843 matches found
PT-2024-33310 · Arm · Mbed Os
Name of the Vulnerable Software and Affected Versions: MBed OS version 6.16.0 Description: An issue was discovered in the processing of HCI packets. The software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of...
CVE-2024-48981
An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of possible lengths. The initial parsing function, hciTrSerialRxIncoming does n...
CVE-2024-48981
Summary: MBed OS 6.16.0 contains a vulnerability in HCI packet processing. The code path that determines the packet header length during HCI input (function hciTrSerialRxIncoming) does not discard packets with invalid identifiers and does not set a safe default for unknown header lengths. This ca...
CVE-2024-48985
MBed OS 6.16.0 is affected by a buffer overflow in HCI packet processing. When reading the packet length from the first two bytes, the code allocates a buffer sized to the packet body plus header; if allocation fails due to an oversized packet, there is no proper error handling and hciTrSerialRxI...
CVE-2018-9368
In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation...
CVE-2018-9368
In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation...
webkit: pointer authentication bypass
A vulnerability was found in Webkit. This flaw allows an attacker with arbitrary read and write capability to bypass pointer authentication...
CVE-2024-47013
In pmucalraehandleseqint of flexpmucalrae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-47013
In pmucalraehandleseqint of flexpmucalrae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-47013
CVE-2024-47013 is described across multiple sources as a flaw in the PMU firmware path (pmucal_rae_handle_seq_int in flexpmu_cal_rae.c) where uninitialized data allows an arbitrary write, enabling local privilege escalation with no user interaction. Documents consistently note the issue affects P...
CVE-2024-47013
In pmucalraehandleseqint of flexpmucalrae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-41721
An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution...
CVE-2024-41721 bhyve(8) out-of-bounds read access via XHCI emulation
An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution...
LLama cpp python binding < 0.2.88 Arbitrary Write Vulnerability
The version of llama.cpp installed on the remote host is prior to 0.2.88. It is, therefore, affected by an arbitrary write vulnerability. This vulnerability was combined with another arbitrary address read vulnerability to achieve RCE, demonstrating the significant impact of the vulnerability. No...
CVE-2024-42416 Multiple issues in ctl(4) CAM Target Layer
The ctlreportsupportedopcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on...
CVE-2024-42416 Multiple issues in ctl(4) CAM Target Layer
The ctlreportsupportedopcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on...
Exploit for Race Condition in Linux Linux_Kernel
CVE-2022-2590, Dirty COW restricted to shmem linux kernel ver...
GHSA-VVMV-WRVP-9GJR @jmondi/url-to-png contains a Path Traversal vulnerability
Summary When trying to add a BLOCKLIST feature when the maintainer noticed they didn't sanitize the ImageId in the code, which leads to path traversal vulnerability. Now, this is different from a traditional path traversal issue, because as of NOW you can store the image in any place arbitrarily,...
@jmondi/url-to-png contains a Path Traversal vulnerability
Summary When trying to add a BLOCKLIST feature when the maintainer noticed they didn't sanitize the ImageId in the code, which leads to path traversal vulnerability. Now, this is different from a traditional path traversal issue, because as of NOW you can store the image in any place arbitrarily,...