CVE-2024-46826 ELF: fix kernel.randomize_va_space double read

In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomizevaspace double read ELF loader uses "randomizevaspace" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly on...

CVE-2024-46826

The CVE-2024-46826 issue is a concrete Linux kernel vulnerability where the ELF loader uses kernel.randomize_va_space twice, allowing potential inconsistency of the randomization value across an exec. The root cause is a double read of the sysctl value, which can change over time, potentially cau...

CVE-2024-46826: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomizevaspace double read ELF loader uses "randomizevaspace" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly on...

PT-2024-31700 · Cursor · Cursor

Name of the Vulnerable Software and Affected Versions: Cursor versions prior to 0.41.0 Description: The issue affects Cursor, an artificial intelligence code editor, on macOS. If a user has granted Cursor access to the camera or microphone, any program run on the machine can access these devices...

PT-2024-40569

Name of the Vulnerable Software and Affected Versions: llama model loader affected versions not specified Description: The issue is related to a heap-buffer-overflow read error. Technical details indicate that the crash occurs in the gguf get tensor offset function, specifically within the llama...

PT-2024-33704

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been fixed, related to the TPM event log table, a Linux-specific construct where data produced by the GetEventLog boot service is cached in memory and...

rust-vmm linux-loader vulnerable to Out-of-bounds Read

...

CVE-2024-40657

In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Fedora: Security Advisory (FEDORA-2024-9974808629)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that stems from the addPreferencesForType method in the AccountTypePreferenceLoader.java file contains a proxy confusion with a possible way to...

@raptorjs/ng-portal (>=1.0.5, <=2.1.3), @umptor/slidedeck (2.1.1) +6 more potentially affected by CVE-2024-8373 via angular-loader (>=1.7.9, <=1.8.3)

angular-loader NPM version =1.7.9, =1.0.5, =2.0.7, =2.0.0, =2.4.0, =1.1.0, =1.8.2, =1.8.4 Source cves: CVE-2024-8373 Source advisory: MEND:CVE-2024-8373...

hslayers-ng (>=0.4.1, <=0.5.4) potentially affected by CVE-2024-8373 via angular-loader (1.4.14)

angular-loader NPM version 1.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on angular-loader and may be impacted: - hslayers-ng =0.4.1, =0.5.4 Source cves: CVE-2024-8373 Source advisory: MEND:CVE-2024-8373...

@raptorjs/ng-portal (>=1.0.5, <=2.1.3), @umptor/slidedeck (2.1.1) +6 more potentially affected by CVE-2024-8372 via angular-loader (>=1.7.9, <=1.8.3)

angular-loader NPM version =1.7.9, =1.0.5, =2.0.7, =2.0.0, =2.4.0, =1.1.0, =1.8.2, =1.8.4 Source cves: CVE-2024-8372 Source advisory: MEND:CVE-2024-8372...

hslayers-ng (>=0.4.1, <=0.5.4) potentially affected by CVE-2024-8372 via angular-loader (1.4.14)

angular-loader NPM version 1.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on angular-loader and may be impacted: - hslayers-ng =0.4.1, =0.5.4 Source cves: CVE-2024-8372 Source advisory: MEND:CVE-2024-8372...

Loki: a new private agent for the popular Mythic framework

In July 2024, we discovered the previously unknown Loki backdoor, which was used in a series of targeted attacks. By analyzing the malicious file and open sources, we determined that Loki is a private version of an agent for the open-source Mythic framework. One of the agent's decrypted strings O...

GHSA-GPRJ-6M2F-J9HX DOM clobbering could escalate to Cross-site Scripting (XSS)

Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up the value of document.currentScript.src. It is possible to "clobber" this lookup with otherwise benign HTML on the page, for example:...

PT-2024-32788

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to the firmware loader in the Linux kernel, where certain code paths construct firmware file names from string components passed through from devices or semi-privileged...

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader...

CLSA-2024-1724433427 grub2: Fix of CVE-2023-4693

CVE-2023-4693: ntfs: fix an out-of-bounds read flaw on NTFS filesystem driver...

io.americanexpress.synapse:sample-function-greeter-gcp (>=0.4.0, <=0.4.10), io.zipkin:zipkin-server (>=3.0.0, <=3.3.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.2.0, <=3.2.8)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.2.0, =0.4.0, =3.0.0, =3.2.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...