ZZCMS 代码问题漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter file in file 3/Ebbak5.1/upload/class/functions.php that can lead to unrestricted uploads...

CLSA-2024-1729627193 Fix CVE(s): CVE-2023-27043

SECURITY UPDATE: Incorrect parsing of email addresses containing special characters - debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses and parseaddr functions - CVE-2023-27043...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2024-49992

In the Linux kernel, the following vulnerability has been resolved: drm/stm: Avoid use-after-free issues with crtc and plane ltdcload calls functions drmcrtcinitwithplanes, drmuniversalplaneinit and drmencoderinit. These functions should not be called with parameters allocated with devmkzalloc to...

WordPress Rover IDX plugin <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability

Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Rover IDX versions = 3.0.0.2903...

DEBIAN-CVE-2024-49982

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 "aoe: fix the potential use-after-free problem in aoecmdcfgpkts" makes tx calling devput instead of doing in aoecmdcfgpkts. It...

AZL-51287 CVE-2024-49917 affecting package kernel for versions less than 6.6.64.2-9

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn30inithw This commit addresses a potential null pointer dereference issue in the dcn30inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

DEBIAN-CVE-2024-49916

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn401inithw This commit addresses a potential null pointer dereference issue in the dcn401inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

AZL-51186 CVE-2024-49916 affecting package kernel 6.6.126.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn401inithw This commit addresses a potential null pointer dereference issue in the dcn401inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

AZL-51141 CVE-2024-49917 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn30inithw This commit addresses a potential null pointer dereference issue in the dcn30inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

UBUNTU-CVE-2024-49916

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn401inithw This commit addresses a potential null pointer dereference issue in the dcn401inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

CVE-2024-49961 media: i2c: ar0521: Use cansleep version of gpiod_set_value()

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ar0521: Use cansleep version of gpiodsetvalue If we use GPIO reset from I2C port expander, we must use cansleep variant of GPIO functions. This was not done in ar0521poweron/ar0521poweroff functions. Let's fix that...

CVE-2024-49961 media: i2c: ar0521: Use cansleep version of gpiod_set_value()

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ar0521: Use cansleep version of gpiodsetvalue If we use GPIO reset from I2C port expander, we must use cansleep variant of GPIO functions. This was not done in ar0521poweron/ar0521poweroff functions. Let's fix that...

CVE-2024-49961 media: i2c: ar0521: Use cansleep version of gpiod_set_value()

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ar0521: Use cansleep version of gpiodsetvalue If we use GPIO reset from I2C port expander, we must use cansleep variant of GPIO functions. This was not done in ar0521poweron/ar0521poweroff functions. Let's fix that...

CVE-2024-49917 drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn30inithw This commit addresses a potential null pointer dereference issue in the dcn30inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

The vulnerability of the TMOS Shell configuration tool, which is used for managing monitors in the BIG-IP Access Policy Manager, as well as in programs like BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibility and Reporting (AVR), BIG-IP Camer-Grade NAT (CGNAT), BIG-IP DDos Hybrid Defender, BIG-IP Domain Name System, BIG-IP Edge Gateway, BIG-IP Fraud Protection Service, BIG-IP Global Traffic Manager, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Inforcement Manager, BIG-IP SSL Orchestrator, BIG-IP Webaccelerator, and BIG-IP WebSafe, allows a perpetrator to increase their privileges.

The vulnerability of the TMOS Shell configuration tool, which is used for managing monitors in the BIG-IP Access Policy Manager, as well as programs like BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP...

WordPress WP Easy Post Types plugin <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability

Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Easy Post Types versions = 1.4.4...

CVE-2024-9143 Low-level invalid GF(2^m) parameters lead to OOB memory access

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools

A flaw was found in the packageindex module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to co...

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools

A flaw was found in the packageindex module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to co...