CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

RockyLinux 9 : kernel (RLSA-2024:8617)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8617 advisory. hw: cpu: intel: Native Branch History Injection BHI CVE-2024-2201 kernel: tcp: add sanity checks to rx zerocopy CVE-2024-26640 kernel: mptcp: fix data...

AZL-52926 CVE-2024-50152 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2setea Clang static checkerscan-build warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfreeea; | ^ There is a double free in such case: 'ea is initializ...

UBUNTU-CVE-2024-50152

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2setea Clang static checkerscan-build warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfreeea; | ^ There is a double free in such case: 'ea is initializ...

PT-2024-33113 · Shenzhen Tuoshi Network Communications Co. · Nr500-Ea

Name of the Vulnerable Software and Affected Versions: Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLIC version 3.2.2543.12.18 Description: The issue is related to incorrect access control, allowing attackers to access the SSH protocol without authenticatio...

Tuoshi NR500-EA 安全漏洞

Tuoshi NR500-EA is a wireless router from Tuoshi, China. A security vulnerability exists in Tuoshi NR500-EA version 3.2.2543.12.18, which stems from a privilege modification vulnerability that allows an attacker to access the SSH protocol without authentication...

Tuoshi NR500-EA 安全漏洞

Tuoshi NR500-EA is a wireless router from Tuoshi China. A security vulnerability exists in Tuoshi NR500-EA version 3.2.2543.12.18, which originates from a command injection vulnerability in the component atcommand.asp...

CVE-2024-48440

The CVE-2024-48440 entry affects Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA (RG500UEAABxCOMSLICv3.2.2543.12.18) and is caused by a command injection vulnerability in the at_command.asp component. Public data lists CVSSv3.1 metrics: AV Adjacent, AC Low, PR None, UI None,...

DEBIAN-CVE-2024-49900

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of newea in eabuffer syzbot reports that lzo1x1docompress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x1docompress+0x19f9/0x2510...

AZL-51485 CVE-2024-49900 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of newea in eabuffer syzbot reports that lzo1x1docompress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x1docompress+0x19f9/0x2510...

DEBIAN-CVE-2024-45003

In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming processSee function pruneicachesb collects all reclaimable inodes and mark them with IFREEING flag at first, at that time, other processes will be...

UBUNTU-CVE-2024-45003

In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming processSee function pruneicachesb collects all reclaimable inodes and mark them with IFREEING flag at first, at that time, other processes will be...

MAL-2024-8270 Malicious code in @diotoborg/ea-sint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b95e915f94bee83c0e1641dbf02efd61167248012d21dd8ba5f690c15913a512 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8653 Malicious code in @diotoborg/temporibus-ea (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4822012ec1a833f674cfa9f32eb442ad1a087d5edf1a5b693743f06491fb2bb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/ea-consectetur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65c9696fb568aa04d4ee8f20b1815ae16b0511e7731e9744663f006eb21fde3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/placeat-ea-autem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcf0392eb6b7aaaf4beeb8fc0399b6dd4ad83eff6a98b990b17d2c31f8f41687 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-41017

In the Linux kernel, the following vulnerability has been resolved: jfs: don't walk off the end of ealist Add a check before visiting the members of ea to make sure each ea stays within the ealist...

CVE-2024-41017

A vulnerability was found in the Journaled File System JFS in the kernel code, which allows for out-of-bounds access when traversing the extended attribute list ealist. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

java-21-openjdk security update

1:21.0.4.0.7-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.4.0.7-1 - Update to jdk-21.0.4+7 GA - Update release notes to 21.0.4+7 - Switch to GA mode. - Sync the copy of the portable specfile with the latest update - Add missing section headers in NEWS - This tarball is embargoed unti...

CVE-2024-40972

In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4xattrsetentry creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking which acquires locks on othe...