PT-2024-14606 · Ngmm · Ngmm

Name of the Vulnerable Software and Affected Versions: ngmm affected versions not specified Description: The issue is related to incorrect error handling, which could lead to undefined behavior. This might result in a remote denial of service, and no additional execution privileges are needed to...

crayon: ObjectPool creates uninitialized memory when freeing objects

As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage...

GHSA-XFHW-6MC4-MGXF crayon: ObjectPool creates uninitialized memory when freeing objects

As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage...

GHSA-4V52-7Q2X-V4XJ eyre: Parts of Report are dropped as the wrong type during downcast

In affected versions, after a Report is constructed using wraperr or wraperrwith to attach a message of type D onto an error of type E, then using downcast to recover ownership of either the value of type D or the value of type E, one of two things can go wrong: - If downcasting to E, there remai...

eyre: Parts of Report are dropped as the wrong type during downcast

In affected versions, after a Report is constructed using wraperr or wraperrwith to attach a message of type D onto an error of type E, then using downcast to recover ownership of either the value of type D or the value of type E, one of two things can go wrong: - If downcasting to E, there remai...

PT-2024-9008

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.37 Description: The issue is related to the blk-iocost component in the Linux kernel, where sometimes iocg-delay is shifted right by a number that is too large, resulting in undefined behavior on some...

CVE-2024-2103

Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5...

MAL-2024-1202 Malicious code in lyft-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2fa096ec56c6910a67c11cdb8b7ebb3bede054bf1ea7eb926fff07e2265c00dc The OpenSSF Package Analysis project identified 'lyft-core' @ 999.3.9 pypi as malicious. It is considered malicious because: - The package...

CVE-2024-2103 Inclusion of Undocumented Features

Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5...

CVE-2024-2700 Quarkus-core: leak of local configuration properties into quarkus applications

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been...

CVE-2024-2700

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been...

CVE-2024-2103: Inclusion of Undocumented Features or Chicken Bits

Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transfer Relay, SEL-700G Generator Protection Relay, SEL-710-5...

CVE-2024-26742

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disablemanagedinterrupts Correct blk-mq registration issue with module parameter disablemanagedinterrupts enabled. When we turn off the default PCIIRQAFFINITY flag, the driver needs to register with blk-mq usi...

CVE-2024-26742: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disablemanagedinterrupts Correct blk-mq registration issue with module parameter disablemanagedinterrupts enabled. When we turn off the default PCIIRQAFFINITY flag, the driver needs to register with blk-mq usi...

CVE-2023-6154

A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This...

Ross Anderson

Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge. I cant remember when I first met Ross. Of course it was before 2008, when we created the Security and Human Behavior workshop. It was well before 2001, when we created the Workshop on Economics and...

Bitdefender's various products have security vulnerabilities

Bitdefender Antivirus Plus and others are products of the Romanian company Bitdefender.Bitdefender Antivirus Plus is a suite of antivirus software that offers mainly cyber threat detection and ransomware protection.Bitdefender Internet Security is a free version of antivirus software that mainly...

MAL-2024-1177 Malicious code in poptoken-builder-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e47c000bd16e968d0cf79cedeb817099f703aeaa335771981d0c5a9f43982b73 The OpenSSF Package Analysis project identified 'poptoken-builder-node' @ 99.3.0 npm as malicious. It is considered malicious because: - The...

RUSTSEC-2024-0429 Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`

The VariantStrIter::implget function called internally by implementations of the Iterator and DoubleEndedIterator traits for this type was unsound, resulting in undefined behaviour. An immutable reference &p to a mut libc::cchar pointer initialized to NULL was passed as an argument to a C functio...

Ruijie Networks RG-NBR700GW security vulnerability

Ruijie Networks RG-NBR700GW is an Internet Behavior Management router from Ruijie Networks China. A security vulnerability exists in Ruijie Networks RG-NBR700GW version 10.34b12, which stems from a lack of cookie authentication when resetting the password, resulting in an administrator password...