CVE-2024-25393

The RT-Thread open-source IoT real-time operating system (RTOS) is affected by a stack buffer overflow vulnerability in the net/at/src/at_server.c file. The root cause is the component's failure to properly validate the length size of input data . This flaw can be exploited by remote attackers to...

CVE-2024-25395

A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2...

CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-2214 Missing array size check in _Mtxinit() in the Xtensa port

In Eclipse ThreadX before version 6.4.0, the Mtxinit function in the Xtensa port was missing an array size check causing a memory overwrite. The affected file was ports/xtensa/xcc/src/txcliblock.c...

CVE-2024-2214: Improper Validation of Array Index

In Eclipse ThreadX before version 6.4.0, the Mtxinit function in the Xtensa port was missing an array size check causing a memory overwrite. The affected file was ports/xtensa/xcc/src/txcliblock.c...

CVE-2024-29189: Improper Neutralization of Special Elements used in an OS Command

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/productinstance.py, upon calling this method startprogram directly, users could exploit its usage to perform malicious operations on the current...

CVE-2024-29684

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component /src/dede/makehtmlhomepage.php allowing a remote attacker to execute arbitrary code...

CVE-2024-29684: Cross-Site Request Forgery (CSRF)

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component /src/dede/makehtmlhomepage.php allowing a remote attacker to execute arbitrary code...

CVE-2024-2822

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/voteedit.php. The manipulation of the argument aid leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed...

CVE-2024-2821

A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of the file /src/dede/friendlinkedit.php. The manipulation of the argument id leads to cross-site request forgery. The attack may be launched remotely. The...

CVE-2024-2820

A vulnerability classified as problematic was found in DedeCMS 5.7. Affected by this vulnerability is an unknown functionality of the file /src/dede/baidunews.php. The manipulation of the argument filename leads to cross-site request forgery. The attack can be launched remotely. The exploit has...

PT-2024-22334

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description A vulnerability was found in DedeCMS, affecting an unknown functionality of the file /src/dede/baidunews.php. The manipulation of the filename argument leads to cross-site request forgery. The attack can be...

CVE-2024-2193

A new cache speculation vulnerability, known as Spectre-SRC Speculative Race Conditions, was found in hw. Spectre-SRC is similar to the Spectre v1 and allows speculative use-after-free. The difference between this issue and Spectre V1 is that this issue is based on synchronization primitives with...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: kube-bench, src, argo-workflows, kine, spicedb, kots, amass, step-ca, ferretdb, step, k3s, trillian, temporal-server, caddy...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: argo-workflows, amass, trillian-fips, wavefront-collector-for-kubernetes, kots, kube-bench, step, caddy, argo-workflows-fips, k3s, caddy-fips, kine, step-ca, trillian, temporal-server, spicedb, ferretdb, falcosidekick-fips, kube-bench-fips, src, temporal-server-fips...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, grpcurl, hugo, configmap-reload, prometheus-beat-exporter, tigera-operator, cosign-fips, caddy, kubeflow-pipelines, flux-kustomize-controller, secrets-store-csi-driver-provider-aws, fulcio, kiam, policy-controller,...

Code injection

swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a...

CVE-2024-26337: Undefined Security Weakness

swftools v0.9.2 was discovered to contain a segmentation violation via the function sfont at swftools/src/swfc.c...

RHEL 9 : libX11 (RHSA-2024:1088)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1088 advisory. The libX11 packages contain the core X11 protocol client library. Security Fixes: libX11: InitExt.c can overwrite unintended portions of the Display...