PT-2024-26566 · Xintongda · Xintongda Oa

Name of the Vulnerable Software and Affected Versions: Xintongda OA version 2023.12.30.1 Description: The issue is related to an arbitrary file upload vulnerability in the File Preview function, allowing attackers to execute arbitrary code by uploading a crafted PDF file. Recommendations: For...

ROS-20240422-10

A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection negotiation process and remove an arbitrary number of SSH service messages. during the connection negotiation process and cause an arbitrary number of SSH service...

SUSE CVE-2021-47333

In the Linux kernel, the following vulnerability has been resolved: misc: alcorpci: fix null-ptr-deref when there is no PCI bridge There is an issue with the ASPMoptional capability checking function. A device might be attached to root complex directly, in this case, bus-selfbridge will be NULL,...

pcs security update

0.10.18-2.0.1 - Replace HAM-logo.png with a generic one 0.10.18-2 - Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack Resolves: RHEL-26445, RHEL-26447, RHEL-26449 0.10.18-1 - Rebased to the latest sources see CHANGELOG.md Resolves: RHEL-7741 0.10.17-6 - Rebased to th...

systemd security update

239-82.0.1 - Fixed deletion issue for symlink when device is opened Orabug: 36228608 - Fix local-fs and remote-fs targets during system boot replaces old Orabug: 25897792 Orabug: 35871376 - 1A Add 'systemd-fstab-generator-reload-targets.service' file Orabug: 35871376 - 1B Add required rpms for...

PT-2024-27305 · WordPress · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to, and including, 2.4.43 Description: The issue is related to a missing capability check on the functions action request disable, action change template, and action request enable. This...

PT-2024-40480 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue arises from the LoginForm calling the disableSecurityToken function, which leads to a "shared host domain" vulnerability. This vulnerability is related to the way security...

xorg-x11-server: heap buffer overflow in DisableDevice

A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments...

PT-2024-25161 · Realtek Semiconductor · Realtek High Definition Audio Function Driver

Name of the Vulnerable Software and Affected Versions: Realtekr High Definition Audio Function Driver version 6.0.9549.1 Description: An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtekr High Definition Audio Function Driver allows attackers to escalate privileges and...

PT-2024-27103 · WordPress · Wp Scraper

Name of the Vulnerable Software and Affected Versions: WP Scraper plugin for WordPress versions up to, and including, 5.7 Description: The issue is related to unauthorized access due to a missing capability check on the wp scraper multi scrape action function. This allows authenticated attackers...

PT-2024-25157 · Asustek Computer · Aisuite3

Name of the Vulnerable Software and Affected Versions: AISuite3 version 3.03.36 Description: An issue in the component AslO3 64.sys allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. Recommendations: For version 3.03.36, consider disabling the...

PT-2024-25159 · Asus · Asus Atszio Driver

Name of the Vulnerable Software and Affected Versions: ASUS ATSZIO Driver version 0.2.1.7 Description: An issue in the component ATSZIO64.sys of the ASUS ATSZIO Driver allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. Recommendations: For versi...

PT-2024-7972 · Asus · Asus Gputweak Ii

Name of the Vulnerable Software and Affected Versions: ASUS GPU TweakII version 1.4.5.2 Description: The issue is related to the component IOMap64.sys of ASUS GPU TweakII, which allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. This is due to...

UBUNTU-CVE-2021-47431

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gart.bo pincount leak gmcv9,100gartdisable isn't called matched with correspoding gartenbale function in SRIOV case. This will lead to gart.bo pincount leak on driver unload...

UBUNTU-CVE-2021-47234

In the Linux kernel, the following vulnerability has been resolved: phy: phy-mtk-tphy: Fix some resource leaks in mtkphyinit Use clkdisableunprepare in the error path of mtkphyinit to fix some resource leaks...

SUSE CVE-2024-35799

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent crash when disable stream Why Disabling stream encoder invokes a function that no longer exists. How Check if the function declaration is NULL in disable stream encoder...

SUSE CVE-2024-35806

In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgrlock smpcallfunctionsingle disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgrlock elsewhere. This is already done by...

SUSE CVE-2024-35816

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: prevent leak of left-over IRQ on unbind Commit 5a95f1ded28691e6 "firewire: ohci: use devres for requested IRQ" also removed the call to freeirq in pciremove, leading to a leftover irq of devmrequestirq at...

SUSE CVE-2024-35926

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix asyncdisable descriptor leak The disableasync paths of iaacompress/decompress don't free idxd descriptors in the asyncdisable case. Currently this only happens in the testcases where req-dst is set to null. Add ...

PT-2024-3760

Name of the Vulnerable Software and Affected Versions Veeam Backup Enterprise Manager affected versions not specified Description Veeam Backup Enterprise Manager has a flaw that allows unauthenticated users to log in as any user to the enterprise manager web interface. The vulnerability resides i...