Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer CVE-2022-48627 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets CVE-2023-526...

U.S. Releases High-Profile Russian Hackers in Diplomatic Prisoner Exchange

In a historic prisoner exchange between Belarus, Germany, Norway, Russia, Slovenia, and the U.S., two Russian nationals serving time for cybercrime activities have been freed and repatriated to their country. This includes Roman Valerevich Seleznev and Vladislav Klyushin, who are part of a group ...

Exploit for CVE-2000-0114

This is a collection of vulnerability templates for the Nuclei vulnerability scanner. The templates are organized by CVE ID and include information such as the vulnerability name, description, severity, and remediation steps. The templates also include HTTP requests and matchers to identify the...

SUSE CVE-2024-40913

In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anonfd until after copytouser succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but ...

SUSE CVE-2024-40950

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: fix misused mappinglargefoliosupport for anon folios When I did a large folios split test, a WARNING " 5059.122759 T166 Cannot split file folio to non-0 order" was triggered. But the test cases are only for anonmo...

DEBIAN-CVE-2024-40950

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: fix misused mappinglargefoliosupport for anon folios When I did a large folios split test, a WARNING " 5059.122759 T166 Cannot split file folio to non-0 order" was triggered. But the test cases are only for anonmo...

UBUNTU-CVE-2024-40950

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: fix misused mappinglargefoliosupport for anon folios When I did a large folios split test, a WARNING " 5059.122759 T166 Cannot split file folio to non-0 order" was triggered. But the test cases are only for anonmo...

UBUNTU-CVE-2024-40913

In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anonfd until after copytouser succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but ...

CVE-2024-40950

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: fix misused mappinglargefoliosupport for anon folios When I did a large folios split test, a WARNING " 5059.122759 T166 Cannot split file folio to non-0 order" was triggered. But the test cases are only for anonmo...

PT-2024-29168 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability has been resolved in the Linux kernel related to the mapping large folio support function, which is only reasonable for page cache folios. However, in split huge page t...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from an abuse of the mappinglargefoliosupport function in the mm:hugememory component when handling anonymous folios...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a failure of the cachefiles component to properly delay exposing anonymous file descriptors after a successful copytouser function...

MAL-2024-7549 Malicious code in sap-anonymous (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 600189eca1a3b13a8e65a6fb4815d1b5f2d34410339679f108f4981e5e84df56 The OpenSSF Package Analysis project identified 'sap-anonymous' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-anonymous (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 600189eca1a3b13a8e65a6fb4815d1b5f2d34410339679f108f4981e5e84df56 The OpenSSF Package Analysis project identified 'sap-anonymous' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets CVE-2023-52620 createemptylvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missi...

CLSA-2024-1719932549 kernel: Fix of 20 CVEs

net: iptunnel: make sure to pull inner header in iptunnelrcv CVE-2024-26882 - net: Set true network header for ECN decapsulation CVE-2024-26882 - media: dvb-core: Fix use-after-free due to race at dvbregisterdevice CVE-2022-45884 - media: dvbdev: fix error logic at dvbregisterdevice...

CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCach...

CVE-2024-38522 CSP bypass in Hush Line

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0...

CVE-2024-38521

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-38521

Vulnerability: CVE-2024-38521 affects Hush Line prior to version 0.1.0, with a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and is not sanitized on display. Root cause (from PT-2024-28049): mis-handling of user-controlled input in the Inbox leads to stored XSS....