Fedora 37 : kernel / kernel-headers / kernel-tools (2023-f4f9182dc8)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-f4f9182dc8 advisory. The 6.1.5 stable kernel rebase contains new features, enhanced hardware support, and a number of important fixes across the tree. Tenable has...

GHSA-3H7Q-RFH9-XM4V Synapse V2 state resolution weakness allows Denial of Service (DoS)

Impact A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in how the auth chain cover index is calculated. This can induce high CPU consumption and accumulate excessive data in the database ...

CVE-2024-31208 Synapse's V2 state resolution weakness allows DoS from remote room members

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

CVE-2024-31208 Synapse's V2 state resolution weakness allows DoS from remote room members

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

CVE-2024-31208

CVE-2024-31208 affects Synapse (Matrix homeserver) before 1.105.1. A remote matrix user sharing a room with such servers can dispatch crafted events to exploit the V2 state resolution algorithm, causing high CPU usage and database bloat leading to a denial of service. Impact is limited to servers...

CVE-2024-31208

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

CVE-2024-31208 Synapse's V2 state resolution weakness allows DoS from remote room members

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

MAL-2024-1285 Malicious code in djs-embeds-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86831222f9b0a818e862c2db4a2e7f56259e7bae31f417c9464d2c19cb67dadb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in djs-embeds-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86831222f9b0a818e862c2db4a2e7f56259e7bae31f417c9464d2c19cb67dadb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-32466

Tolgee is an open-source localization platform. For the /v2/projects/translations and /v2/projects/projectId/translations endpoints, translation data was returned even when API key was missing translation.view scope. However, it was impossible to fetch the data when user was missing this scope. S...

GO-2024-2667 Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2

Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2...

CVE-2024-3765 Xiongmai AHB7804R-MH-V2 Sofia Service access control

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530R80X30-PQ8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input...

CVE-2024-3765 Xiongmai AHB7804R-MH-V2 Sofia Service access control

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530R80X30-PQ8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input...

Xiongmai AHB7804R-MH-V2 访问控制错误漏洞

The Xiongmai AHB7804R-MH-V2 is a hard disk recorder from Xiongmai Technology Xiongmai, a Chinese company. An access control error vulnerability exists in some Xiongmai products, which stems from improper access control. The following products are affected: AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL...

SUSE CVE-2024-2201

A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent FineIBT, and to leak arbitrary Linux kernel memory on Intel systems...

Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel

Cybersecurity researchers have disclosed what they say is the "first native Spectre v2 exploit" against the Linux kernel on Intel systems that could be exploited to read sensitive data from the memory. The exploit, called Native Branch History Injection BHI, can be used to leak arbitrary kernel...

CVE-2024-2201

A flaw was found in some Intel CPUs where mitigations for the Spectre V2/BHI vulnerability were incomplete. This issue may allow an attacker to read arbitrary memory, compromising system integrity and exposing sensitive information. Mitigation Mitigation for this issue is either not available or...

Linux kernel on Intel systems is susceptible to Spectre v2 attacks

Overview A new cross-privilege Spectre v2 vulnerability that impacts modern CPU architectures supporting speculative execution has been discovered. CPU hardware utilizing speculative execution that are vulnerable to Spectre v2 branch history injection BHI are likely affected. An unauthenticated...

Spectre V2 Mitigation Bypass on Linux®

AMD ID: AMD-SB-7018 Potential Impact: N/A Severity: N/A Summary An external researcher has shared a paper with AMD titled “InSpectre Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2.” AMD is not aware of any impact to AMD products. No customer action is required...

The vulnerability of the v2_pack_array_to_msg function in the libv2_sdk.so library of the DJI Mavic 3 Pro, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Enterprise, DJI Matrice 300, DJI Matrice M30, DJI Mavic Mini 3 Pro quadricopters allows a intruder to disclose protected information or execute arbitrary code.

The vulnerability of the v2packarraytomsg function in the libv2sdk.so library of the DJI Mavic 3 Pro, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Enterprise, DJI Matrice 300, DJI Matrice M30, and DJI Mavic Mini 3 Pro quadricopters is related to insufficient validation of input data. Exploiting...