5462 matches found
CVE-2024-42285
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...
DEBIAN-CVE-2024-42285
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...
UBUNTU-CVE-2024-42285
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...
CVE-2024-42285 RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iwconnreqhandler associates a new struct rdmaidprivate connid with an existing struct iwcmid cmid as follows: connid-cmid.iw = cmid; cmid-context = connid; cmid-cmhandl...
CVE-2024-42285
CVE-2024-42285 affects the Linux kernel RDMA/iwcm subsystem. The issue is a use-after-free involving destroying CM IDs: a newly allocated rdma_id_private (conn_id) is linked to an existing iw_cm_id (cm_id) and used to set cm_id->context and cm_id->cm_handler, while rdma_destroy_id() frees b...
Hackers Leak 1.4 Billion Tencent User Accounts Online
Massive data leak exposes 1.4 billion Tencent user accounts. Leaked data includes emails, phone numbers, and QQ IDs…...
A refresher on Talos’ open-source tools and the importance of the open-source community
Open-source software that is free to download, deploy and modify is a vital component in the fight for cyber security. Freely available software not only helps defend systems that would otherwise be unprotected, but it also allows people to learn and develop vital cybersecurity skills. In this...
PayPal,Credit Card and Debit Card Payment SQL注入漏洞
PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe individual developer. A SQL injection vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can use this vulnerability to send a specially crafted quer...
School Attendance Monitoring System和School Event Management System 跨站脚本漏洞
School Event Management System is a school event management system and School Attendance Monitoring System is a school attendance monitoring system. A cross-site scripting vulnerability exists in School Attendance Monitoring System and School Event Management System version 1.0. An attacker can...
CVE-2024-3827
The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
CVE-2024-41926
Mattermost server (github.com/mattermost/mattermost-server) is affected by CVE-2024-41926. Versions 9.9.x up to 9.9.0 and 9.5.x up to 9.5.6 fail to validate the source of sync messages, allowing a malicious remote to set arbitrary RemoteId values for synced users and thus claim a user was synced ...
About the security content of iOS 17.6 and iPadOS 17.6
About the security content of iOS 17.6 and iPadOS 17.6 This document describes the security content of iOS 17.6 and iPadOS 17.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...
About the security content of iOS 16.7.9 and iPadOS 16.7.9
About the security content of iOS 16.7.9 and iPadOS 16.7.9 This document describes the security content of iOS 16.7.9 and iPadOS 16.7.9. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...
About the security content of tvOS 17.6
About the security content of tvOS 17.6 This document describes the security content of tvOS 17.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
About the security content of macOS Sonoma 14.6
About the security content of macOS Sonoma 14.6 This document describes the security content of macOS Sonoma 14.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...
About the security content of visionOS 1.3
About the security content of visionOS 1.3 This document describes the security content of visionOS 1.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...
Malicious code in oe-extract-ids (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 bebbe22a538c4b7b6688bd82facdd749052e801663cf523c8d9c1eb11f81ea57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2024-12316 Malicious code in oe-extract-ids (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 bebbe22a538c4b7b6688bd82facdd749052e801663cf523c8d9c1eb11f81ea57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...
