CVE-2024-4897

The CVE-2024-4897 entry affects parisneo/lollms-webui via an insecure dependency on llama-cpp-python (llama_cpp_python-0.2.61+cpuavx2-...), with exploitation possible through the bindings_zoo feature when processing gguf model files. Connected Red Hat CVE-2024-34359 documents explain that the roo...

kernel: udf: Fix NULL pointer dereference in udf_symlink function

A vulnerability was found in the Linux kernel's UDF file system driver, where the udfsymlink function can dereference a NULL pointer. This occurs because the function uses a value returned from udftgetblk without checking if it is NULL, potentially causing system crashes if sbgetblk fails...

golang: archive/zip: Incorrect handling of certain ZIP files

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...

HDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.

...

CVE-2024-38374

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema version of the...

Johnson Controls Illustra Essentials Gen 4 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of this vulnerability may...

Johnson Controls Illustra Essentials Gen 4 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated...

kimageformats:kimgio_xcf_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6420207418015744 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioxcffuzzer Job Type: libfuzzerasankimageformats Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN...

IOAESAccelerator Component Privilege Escalation

The vulnerability of the IOAESAccelerator component in the UDF file system of the Mac OS operating system is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

Astra Linux – vulnerability in Ghostscript

Artifex Ghostscript versions prior to 10.03.1 allow memory corruption, as well as SAFER sandbox bypass, achieved through format string injection using a uniprint device...

Astra Linux – vulnerability in liblivemedia

Live555 version 1.08 fails to properly handle Matroska and Ogg files. Sending two consecutive RTSP SETUP commands for the same track results in a Use-After-Free condition and a crash of the daemon...

CVE-2024-3633

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

SUSE CVE-2024-29510

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device...

Malicious code in brakeman-translate_checkstyle_format (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in android-lint_translate_checkstyle_format (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2391 Malicious code in format-date (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

CVE-2024-4641

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service...

CVE-2024-4641 OnCell G3470A-LTE Series: Authenticated Format String Errors

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service...

CVE-2024-4641 OnCell G3470A-LTE Series: Authenticated Format String Errors

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service...

CVE-2024-4641

Summary: CVE-2024-4641 affects MOXA OnCell G3470A-LTE Series firmware v1.7.7 and earlier, due to accepting an externally supplied format string as an argument. An attacker could supply a manipulated format string to trigger a memory leak and denial of service. Affected scope: OnCell G3470A-LTE Se...