PT-2024-33817

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A kernel info leak has been resolved in the Linux kernel. The issue occurs because the xol add vma function maps an uninitialized page allocated by create xol area into userspace, making this...

PT-2024-33454 · Unknown · Jiangqie Free Mini Program

Name of the Vulnerable Software and Affected Versions: JiangQie Free Mini Program versions n/a through 2.5.2 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to significant security...

PT-2024-39760 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overa...

The vulnerability of the amdgpu_cgs_get_firmware_info() function in the Linux operating system allows a hacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the amdgpucgsgetfirmwareinfo function in the Linux operating system is related to reading memory beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected information...

PT-2024-37018

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been fixed, specifically in the octeontx2-pf component, within the otx2 dmac flt.c file. The issue involved inadequate error handling related to t...

smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()

...

PT-2024-35649

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A possible resource leak has been identified in the firmware loader of the Linux kernel, specifically in the fw log firmware info function. The alg instance should be released under the...

Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates

Cybersecurity researchers have disclosed a new malware campaign that delivers Hijack Loader artifacts that are signed with legitimate code-signing certificates. French cybersecurity company HarfangLab, which detected the activity at the start of the month, said the attack chains aim to deploy an...

CVE-2024-9952

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=systeminfo/contactinfo of the component Contact Information Page. The manipulation of the argument Address leads to cross site...

SourceCodester Online Eyewear Shop 跨站脚本漏洞

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A cross-site scripting vulnerability exists in...

PT-2024-33059

Name of the Vulnerable Software and Affected Versions Cloudlog version 2.6.15 Description The issue is related to a SQL injection vulnerability in the Oqrs.php endpoint, specifically affecting the get station info function when the station id parameter is used. This vulnerability can be exploited...

Cloudlog 安全漏洞

Cloudlog is a self-hosted PHP application by the individual developer Peter Goodhall. Allows logging of amateur radio contacts from anywhere. A security vulnerability exists in Cloudlog version 2.6.15 that stems from allowing SQL injection via the stationid parameter of Oqrs.php getstationinfo...

PT-2024-33908

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A kernel-infoleak issue has been identified in the Linux kernel, specifically in the con font get function. The font.data may not initialize all memory spaces, depending on the...

PT-2024-39824 · Tungsten Automation · Tungsten Automation Power Pdf

Name of the Vulnerable Software and Affected Versions: Tungsten Automation Power PDF affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious...

CLSA-2024-1728581726 linux-firmware: Fix of CVE-2023-31315

Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A10F12ver:0x0A101248, cpuid:0x00AA0F02ver:0x0AA00215, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A10F11ver:0x0A101148, cpuid:0x00A00F11ver:0x0A0011D5; - Update AMD CPU microcode for processor family 0x17:...

CLSA-2024-1728581276 linux-firmware: Fix of CVE-2023-31315

Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A10F12ver:0x0A101248, cpuid:0x00AA0F02ver:0x0AA00215, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A10F11ver:0x0A101148, cpuid:0x00A00F11ver:0x0A0011D5; - Update AMD CPU microcode for processor family 0x17:...

CVE-2024-47671

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb-infoleak The syzbot reported a kernel-usb-infoleak in usbtmcwrite, we need to clear the structure before filling fields...

AZL-50812 CVE-2024-47671 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb-infoleak The syzbot reported a kernel-usb-infoleak in usbtmcwrite, we need to clear the structure before filling fields...

CVE-2024-9671

A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed...

PT-2024-32533 · Unknown · Ws Form Lite

Name of the Vulnerable Software and Affected Versions: WS Form LITE versions 1.9.238 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For WS Fo...