CVE-2024-41126 Out-of-bounds read when decoding SNMP messages in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The...

CLSA-2024-1732704094 squid: Fix of CVE-2024-45802

CVE-2024-45802: disable ESI...

squid: Fix of CVE-2024-45802

CVE-2024-45802: disable ESI...

CLSA-2024-1732702350 squid: Fix of CVE-2024-45802

CVE-2024-45802: disable ESI...

CLSA-2024-1732702216 squid34: Fix of CVE-2024-45802

CVE-2024-45802: disable ESI...

squid34: Fix of CVE-2024-45802

CVE-2024-45802: disable ESI...

CLSA-2024-1732701268 Fix CVE(s): CVE-2024-45802

SECURITY UPDATE: Fix DoS by a trusted server by disable ESI - CVE-2024-45802...

CLSA-2024-1732699822 Fix CVE(s): CVE-2024-45802

SECURITY UPDATE: Fix DoS by a trusted server by disable ESI - CVE-2024-45802...

SUSE CVE-2024-52811

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

PT-2024-35797 · Unknown · Phpgurukul Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul COVID 19 Testing Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the /covid-tms/patient-search-report.php endpoint, which allows remote attackers to execute arbitrary code via the...

PT-2024-29281 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG affected versions not specified Description: An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The issue exists in the...

GHSA-7P9F-6X8J-GXXP CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

Impact Patches 1.31.1, 1.30.6, 1.29.8 Workarounds set enablecriusupport = false References Are there any links users can visit to find out more?...

PT-2024-35775 · Taiga · Taiga

Name of the Vulnerable Software and Affected Versions: Taiga version 6.8.1 Description: A CSV injection issue allows attackers to execute arbitrary code via uploading a crafted CSV file. This is achieved by loading a specifically manipulated CSV file, enabling the execution of arbitrary code...

PT-2024-9475 · Advantech · Advantech Eki-6333Ac-2G +1

Name of the Vulnerable Software and Affected Versions: Advantech EKI-6333AC-2G versions 1.6.3 and earlier Advantech EKI-6333AC-2GD versions 1.6.3 and earlier Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier Description: A vulnerability was discovered in the "edgserver" service of Advantech's...

PT-2024-35793 · Spip · Spip

Name of the Vulnerable Software and Affected Versions: SPIP version 4.3.3 Description: The issue concerns an authenticated arbitrary file upload vulnerability in the Documents module. This allows attackers to execute arbitrary code by uploading a crafted PDF file. There is no information provided...

kernel:4.18.0 security update

4.18.0-553.30.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

The vulnerability of the powerpc/64s/interrupt components in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the powerpc/64s/interrupt components in the Linux operating system’s kernel is related to errors in resource management in the exitmustharddisable function. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the downloadallsubmissions feature. This can allow for leakage of...

CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the downloadallsubmissions feature. This can allow for leakage of...

Malware Exploits Trusted Avast Anti-Rootkit Driver to Disable Security Software

Malware exploits legitimate Avast anti-rootkit driver to disable security software. Trellix researchers uncover the attack and provide mitigation steps...