PT-2024-35516

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer error issue has been resolved in the Linux kernel. The problem was addressed by adding an encoder check in hdcp2 get capability and intel hdcp2 get capability to prevent t...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

A flaw was found in the Linux kernel. A potential data-race in the nftexprtypeget function exists...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

A potential data-race flaw was found in nftobjtypeget in the Linux kernel. This issue can lead to a crash...

AZL-49664 CVE-2024-6874 affecting package cmake for versions less than 3.30.3-2

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

Unauthorized Access

alextselegidis/easyappointments is vulnerable to Unauthorized Access. The vulnerability is due to insufficient access controls in the GET, PUT, DELETE /providers/providerId endpoints, allowing a low privileged user to fetch, modify, or delete a privileged user's data...

PT-2024-28842 · Unknown · Stitionai/Devika

Name of the Vulnerable Software and Affected Versions: stitutionai devika version v1 Description: The issue concerns a path traversal attack through the snapshot path parameter in the "/api/get-browser-snapshot" endpoint. This allows an attacker to manipulate the snapshot path parameter, traverse...

CVE-2024-6969

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/getpatienthistory.php. The manipulation of the argument patientid leads to sql injection. The attack may be initiated...

PT-2024-8127 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A6000R version V1.0.1-B20201211.2000 Description: The issue is related to the get apcli conn info function in the TOTOLINK A6000R router's firmware, which fails to neutralize special elements used in an OS command. This can be...

VulnCheck KEV: CVE-2020-25540

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter...

PT-2024-37983 · Zhongbangkeji · Crmeb

Name of the Vulnerable Software and Affected Versions: ZhongBangKeJi CRMEB versions up to 5.4.0 Description: A critical issue was found in the function get image base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. This issue can be exploited...

CVE-2024-41281

Linksys WRT54G v4.21.5 has a stack overflow vulnerability in getmergemac function...

Linksys WRT54G 安全漏洞

The Linksys WRT54G is a router from Linksys USA. A buffer overflow vulnerability exists in the Linksys WRT54G v4.21.5, which stems from a boundary error in the getmergemac function when handling untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary code on the...

PT-2024-29346 · Linksys · Linksys Wrt54G

Name of the Vulnerable Software and Affected Versions: Linksys WRT54G version 4.21.5 Description: The issue is a stack overflow vulnerability in the get merge mac function. Recommendations: For Linksys WRT54G version 4.21.5, as a temporary workaround, consider disabling the get merge mac function...

Server-side Request Forgery (SSRF)

org.apache.streampipes: streampipes-rest is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper validation of custom endpoints during the installation process of a pipeline elements, allowing an attacker to manipulate StreamPipes into sending HTTP GET requests to...

CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process

Server-Side Request Forgery SSRF vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an...

SUSE CVE-2022-48785

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6getlladdr Some time ago 8965779d2c0e "ipv6,mcast: always hold idev-lock before mcalock" switched ipv6getlladdr to ipv6getlladdr, which is rcu-unsafe version. That was OK, because idev-lock...

XenForo 2.2.15 Cross Site Request Forgery Vulnerability

------------------------------------------------------------------------------- XenForo = 2.2.15 Widget::actionSave Cross-Site Request Forgery Vulnerability ------------------------------------------------------------------------------- - Software Link: https://xenforo.com - Affected Versions:...

DEBIAN-CVE-2022-48803

In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fix missing sentinel for clkdivtable gettablemaxdiv tries to access "clkdivtable" array out of bound defined in phy-j721e-wiz.c. Add a sentinel entry to prevent the following global-out-of-bounds error reported by enabli...

DEBIAN-CVE-2022-48785

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6getlladdr Some time ago 8965779d2c0e "ipv6,mcast: always hold idev-lock before mcalock" switched ipv6getlladdr to ipv6getlladdr, which is rcu-unsafe version. That was OK, because idev-lock...

UBUNTU-CVE-2022-48797

In the Linux kernel, the following vulnerability has been resolved: mm: don't try to NUMA-migrate COW pages that have other uses Oded Gabbay reports that enabling NUMA balancing causes corruption with his Gaudi accelerator test load: "All the details are in the bug, but the bottom line is that...