UBUNTU-CVE-2021-47123

In the Linux kernel, the following vulnerability has been resolved: iouring: fix ltout double free on completion race Always remove linked timeout on iolinktimeoutfn from the master request link list, otherwise we may get use-after-free when first iolinktimeoutfn puts linked timeout in the fail...

CVE-2021-47123 io_uring: fix ltout double free on completion race

In the Linux kernel, the following vulnerability has been resolved: iouring: fix ltout double free on completion race Always remove linked timeout on iolinktimeoutfn from the master request link list, otherwise we may get use-after-free when first iolinktimeoutfn puts linked timeout in the fail...

CVE-2024-26178

creationtimestamp| type| source ---|---|--- 2024-03-12 20:21:49+00:00| seen| https://t.me/ctinow/206086 2024-04-18 16:45:00+00:00| seen| https://googleprojectzero.blogspot.com/2024/04/the-windows-registry-adventure-1.html 2024-12-19 18:03:00+00:00| seen|...

BIT-GOLANG-2020-28366 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file...

RHEL 8 : kernel (RHSA-2024:1188)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1188 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: out-of-bounds write in...

CVE-2021-46976

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix crash in autoretire The retire logic uses the 2 lower bits of the pointer to the retire function to store flags. However, the autoretire function is not guaranteed to be aligned to a multiple of 4, which causes...

CVE-2021-46976 drm/i915: Fix crash in auto_retire

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix crash in autoretire The retire logic uses the 2 lower bits of the pointer to the retire function to store flags. However, the autoretire function is not guaranteed to be aligned to a multiple of 4, which causes...

CVE-2023-52435 net: prevent mss overflow in skb_segment()

In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skbsegment Once again syzbot is able to crash the kernel in skbsegment 1 GSOBYFRAGS is a forbidden value, but unfortunately the following computation in skbsegment can reach it quite easily : mss = ms...

Alert: CISA Warns of Active 'Roundcube' Email Attacks - Patch Now

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a medium-severity security flaw impacting Roundcube email software to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The issue, tracked as CVE-2023-43770 CVSS score: 6.1,...

Malicious code in en-task-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 430b6af14481f12dfa919057a897496d1f551a6e0a10bb136d228753517161b8 The OpenSSF Package Analysis project identified 'en-task-helpers' @ 1.29.20 npm as malicious. It is considered malicious because: - The package...

Liferay Portal vulnerable to user impersonation

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the doAsUserId URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user...

Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social networking, etc. Liferay D...

PT-2024-8424 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a race condition error in the HDMA controller register. The Linked list element and pointer are not stored in the same memory as the HDMA controller register. I...

China-Linked Hackers Target Myanmar's Top Ministries with Backdoor Blitz

The China-based threat actor known as Mustang Panda is suspected to have targeted Myanmar's Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans. The findings come from CSIRT-CTI, which said the activities took place in November...

PT-2024-21878

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition error can occur in the Linux kernel due to the Linked list element and pointer not being stored in the same memory as the eDMA controller register. If the doorbell...

Malicious code in orchidnet-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0dd6961cefb46152dbb4b21adeb369408e08c40551592284dd3789c650000d08 The OpenSSF Package Analysis project identified 'orchidnet-web' @ 9.1.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in storefront_h5_sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f7c0d65d6fdf4ca9a7677bce242a39f89c488703b532de05acb574c7baa799e3 The OpenSSF Package Analysis project identified 'storefronth5sdk' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

CVE-2024-21669

Hyperledger Aries Cloud Agent Python ACA-Py is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation...

Format string

Hyperledger Aries Cloud Agent Python ACA-Py is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation...

CVE-2024-21669

Hyperledger Aries Cloud Agent Python (ACA-Py) contains CVE-2024-21669: when verifying W3C JSON-LD Verifiable Credentials with Linked Data Proofs (LDP-VCs), the result of validating document.proof is not factored into the final presentation verification. This allows holders to present incorrectly ...