kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation

A denial of service vulnerability was found in the Linux kernel. When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set, then entrySYSENTERcompat uses CLEARBRANCHHISTORY and calls the clearbhbloop before the TF flag is cleared. This causes the DB handler excdebugkernel to iss...

PT-2024-10666 · Unknown · /Proc/Driver/Wmt Dbg

Name of the Vulnerable Software and Affected Versions: /proc/driver/wmt dbg driver affected versions not specified Description: The issue concerns the /proc/driver/wmt dbg driver, where several possible out of bounds writes could lead to local escalation of privilege. System execution privileges...

PT-2024-10667 · Gt1151 · Gt1151

Name of the Vulnerable Software and Affected Versions: GT1151 affected versions not specified Description: The issue is related to a possible out of bounds write due to a missing bounds check in the gt1x debug write proc and gt1x tool write functions of the gt1x generic.c and gt1x tools.c files...

Cisco Small Business SPA300 and SPA500 Series IP Phones Local Code Execution (CVE-2014-3312)

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435...

AZL-53970 CVE-2024-53257 affecting package vitess for versions less than 19.0.4-7

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

AZL-53977 CVE-2024-53257 affecting package vitess for versions less than 17.0.7-7

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

Vitess 安全漏洞

Vitess is a database clustering system for horizontally scaling MySQL from the Vitess open source. A security vulnerability exists in Vitess that stems from the /debug/querylogz and /debug/env pages of vtgate and vttablet not properly escaping user input...

The vulnerability of the Intel Server Debug and Provisioning Tool (Intel SDP) in managing and operating server infrastructure affects Windows operating systems. This vulnerability stems from insufficient access control mechanisms, allowing attackers to increase their privileges.

The vulnerability of the Intel Server Debug and Provisioning Tool Intel SDP for operating systems running on Windows relates to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...

openSUSE Security Advisory (SUSE-SU-2024:4088-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:4106-1 Security update for tomcat

This update for tomcat fixes the following issues: - Update to Tomcat 9.0.97 Fixed CVEs: + CVE-2024-52316: If the Jakarta Authentication fails with an exception, set a 500 status bsc1233434 Catalina + Add: Add support for the new Servlet API method HttpServletResponse.sendEarlyHints. markt + Add:...

CVE-2016-10394

Initial xblsec revision does not have all the debug policy features and critical checks...

CVE-2016-10394 Improper Authentication in Core

Initial xblsec revision does not have all the debug policy features and critical checks...

PT-2024-10569 · Xbl Sec · Xbl Sec

Name of the Vulnerable Software and Affected Versions: xbl sec affected versions not specified Description: The initial revision of xbl sec lacks certain debug policy features and critical checks. Recommendations: At the moment, there is no information about a newer version that contains a fix fo...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: jfs: xattr: fixed buffer overflow for invalid xattr values. When the xattr size is not as expected, it is printed out to the kernel log in hexadecimal format as a form of debugging. However, when that xattr size is larger than...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the bpf code, the splat operation in skbpullreason can cause an issue. The syzkaller build with CONFIGDEBUGNET=y frequently triggers a debug hint in skbmaypull. We would like to keep this debug check because it might indicate...

CVE-2024-50267

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: fix use after free in debug printk The "devdbg&urb-;dev-dev, ..." which happens after usbfreeurburb is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid...

CVE-2024-50234

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn't being cleared out before interrupts are enabled. We end u...

CVE-2024-52067

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...

CVE-2022-43937

Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a...

CVE-2024-52067 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...