PT-2024-31382

Name of the Vulnerable Software and Affected Versions Ruijie RG-UAC up to 20240428 Description A critical vulnerability was found in Ruijie RG-UAC, affecting an unknown functionality of the file /view/dhcp/dhcpConfig/dhcp relay commit.php. The manipulation of the interface from argument leads to ...

Ruijie Networks RG-UAC 操作系统命令注入漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. An operating system command injection vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which...

CVE-2024-34502

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will attempt to make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit...

[SECURITY] Debian 10 LTS will reach end-of-life on June 30th, 2024

Dear Debian LTS users, This is a gentle reminder that Debian 10 "buster" will reach end of support as the LTS release on June 30, 2024. Users are encouraged to upgrade to Debian 11 "bullseye". Starting in July, Debian will not provide further security updates for Debian 10. A subset of buster...

SUSE CVE-2024-26946

In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copyfromkernelnofault to read from unsafe address Read from an unsafe address with copyfromkernelnofault in archadjustkprobeaddr because this function is used before checking the address is in text or not...

D-Link DIR-X3260 安全漏洞

The D-Link DIR-X3260 is a mainstream router from D-Link that supports Wi-Fi 6. The D-Link DIR-X3260 suffers from a command injection vulnerability that stems from the SetSysEmailSettings EmailFrom command injection remote code execution vulnerability. An attacker can exploit this vulnerability to...

CVE-2024-27060 thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tbportupdatecredits Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BUG: kernel NULL pointer dereference, address: 0000000000000020 PF: supervisor read...

CVE-2024-33681: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting XSS.This issue affects Regenerate post permalink: from n/a through 1.0.3...

PT-2024-24933

Name of the Vulnerable Software and Affected Versions Llama.cpp versions prior to the version patched in commit b2740 Description The issue is related to the use of an uninitialized heap variable in the gguf init from file function. This can cause the program to crash, leading to a denial of...

SUSE CVE-2024-26926

In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in bindergetobject Commit 6d98eb95b450 "binder: avoid potential data leakage when copying txn" introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset...

PYSEC-2024-208

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the createfromblueprint builtin can result in a double eval vulnerability when rawargs=True and the args argument has side-effects. It can be seen that the buildcreateIR function of t...

CVE-2024-32647 vyper performs double eval of raw_args in create_from_blueprint

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the createfromblueprint builtin can result in a double eval vulnerability when rawargs=True and the args argument has side-effects. It can be seen that the buildcreateIR function of t...

DEBIAN-CVE-2024-26926

In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in bindergetobject Commit 6d98eb95b450 "binder: avoid potential data leakage when copying txn" introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset...

UBUNTU-CVE-2024-26926

In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in bindergetobject Commit 6d98eb95b450 "binder: avoid potential data leakage when copying txn" introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset...

PT-2024-24740 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.10 and prior Description: Using the create from blueprint builtin can result in a double eval vulnerability when raw args=True and the args argument has side-effects. The build create IR function of the create from blueprin...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper 0.3.10 and earlier versions, which stems from the use of the createfromblueprint built-in function may lead to a security issue...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the removal of an offset alignment check done by calling binderalloccopyfrombuffer - checkbuffer...

CVE-2024-32817: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.2...

UBUNTU-CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

Tenda FH1203 fromWizardHandle Method Buffer Overflow Vulnerability

Tenda FH1203 is a dual-band wireless router from Tenda China, mainly used for home network coverage. The Tenda FH1203 suffers from a buffer overflow vulnerability that stems from the PPW parameter of the fromWizardHandle method failing to properly validate the length of the input data, which can ...