kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent

A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process...

Windows SAM secrets leak - HiveNightmare

Due to mismanagement of SAM and SYSTEM hives in Windows 10, it is possible for an unprivileged user to read those files. But, as they are locked while Windows is running we are not able to read them directly. The trick is to take advantage of Volume Shadow Copy, which is generally enabled, to...

MAT File I/O Library 缓冲区错误漏洞

The MAT File I/O Library matio is an open source, C language library for reading and writing binary MATLAB MAT files. A buffer error vulnerability exists in matio a.k.a. MAT File I O Library 1.5.20 and 1.5.21, which stems from a heap-based buffer overflow in the H5MM memcpy called from the H5MM...

Microsoft Windows 10 gives unprivileged user access to system32\config files

Overview Multiple versions of Windows 10 grant non-administrative users read access to files in the %windir%\system32\config directory. This can allow for local privilege escalation LPE. Description With multiple versions of Windows 10, the BUILTIN\Users group is given RX permissions to files in...

PT-2021-23375 · Dcmtk +5 · Dcmtk +5

Name of the Vulnerable Software and Affected Versions: DCMTK versions 3.6.6 and earlier Description: The issue is related to improper string copy handling in DCMTK. By sending specific requests to the dcmqrdb program, an attacker can cause the program to query its database and copy the result, ev...

CVE-2021-33766 ProxyToken

Microsoft Exchange Server Information Disclosure Vulnerability Recent assessments: NinjaOperator at August 30, 2021 4:59pm UTC reported: An unauthenticated actor can perform configuration actions on mailboxes belonging to arbitrary users. Which can be used to copy all emails addressed to a target...

The vulnerability of the image decoding process in QUIC systems of the Rendering of Remote Virtual Desktops SPICE software lies in the copying of buffers without checking the size of the input data. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the image decoding process in the QUIC rendering system for remote virtual desktops SPICE involves copying buffers without checking the size of the input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, a...

The vulnerability of the client-side SCP mechanism in OpenSSH, which arises due to insufficient validation of input data, allows attackers to overwrite arbitrary files in the client’s download directory.

The vulnerability of the client-side SCP component in OpenSSH exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to rewrite any files in the client’s download directory by creating a sub-directory anywhere on the remote server...

The vulnerability of the opj_dwt_calc_explicit_stepsizes() function in the OpenJPEG image encoding and decoding library lies in the lack of a mechanism to verify the size of the copied data. This allows an attacker to trigger a service failure.

The vulnerability of the opjdwtcalcexplicitstepsizes function in the OpenJPEG image encoding and decoding library is related to the lack of a mechanism for checking the size of copied data. Exploiting this vulnerability allows an attacker to trigger a service failure remotely...

The vulnerability of the `gh_finish_to_bv` function in the library, which performs security transformations using GOST algorithms, is related to insufficient data processing within the security mechanisms. This vulnerability allows attackers to gain access to confidential data.

The vulnerability of the ghfinishtobv function in the library, which performs security transformations using GOST algorithms, is related to the leakage of user passwords during the creation of a copy cx2 of the ghcontext structure. Exploiting this vulnerability allows an attacker to gain access t...

PT-2024-11317 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free vulnerability in the arch topology component of the Linux kernel. The topology scale freq tick function, which is called from scheduler tick, m...

GHSA-69V6-XC2J-R2JF Shallow copy bug in geth

Impact This is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth’s pre-compiled dataCopy at 0x00...04 contract did a shallow copy on invocation. An attacker could deploy a contract that - writes X to an EVM memory region R,...

Shallow copy bug in geth

Impact This is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth’s pre-compiled dataCopy at 0x00...04 contract did a shallow copy on invocation. An attacker could deploy a contract that - writes X to an EVM memory region R,...

WordPress Secure Copy Content Protection and Content Locking plugin <= 2.6.6 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability discovered by To Quang Duong in WordPress Secure Copy Content Protection and Content Locking plugin versions = 2.6.6. Solution Update the WordPress Secure Copy Content Protection and Content Locking plugin to the latest available version at lea...

Weidmueller Industrial WLAN 数字错误漏洞

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. A denial of service vulnerability exists in Weidmueller Industrial WLAN devices, which can be exploited by an attacker via specially crafted packets to cause an integer overflow that triggers a large memcpy...

CVE-2020-21788

In CRMEB 3.1.0+ strict domain name filtering leads to SSRFServer-Side Request Forgery. The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php...

The vulnerability of the IBM DB2 database management system lies in the lack of mechanisms to verify the size of copied data, which allows attackers to increase their privileges.

The vulnerability of the IBM DB2 database management system is related to the lack of a mechanism for checking the size of copied data. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Design/Logic Flaw

Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with Samsung Contacts privilege...

PT-2024-11232 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.13 Description: The issue is related to a null pointer dereference in the Linux kernel's bridge tunnel due to lockless access in the tunnel egress path. When a VLAN tunnel is deleted, the tunnel dst pointer...

kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c

A use-after-free flaw was found in the Linux kernel console driver when using the copy-paste buffer. This flaw allows a local user to crash the system...