CVE-2024-40520

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by adminconfigmark.php directly splicing and writing the user input data into incphotowatermarkconfig.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrar...

CVE-2024-40980

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: replace spinlock by rawspinlock tracedropcommon is called with preemption disabled, and it acquires a spinlock. This is problematic for RT kernels because spinlocks are sleeping locks in this configuration, which...

CVE-2024-39499

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

CVE-2024-40980 drop_monitor: replace spin_lock by raw_spin_lock

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: replace spinlock by rawspinlock tracedropcommon is called with preemption disabled, and it acquires a spinlock. This is problematic for RT kernels because spinlocks are sleeping locks in this configuration, which...

CVE-2024-39499

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

CVE-2024-39499

CVE-2024-39499 (Linux kernel, vmci): The vulnerability allows speculative leaks via event_deliver() because user-controlled event_msg->event_data.event was used as an index without sanitization. The fix sanitizes the index to mitigate speculative information leaks. The issue is exploitable loc...

CVE-2024-39499 vmci: prevent speculation leaks by sanitizing event in event_deliver()

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

CVE-2024-39499 vmci: prevent speculation leaks by sanitizing event in event_deliver()

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

JVN#28515217: Cleartext transmission issue in TONE store App to TONE store

TONE store App provided by DREAM TRAIN INTERNET INC. contains a cleartext transmission issue to TONE store website CWE-419. Impact A man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App. Solution Update the application Update the application to...

us.bergstrominc.com Cross Site Scripting vulnerability OBB-3941397

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ProductBoard, Inc.: Insecure Invitation Link Handling

The invitation link handling process of satismeter.com was found to have a critical security vulnerability. The issue allowed unauthorized users to join an organization using invitation links sent to different email addresses, bypassing the email verification process. The vulnerability occurred...

Debian Linux SEoL (5.0.x)

According to its version, Debian Linux is 5.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

Canonical Ubuntu Linux SEoL (7.04.x)

According to its version, Canonical Ubuntu Linux is 7.04.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL...

Canonical Ubuntu Linux SEoL (14.10.x)

According to its version, Canonical Ubuntu Linux is 14.10.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL...

Apple Mac OS X SEoL (10.7.x)

According to its version, Apple Mac OS X is 10.7.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

SUSE Enterprise Linux SEoL (9.4.x)

According to its version, SUSE Enterprise Linux is 9.4.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 8090...

[SECURITY] Fedora 40 Update: cups-2.4.10-1.fc40

CUPS printing system provides a portable printing layer for UNIX=C2=AE operating systems. It has been developed by Apple Inc. to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces...

CVE-2024-5862

Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This issue affects Mia-Med Health Aplication: before 1.0.14...

CVE-2024-3264

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validation. This issue affects Mia-Med Health Aplication: before 1.0.14...

CVE-2024-3264

CVE-2024-3264 concerns Mia Technology’s Mia-Med Health Application. Multiple connected sources describe a vulnerability arising from the use of a broken or risky cryptographic algorithm that enables signature spoofing due to improper validation/authentication. The affected product is reported as ...