UBUNTU-CVE-2024-26933

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if...

UBUNTU-CVE-2024-27004

In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disableunused Doug reported 1 the following hung task: INFO: task swapper/0:1 blocked for more than 122 seconds. Not tainted 5.15.149-21875-gf795ebc40eb8 1 "echo 0...

UBUNTU-CVE-2024-27014

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent deadlock while disabling aRFS When disabling aRFS under the priv-statelock, any scheduled aRFS works are canceled using the cancelworksync function, which waits for the work to end if it has already started...

CVE-2024-26933

CVE-2024-26933 is described in connected advisories as a Linux kernel USB core fix: it resolves a deadlock in the port "disable" sysfs attribute handling. The show/store callbacks for the disable sysfs file in port.c acquire the hub’s device lock, while removing a hub (and potentially changing it...

CVE-2024-26933 USB: core: Fix deadlock in port "disable" sysfs attribute

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if...

PT-2024-25250

Name of the Vulnerable Software and Affected Versions phiola version 2.0-rc22 Description The issue is a Buffer-Overflow vulnerability located at pcm convert.h:513. This vulnerability allows a remote attacker to execute arbitrary code via a crafted .wav file. Recommendations For phiola version...

PT-2024-12115 · Libmodbus · Libmodbus

Name of the Vulnerable Software and Affected Versions: libmodbus version 3.1.10 Description: The issue is a heap-based buffer overflow vulnerability in the read io status function located in src/modbus.c. This vulnerability can potentially be exploited, but there is no information provided about...

PT-2024-20899 · Unknown · S3-Url-Parser

Name of the Vulnerable Software and Affected Versions: s3-url-parser version 1.0.3 Description: The issue is related to a denial of service via the regexes component. Recommendations: For s3-url-parser version 1.0.3, consider disabling the regexes component as a temporary workaround until a patch...

PT-2024-13349 · Teledyne Flir · Teledyne Flir M300

Name of the Vulnerable Software and Affected Versions: Teledyne FLIR M300 versions 2.00 through 2.00-19 Description: An issue was discovered in the web server of the affected software, allowing unauthenticated remote code execution. This can be exploited by sending a POST request to the vulnerabl...

PT-2024-25249 · Unknown · Stsaz Phiola

Name of the Vulnerable Software and Affected Versions: stsaz phiola version 2.0-rc22 Description: The issue is related to a Buffer-Overflow vulnerability at conv.c:68, which allows a remote attacker to execute arbitrary code via a crafted .wav file. Recommendations: For version 2.0-rc22, consider...

PT-2024-15246 · Webroot · Webroot Antivirus

Name of the Vulnerable Software and Affected Versions: Webroot Antivirus versions 8.0.1 through 9.0.35.12 Description: The issue allows malicious software to abuse WRSA.EXE to delete arbitrary and protected files due to a privilege escalation vulnerability. This vulnerability affects Webroot...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a security hole in the sysfs attribute of port disable...

PT-2024-24464

Name of the Vulnerable Software and Affected Versions LoMag WareHouse Management application versions 1.0.20.120 and older Description The issue allows weak passwords. By default, hard-coded passwords of 10 characters with little or no complexity are allowed. Recommendations For versions 1.0.20.1...

kernel: scsi: qedi: Fix use after free bug in qedi_remove()

A use-after-free vulnerability was found in the Linux kernel's QLogic qedi iSCSI driver. When the driver is removed via qediremove, the SCSI host structure may be freed while recoverywork or boarddisablework are still running. The work handlers then access the freed qedi-shost structure, causing ...

kernel: net/mlx5e: Move representor neigh cleanup to profile cleanup_tx

A flaw was identified in the Linux kernel’s Mellanox mlx5 Ethernet driver net/mlx5e related to the cleanup order of neighbour information when handling offloaded IP tunnel encapsulation rules in ECMP Equal-Cost Multipath mode. In certain scenarios — such as unloading the eswitch device while an...

kernel: md/raid5-cache: fix a deadlock in r5l_exit_log()

A deadlock vulnerability was found in the md RAID5 cache r5l subsystem in the Linux kernel. In r5lexitlog, flushwork is called while holding reconfigmutex, which waits for disablewritebackwork to complete. However, r5cdisablewritebackasync calls waitevent which requires conf-log to be NULL, but...

PT-2024-25115 · Thinksaas · Thinksaas

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A stored cross-site scripting XSS vulnerability in the component /pubs/counter.php allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter. This...

PT-2024-30528

Name of the Vulnerable Software and Affected Versions Adive Framework version 2.0.8 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited via the...

PT-2024-19478 · Trendnet · Trendnet Tew-815Dap

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-815DAP version 1.0.2.0 Description: The issue allows for Command Injection via the do setNTP function. An authenticated attacker with administrator privileges can exploit this over the network by sending a malicious POST request...

PT-2024-25502 · Yapi · Yapi

Name of the Vulnerable Software and Affected Versions: yapi version 1.10.2 Description: A stored cross-site scripting XSS vulnerability in the Advanced Expectation - Response module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field...