PT-2024-22334

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description A vulnerability was found in DedeCMS, affecting an unknown functionality of the file /src/dede/baidunews.php. The manipulation of the filename argument leads to cross-site request forgery. The attack can be...

CVE-2024-2193

A new cache speculation vulnerability, known as Spectre-SRC Speculative Race Conditions, was found in hw. Spectre-SRC is similar to the Spectre v1 and allows speculative use-after-free. The difference between this issue and Spectre V1 is that this issue is based on synchronization primitives with...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: src, step-ca, spicedb, kots, kube-bench, step, temporal-server, ferretdb, trillian, argo-workflows, amass, caddy, k3s, kine...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: argo-workflows, k3s, wavefront-collector-for-kubernetes, caddy-fips, trillian, amass, trillian-fips, caddy, ferretdb, temporal-server-fips, src, step, falcosidekick-fips, kube-bench, spicedb, temporal-server, argo-workflows-fips, kots, step-ca, kube-bench-fips, kine...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, gotenberg, dex, crossplane-provider-aws-sqs, velero, minio-fips, falcosidekick, crossplane-provider-aws-dynamodb, hugo, sigstore-scaffolding, kubernetes-csi-driver-hostpath, newrelic-nri-kube-events, fulcio, litefs, frp, tflint...

Code injection

swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a...

RHEL 9 : libX11 (RHSA-2024:1088)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1088 advisory. The libX11 packages contain the core X11 protocol client library. Security Fixes: libX11: InitExt.c can overwrite unintended portions of the Display...

CVE-2024-26337: Undefined Security Weakness

swftools v0.9.2 was discovered to contain a segmentation violation via the function sfont at swftools/src/swfc.c...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: src, step-ca, spicedb, kots, kube-bench, step, temporal-server, ferretdb, trillian, argo-workflows, amass, caddy, k3s, kine...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: argo-workflows, k3s, wavefront-collector-for-kubernetes, caddy-fips, trillian, amass, trillian-fips, caddy, ferretdb, temporal-server-fips, src, step, falcosidekick-fips, kube-bench, spicedb, temporal-server, argo-workflows-fips, kots, step-ca, kube-bench-fips, kine...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: argo-workflows, k3s, wavefront-collector-for-kubernetes, caddy-fips, trillian, amass, trillian-fips, caddy, ferretdb, temporal-server-fips, src, step, falcosidekick-fips, kube-bench, spicedb, temporal-server, argo-workflows-fips, kots, step-ca, kube-bench-fips, kine...

openSUSE: Security Advisory for nodejs18 (SUSE-SU-2023:0419-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-1449: Improper Neutralization of Input During Web Page Generation

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's msslide shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'src' user supplied attributes. This make...

CVE-2024-27508

Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c...

CVE-2024-27508: Missing Release of Memory after Effective Lifetime

Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c...

PT-2024-1908

Name of the Vulnerable Software and Affected Versions Kerberos 5 aka krb5 version 1.21.2 Description The issue is related to a memory leak in the /krb5/src/kdc/ndr.c component of the Kerberos 5 implementation. This memory leak vulnerability can be exploited by a remote attacker to cause a denial ...

CVE-2024-25763

openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c...

PT-2024-21131

Name of the Vulnerable Software and Affected Versions openNDS version 10.2.0 Description The issue is related to a Use-After-Free condition via the /openNDS/src/auth.c file. Recommendations For openNDS version 10.2.0, consider disabling the authentication functionality temporarily until a patch i...

CVE-2024-21502: Use of Uninitialized Variable

Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemathmul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary free, arbitrary...

SUSE-SU-2024:0589-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2021-3638: hw/display/ati2d: Fix buffer overflow in ati2dblt bsc1188609 - CVE-2023-3180: virtio-crypto: verify src and dst buffer length for sym request bsc1213925 - CVE-2023-3354: io: remove io watch if TLS channel is closed during handshake...