PT-2025-4804

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...

SUSE CVE-2024-56782

In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpiquirkskipserdevenumeration acpidevhidmatch does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL before calling acpidevhidmatch. At the moment...

AZL-55361 CVE-2024-56782 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpiquirkskipserdevenumeration acpidevhidmatch does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL before calling acpidevhidmatch. At the moment...

UBUNTU-CVE-2024-56782

In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpiquirkskipserdevenumeration acpidevhidmatch does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL before calling acpidevhidmatch. At the moment...

CVE-2024-56782 ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()

In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpiquirkskipserdevenumeration acpidevhidmatch does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL before calling acpidevhidmatch. At the moment...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates in the acpiquirkskipserdevenumeration function of the ACPI module, which does not perform a NULL check on th...

DEBIAN-CVE-2024-11053

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but...

CVE-2024-53245

In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard...

CVE-2024-53245

CVE-2024-53245 affects Splunk Enterprise and Splunk Cloud Platform where a low-privilege user whose username matches a role with read access to dashboards can clone a dashboard and view its name and XML. Affected versions are Splunk Enterprise < 9.3.0, < 9.2.4, and < 9.1.7, and Splunk Cl...

Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

GHSA-75C5-XW7C-P5PM PyJWT Issuer field partial matches allowed

Summary The wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". Details This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. diff - if isinstanceissuer, list: + if...

CVE-2024-53121

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, lock FTE when checking if active The referenced commits introduced a two-step process for deleting FTEs: - Lock the FTE, delete it from hardware, set the hardware deletion function to NULL and unlock the FTE. - Lock...

CVE-2024-53900

CVE-2024-53900 affects Mongoose. Before 8.8.3, it can improperly use $where in match, causing NoSQL injection with potential remote code execution (RCE). CVSS is 3.1 base 9.1 (CRITICAL). Mitigation: upgrade Mongoose to 8.8.3 or later; some sources describe continued risk due to incomplete fixes f...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

SUSE CVE-2024-52303

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each...

GHSA-27MF-GHQM-J3J8 aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

Summary A memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. Impact If the user is making use of any middlewares with aiohttp.web then it is...

DEBIAN-CVE-2024-52303

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each...

PT-2024-8691

Name of the Vulnerable Software and Affected Versions aiohttp versions 3.10.6 through 3.10.10 Description A memory leak can occur when a request produces a MatchInfoError. This issue is caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a...

kernel: mptcp: ensure snd_una is properly initialized on connect

A vulnerability was found in the Linux kernel's match component in the initialization of the snduna variable while establishing a connection. The issue arises when retransmission occurs after a fallback, leaving the snduna sequence number uninitialized, leading to unpredictable behavior and...

kernel: mptcp: ensure snd_una is properly initialized on connect

A vulnerability was found in the Linux kernel's match component in the initialization of the snduna variable while establishing a connection. The issue arises when retransmission occurs after a fallback, leaving the snduna sequence number uninitialized, leading to unpredictable behavior and...