CVE-2022-48727: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Avoid consuming a stale esr value when SError occur When any exception other than an IRQ occurs, the CPU updates the ESREL2 register with the exception syndrome. An SError may also become pending, and will be...

The vulnerability of the rvu_npc_freemem() function in the Marvell OcteonTX2 kernel driver for the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rvunpcfreemem function in the drivers/net/ethernet/marvell/octeontx2/af/rvunpc.c file of the Marvell OcteonTX2 operating system is related to the re-release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2024-4680 Insufficient Session Expiration in zenml-io/zenml

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

RHEL 5 : curl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - curl: NTLM password overflow via integer overflow CVE-2018-14618 - cURL and libcurl 7.10.6 through 7.34.0...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient filtering of submitted values in readonly form fields, including ReadonlyField, LookupField, HTMLReadonlyField, and TimeFieldReadonly. These fields can retain unfiltered data from form...

CVE-2021-47510

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix re-dirty process of tree-log nodes There is a report of a transaction abort of -EAGAIN with the following script. !/bin/sh for d in sda sdb; do mkfs.btrfs -d single -m single -f /dev/$d done mount /dev/sda /mnt/test...

CVE-2021-47510

CVE-2021-47510 affects the Linux kernel's btrfs implementation. A write-hole during tree-log node freeing on zoned devices can trigger a transaction abort (-11) with -EAGAIN when the tree-log depth is ≥ 2, causing write failures during fsync/write paths. The issue is fixed by correctly re-dirtyin...

CVE-2021-47510 btrfs: fix re-dirty process of tree-log nodes

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix re-dirty process of tree-log nodes There is a report of a transaction abort of -EAGAIN with the following script. !/bin/sh for d in sda sdb; do mkfs.btrfs -d single -m single -f /dev/$d done mount /dev/sda /mnt/test...

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system allows a intruder to re-record any files in the system.

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the validation of input data during the processing of sequence bypasses for directories. Exploiting this vulnerability allows a malicious actor to re-record any files in the system...

CVE-2024-35050

A security vulnerability exists in SurveyKing v1.3.1 , where an attacker can escalate privileges by reusing a session ID belonging to a user who was previously deleted by an administrator. This flaw is attributed to insufficient session expiration (CWE-613). The vulnerability allows for high impa...

CVE-2024-21474 Stack-based Buffer Overflow in PMIC

Memory corruption when size of buffer from previous call is used without validation or re-initialization...

CVE-2024-21474

CVE-2024-21474 concerns Qualcomm PMIC reliability due to a memory corruption vulnerability. The issue arises when a buffer size from a previous call is used without proper validation or re-initialization, enabling memory corruption. Connected sources identify the CVE with multiple feeds naming Qu...

CVE-2024-26996 usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix UAF ncm object at re-bind after usb ep transport error When ncm function is working and then stop usb0 interface for link down, ethstop is called. At this piont, accidentally if usb transport error should...

kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA bnxtre driver. A local user could exploit a race condition that occurs when a Queue Pair QP is destroyed, but completion queue CQ polling continues. This can lead to a kernel panic, resulting in a Denial of Service DoS on the...

CVE-2023-6787

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...

CVE-2023-6787 Keycloak: session hijacking via re-authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...

CVE-2023-6787

Keycloak is affected by CVE-2023-6787 due to an error in the re-authentication flow (org.keycloak.authentication). Triggering a new authentication with prompt=login can hijack an active session, because if the user cancels via Restart login, a new session with a different SUB may end up sharing t...

CVE-2023-6787 Keycloak: session hijacking via re-authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...

CVE-2023-6787 Keycloak: session hijacking via re-authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...

CVE-2023-6787: Improper Authentication

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter...