13987 matches found
Brave Desktop 1.70.117 Security Fixes
Added simulation support for EVM transactions. - Added simulation support for Solana transactions. Upgraded Chromium to 129.0.6668.59 — refer to Google Chrome advisories for inherited CVEs...
SUSE CVE-2024-46794
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmioread The mmioread function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmioread unintentionally exposes the value of an initialized variable val on the stack...
PT-2024-31818
Name of the Vulnerable Software and Affected Versions Kastle Systems firmware prior to May 1, 2024 Description The issue concerns the storage of machine credentials in cleartext, which may allow an attacker to access sensitive information. Recommendations For Kastle Systems firmware prior to May ...
Malicious code in rnjnioep (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d4b28e75016946748cc0f573ed6ef13f6ba19871339cae87de357a7ceba6e6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-8287
CVE-2024-8287 affects Anbox Management Service (AMS) versions 1.17.0–1.23.0. AMS does not validate the TLS certificate from the Anbox Stream Agent, enabling potential MITM from within an internal network. CVSS v3.1 base score 7.5 (HIGH) across confidentiality, integrity, and availability impacts;...
CVE-2024-8287
Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this...
CVE-2024-45858
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing i...
AZL-53295 CVE-2024-46794 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmioread The mmioread function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmioread unintentionally exposes the value of an initialized variable val on the stack...
DEBIAN-CVE-2024-46794
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmioread The mmioread function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmioread unintentionally exposes the value of an initialized variable val on the stack...
DEBIAN-CVE-2024-46738
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmciresourceremove When removing a resource from vmciresourcetable in vmciresourceremove, the search is performed using the resource handle by comparing context and resource...
DEBIAN-CVE-2024-46739
In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Fix kernel NULL pointer dereference in hvuiorescind For primary VM Bus channels, primarychannel pointer is always NULL. This pointer is valid only for the secondary channels. Also, rescind callback is meant for...
UBUNTU-CVE-2024-46794
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmioread The mmioread function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmioread unintentionally exposes the value of an initialized variable val on the stack...
UBUNTU-CVE-2024-46739
In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Fix kernel NULL pointer dereference in hvuiorescind For primary VM Bus channels, primarychannel pointer is always NULL. This pointer is valid only for the secondary channels. Also, rescind callback is meant for...
CVE-2024-46790 codetag: debug: mark codetags for poisoned page as empty
In the Linux kernel, the following vulnerability has been resolved: codetag: debug: mark codetags for poisoned page as empty When PGhwpoison pages are freed they are treated differently in freepagesprepare and instead of being released they are isolated. Page allocation tag counters are decrement...
CVE-2024-8287: Improper Certificate Validation
Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this...
lexical-core has multiple soundness issues
RUSTSEC-2024-0377 contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls...
RHSA-2020:2927 Red Hat Security Advisory: OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update
Bulletin has no description...
Intel Processors security vulnerabilities
Intel Processors are American Intel Corporation's provide for interpreting computer instructions and processing data in computer software. A security vulnerability exists in Intel Processors that originates from a hardware logic error contained in the finite state machine FSM. The vulnerability...
GHSA-V6X6-4V4X-2FX9 Withdrawn Advisory: Lunary Cross-Site Request Forgery (CSRF) vulnerability
Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...