CVE-2024-50101

CVE-2024-50101 occurs in the Linux kernel iommu/vt-d code where domain_context_clear() incorrectly called pci_for_each_dma_alias() for non‑PCI devices, potentially causing kernel hangs. The fix adds a check to only call pci_for_each_dma_alias() for PCI devices and calls domain_context_clear_one()...

CVE-2024-50101 iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix incorrect pciforeachdmaalias for non-PCI devices Previously, the domaincontextclear function incorrectly called pciforeachdmaalias to set up context entries for non-PCI devices. This could lead to kernel hangs or...

CVE-2024-50099

The CVE-2024-50099 entry is supported by connected documents showing concrete Linux kernel details. Affected component: arm64 probes in the Linux kernel. Root cause: simulate_ldr_literal() and simulate_ldrsw_literal() relied on plain C memory accesses, which have no extable entries and can fault;...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the dm vdo module failing to clear the pointer to the dedupecontext after releasing it, which could lead to...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which originates in the sfc module, where an unconditional call to xdpdoflush in a netpoll scenario could result in a crash...

Debian dla-3946 : context - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3946 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3946-1 [email protected] https://www.debian.org/lts/security/...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which originates in the LoongArch architecture, and may cause the sleep function to be called in an inappropriate context i...

PT-2024-35548

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the drm/imagination component. The issue occurs when remaining resources are being cleaned up on driver close, and...

SUSE CVE-2024-7558

JUJUCONTEXTID is a predictable authentication secret. On a Juju machine non-Kubernetes or Juju charm container on Kubernetes, an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value. This gives the unprivileged user access to t...

SUSE CVE-2024-8037

Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJUCONTEXTID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a...

SUSE CVE-2024-48909

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of...

PT-2024-33679 · Oak · Oak

Name of the Vulnerable Software and Affected Versions: oak versions prior to 17.1.3 Description: The issue allows an attacker to bypass the default restriction on transferring hidden files using the Context.send API by encoding / as its URL encoded form %2F. This can potentially lead to reading...

IBM CICS TX Standard 安全漏洞

IBM CICS TX Standard is a comprehensive single-transaction runtime package from International Business Machines IBM that provides a cloud-native deployment model for standalone applications. A cross-site request forgery vulnerability exists in the IBM CICS TX Standard Web UI, which can be exploit...

Advanced Browser Data Extraction for Chromium and Gecko Browsers

This post-exploitation module extracts sensitive browser data from both Chromium-based and Gecko-based browsers on the target system. It supports the decryption of passwords and cookies using Windows Data Protection API DPAPI and can extract additional data such as browsing history, keyword searc...

CVE-2024-50344 I, Librarian has a Stored XSS vulnerability in Supplemental Files

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context...

The Importance of Asset Context in Attack Surface Management.

This is the last of the four blogs Help, I can’t see! A Primer for Attack Surface Management Blog Series, The Main Components of an Attack Surface Management ASM Strategy, and Understanding your Attack Surface: Different Approaches to Asset Discovery covering the foundational elements of Attack...

GHSA-7MQJ-XGF8-P59V Apache NiFi Cross-site Scripting vulnerability

Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...

CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description

Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...

CVE-2024-45477

Apache NiFi is affected by CVE-2024-45477 due to improper neutralization of input in the Parameter Context description field. The vulnerability exists in NiFi versions 1.10.0–1.27.0 and 2.0.0-M1–2.0.0-M3, where an authenticated user with permission to configure a Parameter Context can inject arbi...

CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description

Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, whic...