CVE-2024-42241: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-sized page cache can't be supported by xarray. For example, 512MB page cache on ARM64 when the base page size is 64KB can't be supported by...

CVE-2024-7523: Improper Restriction of Rendered UI Layers or Frames

A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This issue only affects Android versions of Firefox. This vulnerability affects Firefox 129...

CVE-2024-28962: Externally Controlled Reference to a Resource in Another Sphere

Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service...

PT-2024-12340 · Keepass · Keepass

Name of the Vulnerable Software and Affected Versions: KeePass affected versions not specified Description: The issue concerns a vulnerability in KeePass, which can be exploited by attackers. The vulnerability is related to XOR encryption and can be used to gain unauthorized access. There have be...

CVE-2024-41123

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, and . The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities...

CVE-2024-42121

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check index msgid before read or write WHAT msgid is used as an array index and it cannot be a negative value, and therefore cannot be equal to MODHDCPMESSAGEIDINVALID -1. HOW Check whether msgid is valid before...

CVE-2024-38429 Matrix - CWE-552: Files or Directories Accessible to External Parties

Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties...

CVE-2024-38429 Matrix - CWE-552: Files or Directories Accessible to External Parties

Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties...

AZL-47379 CVE-2024-42224 affecting package kernel for versions less than 6.6.43.1-7

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 "net: dsa: mv88e6xxx: Support multiple MDIO busses" mv88e6xxxdefaultmdiobus has checked that the return value of listfirstentry is non-NULL. This appears...

CVE-2024-42132: Release of Invalid Pointer or Reference

In the Linux kernel, the following vulnerability has been resolved: bluetooth/hci: disallow setting handle bigger than HCICONNHANDLEMAX Syzbot hit warning in hciconndel caused by freeing handle that was not allocated using ida allocator. This is caused by handle bigger than HCICONNHANDLEMAX passe...

CVE-2024-40817: Improper Restriction of Rendered UI Layers or Frames

The issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Visiting a website that frames malicious content may lead to UI spoofing...

Meta Given Deadline to Address E.U. Concerns Over 'Pay or Consent' Model

Meta has been given time till September 1, 2024, to respond to concerns raised by the European Commission over its "pay or consent" advertising model or risk-facing enforcement measures, including sanctions. The European Commission said the Consumer Protection Cooperation CPC Network has notified...

CVE-2024-5997: Missing Authorization

The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicateuser and duplicatepost functions in all versions up to, and including, 0.6. This makes it possible for authenticate...

CVE-2024-6504: Allocation of Resources Without Limits or Throttling

Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the conso...

CVE-2024-41009: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumerpos is the consumer counter to show which...

CVE-2024-6326: Improper Privilege Management

An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders wh...

CVE-2024-21174: Allocation of Resources Without Limits or Throttling

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.23, 21.3-21.14 and 23.4. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to...

CVE-2024-5630: Unrestricted Upload of File with Dangerous Type

The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites...

WordPress Website Content in Page or Post plugin < 2024.04.09 - Contributor+ Stored Cross-Site Scripting vulnerability

Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ayush Juneja in WordPress Plugin Website Content in Page or Post versions 2024.04.09...

CVE-2024-2430: Improper Neutralization of Input During Web Page Generation

The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...