WordPress Disc Golf Manager Plugin <= 1.0.0 is vulnerable to PHP Object Injection

Software Disc Golf Manager Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-48026 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID ad0f79b4fc3a Credits LVT-tholv2k Required privilege...

EulerOS 2.0 SP12 : python-dns (EulerOS-SA-2024-2513)

According to the versions of the python-dns package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an...

Advisory ROSA-SA-2024-2495

Software: libvpx 1.7.0 OS: ROSA Virtualization 2.1 packageevrstring: libvpx-1.7.0-11.rv3 CVE-ID: CVE-2023-44488 BDU-ID: 2023-06350 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libvpx multimedia library is related to incorrect handling of exceptional states when processing certain special form...

Advisory ROSA-SA-2024-2487

Software: flatpak 1.0.9 OS: rosa-server79 packageevrstring: flatpak-1.0.9-13.res7 CVE-ID: CVE-2021-41133 BDU-ID: 2022-00259 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Flatpak application and environment management tool is related to a lack of blocking in the seccomp filter of mount-related...

Medium: python-dns

Issue Overview: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error CVE-2024-41098 In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcmsendmsg for the same socket. CVE-2024-44946 In the Linux...

uPlot 安全漏洞

uPlot is a fast, memory-efficient Canvas 2D-based chart for drawing time series, lines, areas, ohlc, and bars from leeoniya personal developer. A security vulnerability exists in uPlot versions prior to 1.6.31, which stems from a lack of checking whether attributes resolve to object prototypes...

yt-dlp: Multiple Vulnerabilities

Background yt-dlp is a youtube-dl fork with additional features and fixes. Description Multiple vulnerabilities have been found in yt-dlp. Please review the referenced CVE identifiers for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

CVE-2024-46845

In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a ti...

CVE-2024-46814

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check msgid before processing transcation WHY & HOW HDCPMESSAGEIDINVALID -1 is not a valid msgid nor is it a valid array index, and it needs checking before used. This fixes 4 OVERRUN issues reported by Coverity...

CVE-2024-46861 usbnet: ipheth: do not stop RX on failing RX callback

In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: do not stop RX on failing RX callback RX callbacks can fail for multiple reasons: Payload too short Payload formatted incorrecly e.g. bad NCM framing Lack of memory None of these should cause the driver to seize u...

CVE-2024-46857 net/mlx5: Fix bridge mode operations when there are no VFs

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa 168.967392 BUG: kernel NULL pointer dereference,...

CVE-2024-46857 net/mlx5: Fix bridge mode operations when there are no VFs

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa 168.967392 BUG: kernel NULL pointer dereference,...

CVE-2024-46840 btrfs: clean up our handling of refs == 0 in snapshot delete

In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUGONrefs == 0, which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walkdownproc we...

CVE-2024-46828 sched: sch_cake: fix bulk flow accounting logic for host fairness

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: fix bulk flow accounting logic for host fairness In schcake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when...

CVE-2024-46819 drm/amdgpu: the warning dereferencing obj for nbio_v7_4

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbiov74 if rasmanager obj null, don't print NBIO err data...

CVE-2024-46819 drm/amdgpu: the warning dereferencing obj for nbio_v7_4

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbiov74 if rasmanager obj null, don't print NBIO err data...

kernel: net/sched: Fix UAF when resolving a clash

A use-after-free vulnerability was found in the net/sshd tcfctflowtableprocessconn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability...

ZNC: Remote Code Execution

Background ZNC is an advanced IRC bouncer. Description ZNC's modtcl could allow for remote code execution via a KICK. Impact A vulnerable ZNC with the modtcl module loaded could be exploited for remote code execution. Workaround Unload the modtcl module. Resolution All ZNC users should upgrade to...

liblouis: Multiple Vulnerabilities

Background liblouis is an open-source braille translator and back-translator. Description Multiple vulnerabilities have been discovered in liblouis. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is...