Advisory ROSA-SA-2024-2341

Software: grub2 2.02 OS: ROSA Virtualization 2.1 packageevrstring: grub2-2.02-148.0.1.rv3 CVE-ID: CVE-2022-2601 BDU-ID: 2022-06819 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the grubfontconstructglyph function of the Grub2 operating systems boot loader is related to an operation exceeding...

AMD GPU Memory Leak Advisory - Lenovo Support US

No description provided...

Intel VROC Software Advisory - Lenovo Support US

No description provided...

Intel QAT Software Advisory - Lenovo Support US

No description provided...

Android OS Vulnerability - Lenovo Support US

No description provided...

Intel Ethernet Tools and Driver Install Software Advisory - Lenovo Support US

No description provided...

libdwarf:fuzz_findfuncbypc: Heap-buffer-overflow in _dwarf_internal_global_formref_b

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=5178544143532032 Project: libdwarf Fuzzing Engine: libFuzzer Fuzz Target: fuzzfindfuncbypc Job Type: libfuzzerasanlibdwarf Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

binutils:fuzz_objdump_safe: Use-of-uninitialized-value in bfd_is_section_compressed_info

Detailed Report: https://oss-fuzz.com/testcase?key=6667563805245440 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjdumpsafe Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bfdissectioncompressedinfo...

WyreStorm Apollo VX20 Account Enumeration

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WYRESTORMAPOLLOVX20ACCOUNTENUMERATIONCVE-2024-25734.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.wyrestorm.com Product APOLLO VX20 1.3.58 Vulnerability Type...

WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection

Software Brooklyn Type Theme Vulnerable versions = 4.9.7.6 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24926 Patch priority Medium CVSS severity Medium 7.5 Developer Claim ownership PSID 088c56b0b572 Credits Rafie Muhammad Patchstack Required privilege...

jq:jq_fuzz_execute: Heap-buffer-overflow in validate_relpath

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=5666078684413952 Project: jq Fuzzing Engine: afl Fuzz Target: jqfuzzexecute Job Type: aflasanjq Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x603000000351 Crash State:...

dnsmasq:fuzz_dhcp6: Index-out-of-bounds in is_same_net6

Detailed Report: https://oss-fuzz.com/testcase?key=5344349663592448 Project: dnsmasq Fuzzing Engine: libFuzzer Fuzz Target: fuzzdhcp6 Job Type: libfuzzerubsandnsmasq Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: issamenet6 dhcp6mayberelay dhcp6mayberelay Sanitizer...

WordPress AI Engine: ChatGPT Chatbot Plugin <= 2.1.4 is vulnerable to Arbitrary File Upload

Software AI Engine: ChatGPT Chatbot Type Plugin Vulnerable versions = 2.1.4 Fixed in 2.1.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-0699 Patch priority Medium CVSS severity Medium 6.6 Developer Claim ownership PSID a07cf1730f82 Credits rootxsudip Required...

WordPress WP 404 Auto Redirect to Similar Post Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software WP 404 Auto Redirect to Similar Post Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0509 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c7bee5b7cc4 Credi...

http-pattern-matcher:http_template_fuzz_test: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6624741750276096 Project: http-pattern-matcher Fuzzing Engine: libFuzzer Fuzz Target: httptemplatefuzztest Job Type: libfuzzerasanhttp-pattern-matcher Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x588ff322bd85 Crash State: NULL...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in txtin_probe_data

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5131922854445056 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x62400005df85...

mruby:mruby_fuzzer: Heap-buffer-overflow in mrb_memsearch

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4655387206811648 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6030000003ed Crash State:...

http-pattern-matcher:http_template_fuzz_test: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6624741750276096 Project: http-pattern-matcher Fuzzing Engine: libFuzzer Fuzz Target: httptemplatefuzztest Job Type: libfuzzerasanhttp-pattern-matcher Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x588ff322bd85 Crash State: NULL...

WordPress PT Sign Ups Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software PT Sign Ups Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24848 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c0bd535867dc Credits Faizal Abroni Required privilege...

GHSA-CMF4-H3XC-JW8W Grafana Cross Site Request Forgery (CSRF)

Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for Cross Site Request Forgery for Grafana. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: -...