kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system...

The vulnerability of the Windows Event Logging service in operating systems allows a perpetrator to trigger a service failure.

The vulnerability of Windows Event Logging in operating systems is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by using a specially crafted system call...

PT-2024-15009 · WordPress · Infinitewp Client

Name of the Vulnerable Software and Affected Versions: InfiniteWP Client plugin for WordPress versions up to, and including, 1.12.3 Description: The issue allows unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window ...

Security Vulnerabilities fixed in Thunderbird 115.8 — Mozilla

When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website with the victim...

Medium: lua

Issue Overview: In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. CVE-2021-45985 An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. CVE-2022-33099 Affected Packages: lua...

Design/Logic Flaw

The aioaqueue function, used by the liolistio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free UAF...

CVE-2024-25941

The jail2 system call has not limited a visiblity of allocated TTYs the kern.ttys sysctl. This gives rise to an information leak about processes outside the current jail. Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by "psta...

Design/Logic Flaw

The jail2 system call has not limited a visiblity of allocated TTYs the kern.ttys sysctl. This gives rise to an information leak about processes outside the current jail. Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by "psta...

CVE-2022-23090 AIO credential reference count leak

The aioaqueue function, used by the liolistio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free UAF...

CVE-2022-23090 AIO credential reference count leak

The aioaqueue function, used by the liolistio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free UAF...

CVE-2024-25941

The CVE-2024-25941 issue affects FreeBSD jail(2): the kern.ttys visibility is not limited, enabling an information leak of TTYs from the host or other jails. Exploitation details in the FreeBSD SA-24:02.tty advisory describe the vulnerability and its impact, with attackers potentially reading how...

CVE-2024-25941 jail(2) information leak

The jail2 system call has not limited a visiblity of allocated TTYs the kern.ttys sysctl. This gives rise to an information leak about processes outside the current jail. Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by "psta...

FreeBSD : FreeBSD -- jail(2) information leak (46a29f83-cb47-11ee-b609-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 46a29f83-cb47-11ee-b609-002590c1f29c advisory. - The jail2 system call has not limited a visiblity of allocated TTYs the kern.ttys sysctl. This gives...

FreeBSD-SA-24:02.tty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:02.tty Security Advisory The FreeBSD Project Topic: jail2 information leak Category: core Module: jail Announced: 2024-02-14 Credits: Pawel Jakub Dawidek...

gRPC: file descriptor exhaustion leads to denial of service

A flaw was found in gRPC. Lack of error handling in the TCP server in Google's gRPC, starting in version 1.23 on POSIX-compatible platforms for example, Linux, allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++,...

CVE-2023-48364

A vulnerability has been identified in OpenPCS 7 V9.1 All versions V9.1 SP2 UC05, SIMATIC BATCH V9.1 All versions V9.1 SP2 UC05, SIMATIC PCS 7 V9.1 All versions V9.1 SP2 UC05, SIMATIC Route Control V9.1 All versions V9.1 SP2 UC05, SIMATIC WinCC Runtime Professional V18 All versions V18 Update 4,...

CVE-2023-48363

A vulnerability has been identified in OpenPCS 7 V9.1 All versions V9.1 SP2 UC05, SIMATIC BATCH V9.1 All versions V9.1 SP2 UC05, SIMATIC PCS 7 V9.1 All versions V9.1 SP2 UC05, SIMATIC Route Control V9.1 All versions V9.1 SP2 UC05, SIMATIC WinCC Runtime Professional V18 All versions V18 Update 4,...

PT-2024-2755 · Siemens · Simatic Route Control +5

Name of the Vulnerable Software and Affected Versions: OpenPCS 7 versions prior to V9.1 SP2 UC05 SIMATIC BATCH versions prior to V9.1 SP2 UC05 SIMATIC PCS 7 versions prior to V9.1 SP2 UC05 SIMATIC Route Control versions prior to V9.1 SP2 UC05 SIMATIC WinCC Runtime Professional version V18 through...

PT-2024-2743 · Siemens · Simatic Route Control +5

Name of the Vulnerable Software and Affected Versions: OpenPCS 7 versions prior to V9.1 SP2 UC05 SIMATIC BATCH versions prior to V9.1 SP2 UC05 SIMATIC PCS 7 versions prior to V9.1 SP2 UC05 SIMATIC Route Control versions prior to V9.1 SP2 UC05 SIMATIC WinCC Runtime Professional V18 versions prior ...

Siemens SIMATIC WinCC和Siemens SIMATIC PCS 安全漏洞

SIMATIC PCS 7 is a centralized control system DCS that integrates components such as SIMATIC WinCC, SIMATIC Batch, SIMATIC Route control, OpenPCS 7, etc. SIMATIC WinCC is a Supervisory Control and Data Acquisition SCADA system.SIMATIC WinCC Runtime Professional is a visual runtime platform for...