SUSE CVE-2024-26670

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD Currently the ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD workaround isn't quite right, as it is supposed to be applied after the last explicit memory access, but is immediately...

CVE-2024-26670

A vulnerability was found in the Linux kernel. This issue occurs due to the incorrect placement of the TLBI and DSB instructions, which are not placed after all explicit memory accesses, creating the potential for speculative unprivileged loads...

qt6-webengine -- Multiple vulnerabilities

Qt qtwebengine-chromium repo reports: Backports for 16 security bugs in Chromium: CVE-2024-2625: Object lifecycle issue in V8 CVE-2024-2626: Out of bounds read in Swiftshader CVE-2024-2885: Use after free in Dawn CVE-2024-2887: Type Confusion in WebAssembly CVE-2024-3157: Out of bounds write in...

CVE-2024-26670 arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD Currently the ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD workaround isn't quite right, as it is supposed to be applied after the last explicit memory access, but is immediately...

CVE-2024-26670 arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD Currently the ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD workaround isn't quite right, as it is supposed to be applied after the last explicit memory access, but is immediately...

CVE-2024-26670

CVE-2024-26670 : Linux kernel arm64 workaround for speculative unpriv load (Cortex-A520/A510 errata) fix. The patch ensures the TLBI+DSB sequence is executed after all explicit memory accesses and places it immediately before the ERET when pagetable isolation is disabled. It reworks the KPTI/eret...

CVE-2024-26670

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD Currently the ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD workaround isn't quite right, as it is supposed to be applied after the last explicit memory access, but is immediately...

CVE-2024-26670

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD Currently the ARM64WORKAROUNDSPECULATIVEUNPRIVLOAD workaround isn't quite right, as it is supposed to be applied after the last explicit memory access, but is immediately...

PT-2024-23724 · Beescms · Beescms

Name of the Vulnerable Software and Affected Versions: beescms version 4.0 Description: The issue allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin template.php. This is an arbitrary file write vulnerability...

PT-2024-24026 · Francoisjacquet · Rosariosis

Name of the Vulnerable Software and Affected Versions: francoisjacquet RosarioSIS version 11.5.1 Description: A disputed issue affects the Add Portal Note component, leading to cross-site scripting. The attack can be initiated remotely. The vendor notes that the PDF is opened by the browser app i...

The vulnerability of the Moby container isolation system creation software lies in the lack of proper validation for the incoming requests. This allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Moby container isolation system creation software lies in the lack of checks for the correctness of the requests received. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Xen Security Vulnerabilities

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. A security vulnerability exists in Xen 4....

GHSA-494H-9924-XWW9 Pterodactyl Wings vulnerable to improper isolation of server file access

Impact This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory sandbox root is...

Pterodactyl Wings vulnerable to improper isolation of server file access

Impact This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory sandbox root is...

CVE-2024-27102 Improper isolation of server file access in github.com/pterodactyl/wings

Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside o...

SUSE CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

Microsoft Skype Protection Mechanism Failure Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Skype. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation...

UBUNTU-CVE-2024-26620

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfioapmdevfiltermatrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filteri...

ALPINE-CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

OMRON NJ/NX series vulnerable to path traversal

Overview Machine Automation Controller NJ/NX series provided by OMRON Corporation contain a path traversal vulnerability CWE-22, CVE-2024-27121. OMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact An arbitrary file in the affected product...