WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plum: Spin Wheel & Email Pop-up versions = 2.0...

SUSE-SU-2024:2407-1 Security update for the Linux Kernel RT (Live Patch 15 for SLE 15 SP5)

This update for the Linux Kernel 5.15.21-1505001355 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-26828: Fixed underflow in parseserverinterfaces bsc1223363...

WordPress Plum: Spin Wheel & Email Pop-up Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Plum: Spin Wheel & Email Pop-up Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38744 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 688ef82694b8 Credits Ananda Dhakal Patchstack...

AZL-42835 CVE-2024-38780 affecting package kernel for versions less than 5.15.162.2-1

In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from syncprintobj Since commit a6aa8fca4d79 "dma-buf/sw-sync: Reduce irqsave/irqrestore from known context" by error replaced spinunlockirqrestore with spinunlockirq for both syncdebugfsshow and...

UBUNTU-CVE-2024-38780

In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from syncprintobj Since commit a6aa8fca4d79 "dma-buf/sw-sync: Reduce irqsave/irqrestore from known context" by error replaced spinunlockirqrestore with spinunlockirq for both syncdebugfsshow and...

SUSE CVE-2024-36919

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spinlockbh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as...

DEBIAN-CVE-2024-36919

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spinlockbh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as...

UBUNTU-CVE-2024-36919

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Remove spinlockbh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as...

CVE-2021-47271

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: Fix deadlock issue in cdnspthreadirqhandler Patch fixes the following critical issue caused by deadlock which has been detected during testing NCM class: smp: csd: Detected non-responsive CSD lock 1 on CPU0 smp: csd:...

CVE-2021-47271 usb: cdnsp: Fix deadlock issue in cdnsp_thread_irq_handler

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: Fix deadlock issue in cdnspthreadirqhandler Patch fixes the following critical issue caused by deadlock which has been detected during testing NCM class: smp: csd: Detected non-responsive CSD lock 1 on CPU0 smp: csd:...

CVE-2021-47271

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: Fix deadlock issue in cdnspthreadirqhandler Patch fixes the following critical issue caused by deadlock which has been detected during testing NCM class: smp: csd: Detected non-responsive CSD lock 1 on CPU0 smp: csd:...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from task rescheduling, where the drainworkqueue function cannot be safely called in a spin-locked environment...

SUSE CVE-2024-27402

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skbqueueempty use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skbpeek unexpectedly returning NULL or a pointer to an already dequeued socket buffer...

DEBIAN-CVE-2024-27402

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skbqueueempty use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skbpeek unexpectedly returning NULL or a pointer to an already dequeued socket buffer...

CVE-2024-27402

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skbqueueempty use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skbpeek unexpectedly returning NULL or a pointer to an already dequeued socket buffer...

UBUNTU-CVE-2024-27402

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skbqueueempty use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skbpeek unexpectedly returning NULL or a pointer to an already dequeued socket buffer...

CVE-2024-27402

CVE-2024-27402 affects the Linux kernel’s phonet/pep path. The description states a race in skb_queue_empty() is mishandled: receive queues are protected by their spin-locks, not the socket lock, which can cause skb_peek() to return NULL or a pointer to a socket buffer that has already been deque...

CVE-2024-27402 phonet/pep: fix racy skb_queue_empty() use

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skbqueueempty use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skbpeek unexpectedly returning NULL or a pointer to an already dequeued socket buffer...

leptos-spin-macro (=0.1.0), leptos_reactive (>=0.5.5 <=0.7.0-preview2) +1 more potentially affected by CVE-2024-32980 via spin-sdk (=2.2.0)

spin-sdk CARGO version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on spin-sdk and may be impacted: - leptos-spin-macro =0.1.0 - leptosreactive =0.5.5, =0.7.0-preview2 - libsql-client =0.33.3 Source cves: CVE-2024-32980 Source advisory:...

Spin applications with specific configuration vulnerable to potential network sandbox escape

Impact Some specifically configured Spin applications that use self requests without a specified URL authority can be induced to make requests to arbitrary hosts via the Host HTTP header. If an application's manifest contains a component with configuration such as toml allowedoutboundhosts =...