Linux hv_netvsc DoS

The vulnerability of the hvnetvsc component in the Linux operating system is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-50154

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timerpending in reqskqueueunlink. Martin KaFai Lau reported use-after-free 0 in reqsktimerhandler. """ We are seeing a use-after-free from a bpf prog attached to tracetcpretransmitsynack. The program passes th...

CVE-2024-50167

CVE-2024-50167 involves the Linux kernel be2net memory path where be_xmit() can leak the skb when be_xmit_enqueue() fails, returning NETDEV_TX_OK without freeing resources. The fix adds dev_kfree_skb_any() to free the skb in that code path. Connected advisories confirm the issue is addressed in n...

CVE-2024-50154 tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timerpending in reqskqueueunlink. Martin KaFai Lau reported use-after-free 0 in reqsktimerhandler. """ We are seeing a use-after-free from a bpf prog attached to tracetcpretransmitsynack. The program passes th...

CVE-2024-50154 tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timerpending in reqskqueueunlink. Martin KaFai Lau reported use-after-free 0 in reqsktimerhandler. """ We are seeing a use-after-free from a bpf prog attached to tracetcpretransmitsynack. The program passes th...

Malicious code in ethrereum-js-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcdc76532c3b912681eb183f0654c2ef268dd8926cd3ee20b3265c930ed09865 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10318

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they...

CVE-2024-10318 NGINX OpenID Connect Vulnerability

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they...

CVE-2024-10318 NGINX OpenID Connect Vulnerability

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they...

CVE-2024-51500

The CVE-2024-51500 entry affects Meshtastic firmware. Description details that the firmware does not inspect packets from the special broadcast address 0xFFFFFFFF, enabling a malicious actor to craft a broadcast-like packet that amplifies a single message into multiple messages across every node,...

CVE-2024-51500 Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware

Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address 0xFFFFFFFF which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could cra...

Google's AI Tool Big Sleep Finds Zero-Day Vulnerability in SQLite Database Engine

Google said it discovered a zero-day vulnerability in the SQLite open-source database engine using its large language model LLM assisted framework called Big Sleep formerly Project Naptime. The tech giant described the development as the "first real-world vulnerability" uncovered using the...

PT-2024-27991 · Hgsl · Hgsl

Name of the Vulnerable Software and Affected Versions: HGSL affected versions not specified Description: The issue involves memory corruption that occurs when invoking IOCTL calls from user-space for the HGSL memory node. This can potentially lead to exploitation. Recommendations: At the moment,...

EulerOS 2.0 SP12 : vim (EulerOS-SA-2024-2793)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack...

CVE-2024-43157

Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10...

Exploit for SQL Injection in Ultimatemember Ultimate_Member

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof o...

firefox: thunderbird: Use-after-free in layout with accessibility

The Mozilla Foundation's Security Advisory: An attacker could cause a use-after-free when accessibility is enabled, leading to a potentially exploitable crash...

SUSE-SU-2024:3860-1 Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005562 fixes several issues. The following security issues were fixed: - CVE-2024-35905: Fixed int overflow for stack access size bsc1226327. - CVE-2021-47598: schcake: do not call cakedestroy from cakeinit bsc1227471. - CVE-2024-35863: Fixed potential...

SUSE SLES15 Security Update : kernel (Live Patch 19 for SLE 15 SP4) (SUSE-SU-2024:3799-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3799-1 advisory. This update for the Linux Kernel 5.14.21-1504002492 fixes several issues. The following security issues were fixed: - CVE-2021-47598: schcake: ...

Mattermost security vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability in Mattermost version 9.10.2 and prior 9.10.x, version 9.11.1 and prior 9.11.x, and version 9.5.9 and prior 9.5.x stems from an inability to prevent the display of detailed err...