CVE-2024-24157

Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting XSS via board.py...

PT-2024-20302 · Gnuboard · Gnuboard

Name of the Vulnerable Software and Affected Versions: Gnuboard g6 versions prior to the version including commit c2cc1f5069e00491ea48618d957332d90f6d40e4 Description: The issue concerns a Cross Site Scripting XSS problem. It is related to the board.py file. Recommendations: For Gnuboard g6...

Ruijie Networks RG-UAC 操作系统命令注入漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. An operating system command injection vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which...

PT-2024-31426 · Ruijie · Ruijie Rg-Uac

Name of the Vulnerable Software and Affected Versions: Ruijie RG-UAC up to 20240428 Description: A critical issue has been found in Ruijie RG-UAC, affecting an unknown functionality of the file /view/IPV6/naborTable/add commit.php. The manipulation of the ip addr/mac addr argument leads to os...

Ruijie Networks RG-UAC 安全漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. A security vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which stems from the parameter...

CVE-2022-48689

In the Linux kernel, the following vulnerability has been resolved: tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report 1 showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using...

CVE-2022-48671

CVE-2022-48671 affects the Linux kernel in the cgroup subsystem: a missing cpus_read_lock() in cgroup_attach_task_all() allowed a deadlock with threadgroup_rwsem, mitigated by adding cpus_read_lock() (aligned with cgroup_procs_write_start()). The issue was observed by syzbot at cpuset_attach() an...

CVE-2023-50230

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must...

SUSE CVE-2024-26958

In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------ cut here ------------ refcountt: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28...

CVE-2024-4128

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

CVE-2024-4128 CSRF in firebase-tools emulator suite

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

CVE-2024-4128

The CVE-2024-4128 issue affects the Firebase tools emulator suite (firebase-tools). A CSRF vulnerability exists via the export endpoint that can allow a malicious website to exfiltrate emulator data when a user with the emulator open visits the site if localhost calls are possible. Affected compo...

CVE-2024-4128 CSRF in firebase-tools emulator suite

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million

A Ukrainian national has been sentenced to more than 13 years in prison and ordered to pay $16 million in restitution for carrying out thousands of ransomware attacks and extorting victims. Yaroslav Vasinskyi aka Rabotnik, 24, along with his co-conspirators part of the REvil ransomware group...

CVE-2024-32962

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

CVE-2024-26989

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Fix level3 translation fault in swsuspsave On arm64 machines, swsuspsave faults if it attempts to access MEMBLOCKNOMAP memory ranges. This can be reproduced in QEMU using UEFI when booting with rodata=off...

CVE-2024-26962

In the Linux kernel, the following vulnerability has been resolved: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape For raid456, if reshape is still in progress, then IO across reshape position will wait for reshape to make progress. However, for dm-raid, in...

CVE-2024-27063

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...

CVE-2024-27038

In the Linux kernel, the following vulnerability has been resolved: clk: Fix clkcoreget NULL dereference It is possible for clkcoreget to dereference a NULL in the following sequence: clkcoreget ofclkgethwfromclkspec ofclkgethwfromprovider clkgethw clkgethw can return NULL which is dereferenced b...

CVE-2024-27049 wifi: mt76: mt7925e: fix use-after-free in free_irq()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in freeirq From commit a304e1b82808 "PATCH Debug shared irqs", there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For th...