GHSA-HG58-RF2H-6RR7 CometBFT is unstability during blocksync when syncing from malicious peer

Name: ASA-2024-008: Instability during blocksync when syncing from malicious peer Component: CometBFT Criticality: Medium ACMv1: I:Moderate; L: Possible Affected versions: v0.38.7 Summary An issue was identified for nodes syncing on an existing network during blocksync in which a malicious peer...

EnvisionWare Computer Access & Reservation Control SelfCheck Security Vulnerability

EnvisionWare Computer Access & Reservation Control SelfCheck is a computer access and reservation control solution from EnvisionWare, Inc. A security vulnerability exists in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 that originates from allowing an unauthenticated attacker...

PT-2024-37264 · Deep Sea Electronics · Dse855

Name of the Vulnerable Software and Affected Versions: Deep Sea Electronics DSE855 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. The flaw exists within the...

OESA-2024-1704 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22;...

SUSE CVE-2024-36883

In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in opsinit netallocgeneric is called by netalloc, which is called without any locking. It reads maxgenptrs, which is changed under pernetopsrwsem. It is read twice, first to allocate an array, then t...

CVE-2024-29830

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code...

CVE-2024-29846

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code...

CVE-2024-29824

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Recent assessments: cdelafuente-r7 at July 23, 2024 8:10am UTC reported: Ivanti Endpoint Manager EPM versions 2022 SU5 a...

CVE-2023-52880

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: require CAPNETADMIN to attach NGSM0710 ldisc Any unprivileged user can attach NGSM0710 ldisc, but it requires CAPNETADMIN to create a GSM network anyway. Require initial namespace CAPNETADMIN to do that...

CVE-2024-5295

D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2021-47438

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix memory leak in mlx5coredestroycq error path Prior to this patch in case mlx5coredestroycq failed it returns without completing all destroy operations and that leads to memory leak. Instead, complete the destroy flo...

TOTOLINK CP450 Stack Buffer Overflow Vulnerability

TOTOLINK CP450 is an outdoor wireless client terminal device manufactured by China Gion Electronics, mainly used for wireless broadband access service in rural and remote areas. The TOTOLINK CP450 suffers from a stack buffer overflow vulnerability that originates from the setLanguageCfg method...

CVE-2024-27130 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build...

CVE-2024-27128

CVE-2024-27128 affects QNAP QTS and QuTS hero. A buffer copy without input size checking could allow authenticated network-based code execution. Affected versions are QTS 5.1.x and QuTS hero h5.1.x, with fixes in QTS 5.1.7.2770 build 20240520 and later and QuTS hero h5.1.7.2770 build 20240520 and...

CVE-2023-52741

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata-readintopages When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpagesfillpages+0x14c/0x7e0 Call Trace:...

CVE-2021-47238

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix memory leak in ipmcadd1src BUG: memory leak unreferenced object 0xffff888101bc4c00 size 32: comm "syz-executor527", pid 360, jiffies 4294807421 age 19.329s hex dump first 32 bytes: 00 00 00 00 00 00 00 00 00 00 00 ...

CVE-2024-34947

Quanxun Huiju Network Technology Beijing Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack...

CVE-2024-34947

Quanxun Huiju Network Technology Beijing Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack...

Low: java-11-openjdk

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10,...

Oracle Linux 9 : buildah (ELSA-2024-2245)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2245 advisory. - Rebuild for CVEs: CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 - rebuild for following CVEs: CVE-2023-25173 CVE-2022-41724...