. Intel Microcode processor...

ROS-20240902-23

A vulnerability in the Flatpak application and environment management tool is related to improper Neutralization of special output elements used by a downstream component. Exploitation of the vulnerability could allow a remote attacker to gain access to sensitive data and compromise its integrity...

ROS-20240820-12

A vulnerability in the JavaFX component of Oracle GraalVM Enterprise Edition virtual machine and Oracle Java SE software platform is related to insufficient input validation. Oracle Java SE platform is related to insufficient input data validation. Exploitation of the vulnerability could allow an...

Understanding the New Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVE-2024-21302)

On August 7, 2024, Microsoft disclosed a significant security vulnerability affecting Windows-based systems, known as CVE-2024-21302. This zero-day vulnerability allows attackers with administrator privileges to elevate their access by replacing current versions of Windows system files with...

Advisory ROSA-SA-2024-2462

Software: gstreamer1.0-plugins-good 1.19.1 OS: ROSA-CHROME packageevrstring: gstreamer1.0-plugins-good-1.19.1-4 CVE-ID: CVE-2022-2122 BDU-ID: 2022-06453 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the qtdemuxinflate function of the Gstreamer multimedia framework is caused by an integer overflow...

U.S. Dept Of Defense: DoD workstation exposed to internet via TinyPilot KVM with no authentication

The DoD workstation was exposed to the internet via a TinyPilot KVM device without any authentication. The TinyPilot KVM device was connected to the workstation and allowed remote access to the system over the internet...

CVE-2024-41947 XWiki Platform XSS through conflict resolution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the...

CVE-2024-40422

CVE-2024-40422 concerns path traversal in the Devika v1 snapshot API. Affected: stitionai devika version v1, endpoint /api/get-browser-snapshot. Root cause: manipulation of the snapshot_path parameter lets an attacker traverse directories and access sensitive server files, enabling confidentialit...

ROS-20240717-01

Vulnerability of clientsendparams function in lib/ext/presharedkey.c component of GnuTLS transport layer security library is related to memory usage after its release. of GnuTLS transport layer is related to memory usage after its release. Exploitation exploitation of the vulnerability could allo...

CVE-2024-6036 Denial of Service in gaizhenbiao/chuanhuchatgpt

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the /queue/join? endpoint with "fnindex":66. This unrestricted server restart capability can severely disrupt service availability, cause data loss or...

PT-2024-6615

Name of the Vulnerable Software and Affected Versions: Certifi versions 2021.05.30 through 2024.07.03 Description: The issue is related to the insufficient validation of data when processing the GLOBALTRUST root certificate, which may allow a remote attacker to compromise the integrity of protect...

ROS-20240703-10

Vulnerability of usbguard-dbus daemon of USBGuard USB device protection software is related to an error of access error of an unprivileged user who could connect USB devices. Exploitation of the vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, a...

CVE-2024-5482

A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...