WordPress Forminator Plugin <= 1.36.0 is vulnerable to Insecure Direct Object References (IDOR)

Software Forminator Type Plugin Vulnerable versions = 1.36.0 Fixed in 1.36.1 OWASP Top 10 A3: Injection Classification Insecure Direct Object References IDOR CVE CVE-2024-9700 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID f94c41be5520 Credits Vijaysimha Reddy vijaysimha Require...

CVE-2024-39721: Improper Resource Shutdown or Release

An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely even after the HTTP request is aborted...

PT-2024-10071

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a use after free vulnerability in the Linux kernel, specifically in the io edgeport module. This vulnerability can be exploited to impact the confidentiality,...

apache-airflow-providers-snowflake (>=2.4.0rc1, <=2.5.1), rcd-dev-kit (>=0.0.11, <=1.1.0) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.7.1)

snowflake-connector-python PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - apache-airflow-providers-snowflake =2.4.0rc1, =0.0.11, =1.1.0 Source cves: CVE-2024-49750 Source advisory:...

SUSE CVE-2022-48958

In the Linux kernel, the following vulnerability has been resolved: ethernet: aeroflex: fix potential skb leak in grethinitrings The grethinitrings function won't free the newly allocated skb when dmamappingerror returns error, so add devkfreeskb to fix it. Compile tested only...

DEBIAN-CVE-2022-48975

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochipsetupdev Here is a backtrace report about memory leak detected in gpiochipsetupdev: unreferenced object 0xffff88810b406400 size 512: comm "python3", pid 1682, jiffies 4295346908 age 24.090s...

DEBIAN-CVE-2024-49982

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 "aoe: fix the potential use-after-free problem in aoecmdcfgpkts" makes tx calling devput instead of doing in aoecmdcfgpkts. It...

CVE-2024-49878

In the Linux kernel, the following vulnerability has been resolved: resource: fix regionintersects vs addmemorydrivermanaged On a system with CXL memory, the resource tree /proc/iomem related to CXL memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff ...

CVE-2024-49982 aoe: fix the potential use-after-free problem in more places

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 "aoe: fix the potential use-after-free problem in aoecmdcfgpkts" makes tx calling devput instead of doing in aoecmdcfgpkts. It...

CVE-2024-49947

CVE-2024-49947 affects the Linux kernel net stack, specifically a vulnerability in virtio_net_hdr_to_skb() where an incorrectly set skb-&gt;csum_start could place the transport header before or after the network header when processing injected packets via af_packet. Syzbot-triggered warnings show...

CVE-2024-49947 net: test for not too small csum_start in virtio_net_hdr_to_skb()

In the Linux kernel, the following vulnerability has been resolved: net: test for not too small csumstart in virtionethdrtoskb syzbot was able to trigger this warning 1, after injecting a malicious packet through afpacket, setting skb-csumstart and thus the transport header to an incorrect value...

CVE-2024-49878 resource: fix region_intersects() vs add_memory_driver_managed()

In the Linux kernel, the following vulnerability has been resolved: resource: fix regionintersects vs addmemorydrivermanaged On a system with CXL memory, the resource tree /proc/iomem related to CXL memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff ...

DEBIAN-CVE-2024-47705

In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blkaddpartition The blkaddpartition function initially used a single if-condition ISERRpart to check for errors when adding a partition. This was modified to handle the specific...

AZL-51219 CVE-2024-47705 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blkaddpartition The blkaddpartition function initially used a single if-condition ISERRpart to check for errors when adding a partition. This was modified to handle the specific...

AZL-51150 CVE-2024-47705 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blkaddpartition The blkaddpartition function initially used a single if-condition ISERRpart to check for errors when adding a partition. This was modified to handle the specific...

PT-2024-33886

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A kernel panic can occur in the br netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br nf dev queue xmit. The issue is...

Debian dla-3926 : libperl-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3926 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3926-1 [email protected]...

PT-2024-33823

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been resolved by reverting a commit that removed unnecessary RCU-bh critical section protection. The dev queue xmit nit function is expected to be call...

CVE-2024-49298

CVE-2024-49298 is a stored cross-site scripting (XSS) vulnerability in the PeproDev Ultimate Invoice WordPress plugin (versions up to 2.0.6). The issue stems from improper neutralization of input during web page generation, enabling stored XSS. The vulnerability affects PeproDev Ultimate Invoice ...

SUSE-SU-2024:3694-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005549 fixes several issues. The following security issues were fixed: - CVE-2024-35861: Fixed potential UAF in cifssignalcifsdforreconnect bsc1225312. - CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfochangednotify bsc1225739. -...