CVE-2024-41255

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go...

CVE-2024-41255

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go...

PT-2024-29821

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue is related to a potential null pointer dereference in the ip6table nat table init function. This function accesses net-gen-ptrip6table nat net ops.id, but it is exposed to user space...

PT-2024-29333

Name of the Vulnerable Software and Affected Versions filestash version 0.4 Description The issue is related to filestash being configured to skip TLS certificate verification when using the FTPS protocol. This could potentially allow attackers to execute a man-in-the-middle attack via the Init...

CVE-2024-41255

The file manager filestash v0.4 (specifically the github.com/mickael-kerjean/filestash repository) is vulnerable to Improper Certificate Validation . The software is configured to skip TLS certificate verification when using the FTPS protocol because the InsecureSkipVerify flag is set to true. Th...

CVE-2024-41255

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates in the bpf module in the test case dummystops/dummyinitretvalue, where the first argument of the test1...

AZL-47112 CVE-2024-42065 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add a NULL check in xettmstolenmgrinit Add an explicit check to ensure that the mgr is not NULL...

AZL-47235 CVE-2024-42065 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add a NULL check in xettmstolenmgrinit Add an explicit check to ensure that the mgr is not NULL...

AZL-47555 CVE-2024-41096 affecting package kernel for versions less than 6.6.43.1-7

In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msicapabilityinit KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in pcienablemsirange+0x2c0/0x488 Use-after-free read at 0x0000000024629571 in kfence-12: pcienablemsirange+0x2c0/0x488...

CVE-2024-42065 drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add a NULL check in xettmstolenmgrinit Add an explicit check to ensure that the mgr is not NULL...

DEBIAN-CVE-2024-41068

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix sclpinit cleanup on failure If sclpinit fails it only partially cleans up: if there are multiple failing calls to sclpinit sclpstatechangeevent will be added several times to sclpreglist, which results in the...

UBUNTU-CVE-2024-41025

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix memory leak in audio daemon attach operation Audio PD daemon send the name as part of the init IOCTL call. This name needs to be copied to kernel for which memory is allocated. This memory is never freed which...

CVE-2024-41059 hfsplus: fix uninit-value in copy_name

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copyname syzbot reported BUG: KMSAN: uninit-value in sizedstrscpy+0xc4/0x160 sizedstrscpy+0xc4/0x160 copyname+0x2af/0x320 fs/hfsplus/xattr.c:411 hfspluslistxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the priv-pdev pointer being set after use in the fslasoccardaudmuxinit function...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2024-039 (ALASECS-2024-039)

The version of ecs-init installed on the remote host is prior to 1.84.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-039 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

PT-2024-33756

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential null pointer dereference issue was found in the dcn32 init hw function. This issue could occur when dc-clk mgr is null. The problem is addressed by adding a check to ensure...

PT-2024-33757

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential null pointer dereference issue was found in the dcn401 init hw function. This issue could occur when dc-clk mgr or dc-clk mgr-funcs is null. The fix adds a check to ensure...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-672)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-672 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADE...

Medium: ecs-init

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...