CVE-2024-20294

A vulnerability in the Link Layer Discovery Protocol LLDP feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of specific fields i...

The vulnerability in the full-screen mode of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows attackers to perform spear-phishing attacks.

The vulnerability in the full-screen mode of browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an incorrect limitation on the number of user interface layers or frames that can be displayed. Exploiting this vulnerability allows a malicious actor to...

Ubuntu 22.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-6653-3)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6653-3 advisory. It was discovered that a race condition existed in the ATM Asynchronous Transfer Mode subsystem of the Linux kernel, leading to a use-after-free...

The vulnerability in the implementation of the browser application interfaces of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to display an alertdialog on a different website.

The vulnerability in the implementation of the browser application interfaces of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an incorrect limitation on the number of user interface layers or frames that can be displayed. Exploiting this vulnerability allows a...

Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability

A vulnerability in the Link Layer Discovery Protocol LLDP feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of specific fields i...

The vulnerability of the `ksmbd_tcp_new_connection()` function in the `fs/smb/server/transport_tcp.c` module, which is part of the SMB (Server Message Block) networking protocol implementation in the ksmbd server kernel of the Linux operating system. This vulnerability allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ksmbdtcpnewconnection function in the fs/smb/server/transporttcp.c module, which is part of the SMB Server Message Block networking protocol implementation in the ksmbd server kernel of the Linux operating system, relates to the use of memory after it is freed. Exploiting...

PT-2024-1971

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software affected versions not specified Cisco NX-OS Software affected versions not specified Description A vulnerability in the Link Layer Discovery Protocol LLDP feature could allow an unauthenticated, adjacent attacker to cause a...

INTMAX Launches Plasma Next to Scale Ethereum with Stateless Layer

By Uzair Amir Made available under an open-source license after rigorous academic research, Plasma Next allows anyone to fork the code and launch the network. This is a post from HackRead.com Read the original post: INTMAX Launches Plasma Next to Scale Ethereum with Stateless Layer...

PT-2024-15210 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer WordPress plugin versions prior to 1.8.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, f...

UBUNTU-CVE-2021-46906

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hidsubmitctrl In hidsubmitctrl, the way of calculating the report length doesn't take into account that report-size can be zero. When running the syzkaller reproducer, a report of size 0 causes...

CVE-2024-23836 crafted traffic can cause denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extrem...

CVE-2024-23835 Suricata's pgsql: memory exhaustion use on record parsing

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory use during pgsql parsing could lead to OOM-related crashes. This vulnerability is patched in 7.0.3. As workaround, users can disable the...

[SECURITY] [DLA 3740-1] gnutls28 security update

Debian LTS Advisory DLA-3740-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin February 26, 2024 https://wiki.debian.org/LTS Package : gnutls28 Version : 3.6.7-4+deb10u12 CVE ID : CVE-2024-0553 Debian Bug : 1061046 Hubert Kario discovered that GnuTLS, a portable...

PT-2024-3054

Name of the Vulnerable Software and Affected Versions Jetty versions prior to 9.4.54 Jetty versions prior to 10.0.20 Jetty versions prior to 11.0.20 Jetty versions prior to 12.0.6 Description The issue is related to an HTTP/2 SSL connection that is established and TCP congested, which will be...

SUSE CVE-2024-26583

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread one which called recvmsg/sendmsg may exit as soon as the async crypto handler calls complete so any code past that point risks touching already freed data...

SUSE CVE-2024-26585

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler calls complete. Reorder scheduling the work before calling...

Oracle Linux 8 : kernel (ELSA-2024-12169)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12169 advisory. - drivers: net: slip: fix NPD bug in sltxtimeout CVE-2022-41858 - nfp: fix use-after-free in areacacheget CVE-2022-3545 - HID: check empty reportlist ...

Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6651-1)

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6651-1 advisory. It was discovered that a race condition existed in the ATM Asynchronous Transfer Mode subsystem of the Linux kernel, leading to a use-after-free...

DEBIAN-CVE-2024-26582

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tlsdecryptsg doesn't take a reference on the pages from clearskb, so the putpage in tlsdecryptdone releases them, and we trigger a use-after-free in processrxlist...

DEBIAN-CVE-2024-26583

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread one which called recvmsg/sendmsg may exit as soon as the async crypto handler calls complete so any code past that point risks touching already freed data...