MAL-2024-10605 Malicious code in @david-lab/sol-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0b5dba42ccf786e68c3da9ea3c922e86a77057afd355a7b4534b190ef156e0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: i915/perf: Fix NULL deref bugs with drm_dbg() calls

In the Linux kernel, the following vulnerability has been resolved: i915/perf: Fix NULL deref bugs with drmdbg calls When i915 perf interface is not available dereferencing it will lead to NULL dereferences. As returning -ENOTSUPP is pretty clear return when perf interface is not available...

kernel: i2c: core: Run atomic i2c xfer when !preemptible

In the Linux kernel, the following vulnerability has been resolved: i2c: core: Run atomic i2c xfer when !preemptible Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is disabled. However, non-atomic i2c transfers require preemption e.g. in waitforcompletion while waiting for the DMA...

kernel: net: esp: fix bad handling of pages from page_pool

In the Linux kernel, the following vulnerability has been resolved: net: esp: fix bad handling of pages from pagepool When the skb is reorganized during espoutput !esp-inline, the pages coming from the original skb fragments are supposed to be released back to the system through putpage. But if t...

BELL-CVE-2024-50249

Bulletin has no description...

PT-2024-19130 · Amd · Amd Ryzen Ai Software Npu Driver

Name of the Vulnerable Software and Affected Versions: AMD Ryzen AI Software NPU Driver affected versions not specified Description: The issue is related to improper input validation in the NPU driver, which could allow an attacker to supply a specially crafted pointer, potentially leading to...

PT-2024-34493 · Unknown · Netadmin Iam System

Name of the Vulnerable Software and Affected Versions: NetAdmin IAM system version 4.0.30319 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It affects the "/BalloonSave.ashx" endpoint, where a malicious payload can be injected into the Content field. Recommendations: Fo...

PT-2024-34919 · Unknown · Dang Ngoc Binh Audio Record

Name of the Vulnerable Software and Affected Versions: Dang Ngoc Binh Audio Record versions n/a through 1.0 Description: The issue allows an attacker to upload a web shell to a web server due to an unrestricted upload of file with dangerous type vulnerability. This enables remote hackers to uploa...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which stems from the presence of a dhkey that is not set to null when released...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the wdev-cqmconfig pointer not being cleared after release...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free through the ForEachModule process. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Gist - GitHub Issue - GitHub PR Credit: Ziyi Guo...

Malicious code in octopus-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4f2d9eb61053da88b3c1c9f3f9cda88f3974f897595acd8e1c42ebef0aec126 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2024-2348 hadoop-3.1 security update

Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage. Security Fixes: Apache...

DEBIAN-CVE-2024-50182

In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfdsecret if arch cannot set direct map Return -ENOSYS from memfdsecret syscall if !cansetdirectmap. This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not...

CVE-2024-50182 secretmem: disable memfd_secret() if arch cannot set direct map

In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfdsecret if arch cannot set direct map Return -ENOSYS from memfdsecret syscall if !cansetdirectmap. This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the performance monitor not being stopped properly...

WordPress Share Buttons – Social Media Plugin <= 1.0.2 is vulnerable to SQL Injection

Software Share Buttons – Social Media Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-51845 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID c8254280abdb Credits LVT-tholv2k Required privilege...

PT-2024-16661 · Amazon · Amazon Web Services

Name of the Vulnerable Software and Affected Versions: Amazon Web Services AWS affected versions not specified Description: The issue allows an authenticated data.all user to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user i...

DEBIAN-CVE-2024-50156

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Avoid NULL dereference in msmdispstateprintregs If the allocation in msmdispstatedumpregs failed then block-state can be NULL. The msmdispstateprintregs function does have code to try to handle it with: if reg dumpaddr =...

AZL-53268 CVE-2024-50156 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Avoid NULL dereference in msmdispstateprintregs If the allocation in msmdispstatedumpregs failed then block-state can be NULL. The msmdispstateprintregs function does have code to try to handle it with: if reg dumpaddr =...