Eclipse Mosquitto 安全漏洞

Eclipse Mosquitto is an open source messaging agent software suite from the Eclipse Foundation. A security vulnerability exists in Eclipse Mosquitto versions 1.3.2 through 2.0.18, which originates from an out-of-bounds memory access that may occur if a malicious agent sends a specially crafted...

DEBIAN-CVE-2024-48423

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library...

UBUNTU-CVE-2024-48423

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library...

NetworkManager-libreswan: Local privilege escalation via leftupdown

A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...

CVE-2024-49976 tracing/timerlat: Drop interface_lock in stop_kthread()

In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Drop interfacelock in stopkthread stopkthread is the offline callback for "trace/osnoise:online", since commit 5bfbcd1ee57b "tracing/timerlat: Add interfacelock around clearing of kthread in stopkthread", the...

CVE-2024-47702

In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/dataend/datameta syzbot reported a kernel crash due to commit 1f1e864b6555 "bpf: Handle sign-extenstin ctx member accesses". The reason is due to sign-extension of 32-bit...

CVE-2024-47747 net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition

In the Linux kernel, the following vulnerability has been resolved: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition In the ether3probe function, a timer is initialized with a callback function ether3ledoff, bound to &prevdev-timer. Once the timer is started, the...

CVE-2024-47702 bpf: Fail verification for sign-extension of packet data/data_end/data_meta

In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/dataend/datameta syzbot reported a kernel crash due to commit 1f1e864b6555 "bpf: Handle sign-extenstin ctx member accesses". The reason is due to sign-extension of 32-bit...

CVE-2024-47702 bpf: Fail verification for sign-extension of packet data/data_end/data_meta

In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign-extension of packet data/dataend/datameta syzbot reported a kernel crash due to commit 1f1e864b6555 "bpf: Handle sign-extenstin ctx member accesses". The reason is due to sign-extension of 32-bit...

PT-2024-15967 · WordPress · Rover Idx Plugin

Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to and including 3.0.0.2905 Description: The issue arises from insufficient validation and capability check on the rover idx refresh social callback function, allowing authenticated attackers with...

Exploit for CVE-2024-47176

CVE-2024-47176 Vulnerability Scanner for CUPS A simple tool t...

PrestaShop CoinGate Plugin 安全漏洞

PrestaShop CoinGate Plugin is an open source plugin for CoinGate. A security vulnerability exists in PrestaShop CoinGate Plugin 1.2.7 and earlier versions, which stems from the postProcess function in the file modules/coingate/controllers/front/callback.php that can cause business logic errors...

PT-2024-10622 · Unknown · Coingate Plugin

Name of the Vulnerable Software and Affected Versions: CoinGate Plugin versions up to 1.2.7 Description: A vulnerability was found in the CoinGate Plugin, affecting the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. This issue...

CentOS 7 : firefox (RHSA-2020:5561)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5561 advisory. - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2024-29857 DESCRIPTION: The Bouncy Castle Crypto Package For Java is vulnerable to a denial of service, caused by improper input validation. By importing an EC certificate with crafte...

PT-2024-9994 · WordPress · Time Clock +1

Name of the Vulnerable Software and Affected Versions: Time Clock plugin versions up to 1.2.2 Time Clock Pro plugin versions up to 1.1.4 Description: The issue concerns the etimeclockwp load function callback function, which is related to improper management of code generation. This allows...

PT-2024-40593 · Git +1 · Assimp

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions, including dynamic cast, HandleDynamicTypeCacheMiss, and...

The vulnerability of the iwlreq_fw_callback() function in the Intel Wireless WiFi Next Gen AGN driver for Linux operating systems allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iwlreqfwcallback function in the driver drivers/net/wireless/intel/iwlwifi/iwl-drv.c of the Intel Wireless WiFi Next Gen AGN Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2024-9289

The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwaploginrequestcallback function not properly validating a user's identity prior to authenticating them to the site. This...

CVE-2024-47178 basic-auth-connect's callback uses time unsafe string comparison

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0...