CVE-2024-40943

CVE-2024-40943 concerns the Linux kernel ocfs2 subsystem where races between hole punching and asynchronous I/O (AIO) and direct I/O (DIO) could cause on-disk extent inconsistencies. The description and connected advisories indicate the issue is rooted in concurrency between fallocate/punch_hole ...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure of the f2fs filesystem to properly handle read-only errors on shutdown, which could result in a...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with Windows, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Secure Boot protocol for operating systems running Windows is related to errors in processing input data length parameters. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

Mozilla Firefox and Thunderbird Security Bypass Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Thunderbird is a separate email client software from Mozilla Application Suite. A security bypass vulnerability exists in Mozilla Firefox and Thunderbird, which can be exploited by an attacker to bypass...

Mozilla Firefox and Thunderbird Security Bypass Vulnerability (CNVD-2024-34596)

Mozilla Firefox is an open source web browser.Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. A security bypass vulnerability exists in Mozilla Firefox and Thunderbird, which can be exploited by an attacker to bypass security restrictions caused...

PT-2024-5093 · Ibm · Ibm Datacap Navigator

Name of the Vulnerable Software and Affected Versions: IBM Datacap Navigator versions 9.1.5 through 9.1.9 Description: The issue is related to the error reporting mechanism in IBM Datacap Navigator, which could allow a remote attacker to obtain sensitive information when a detailed technical erro...

CVE-2024-39560

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a logically adjacent downstream RSVP neighbor to cause kernel memory exhaustion, leading to a kernel crash, resulting in a Denial of Service DoS...

Updated netatalk packages fix security vulnerabilities

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibufPASSWDLEN to '\0' in FPLoginExt in login in etc/uams/uamspam.c. CVE-2024-38439 Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation...

python: Path traversal on tempfile.TemporaryDirectory

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...

The vulnerabilities of the functions cert_store_stats() and get_ca_certs() in the SSL module of the Python programming language interpreter (CPython) allow a malicious individual to gain unauthorized access to protected information.

The vulnerability of the certstorestats and getcacerts functions in the SSL module of the Python programming language interpreter CPython is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

USN-6886-1 golang-1.21, golang-1.22 vulnerabilities

It was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. This issue only affected Go 1.21 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS...

python: Path traversal on tempfile.TemporaryDirectory

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...

PT-2024-4784 · Microsoft · Windows Enroll Engine +1

Name of the Vulnerable Software and Affected Versions: Windows Enroll Engine affected versions not specified Description: The issue is related to errors in cryptographic signature verification in the Windows Enroll Engine component of Windows operating systems. This allows an attacker to bypass...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Thunderbird is a separate email client software from Mozilla Application Suite. A security bypass vulnerability exists in Mozilla Firefox and Thunderbird, which can be exploited by an attacker to bypass...

python: Path traversal on tempfile.TemporaryDirectory

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...

The vulnerability of the Orion Login.aspx page of the SolarWinds Platform’s network monitoring and IT infrastructure management software allows a perpetrator to carry out a brute-force attack.

The vulnerability of the Orion Login.aspx page of the SolarWinds IT infrastructure monitoring and management software is related to synchronization errors when using a common resource. Exploiting this vulnerability could allow a malicious actor to carry out a brute-force attack...

The vulnerability of the Firefox Focus browser on iOS operating systems allows a hacker to perform spoofing attacks.

The vulnerability of the Firefox Focus browser on iOS operating systems is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

The vulnerability of the interpreter for Ghostscript software, which handles the processing, conversion, and generation of documents, is related to errors in processing the relative path to the directory. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the interpreter used in software for processing, transforming, and generating Ghostscript documents is related to errors in processing the relative path to the directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafte...

The vulnerabilities of the Handler for User Photo Upload Command and the Handler for Picture Upload Command in the microprogrammable biometric terminals ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME allow a perpetrator to gain unauthorized access, enabling them to read, modify, or delete data.

The vulnerability of the Handler for User Photo Upload Command and Handler for Picture Upload Command components of the microprogrammed software for biometric terminals ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME is related to errors in processing the relative path to the catalog...

The vulnerability of Firefox browser for iOS, related to information representation errors in the user interface, allows a hacker to perform a spoofing attack.

The vulnerability of Firefox browser for iOS is related to information representation errors in the user interface. Exploiting this vulnerability allows an attacker to perform a spoofing attack by replacing the URL address in the location string cp...