CVE-2024-34193

The connected PT-2024-25731 entry provides concrete technical details for CVE-2024-34193: in Smanga version 3.2.7, the file parameter at the PHP/get file flow.php interface is not properly filtered, enabling a path traversal vulnerability that can lead to arbitrary file reads. There is no publish...

CVE-2024-0401

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

CVE-2024-24294

A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the utils.setDeepProperty function of engine.min.js...

CVE-2024-0401

CVE-2024-0401 affects multiple ASUS routers that support custom OpenVPN profiles. An authenticated, remote attacker can execute arbitrary OS commands by uploading a crafted OVPN profile, with impact on confidentiality, integrity, and availability per the cited sources. Affected models include: AS...

CVE-2024-34947

CVE-2024-34947 concerns the IK-Q3000 router from Quanxun Huiju Network Technology (Beijing) Co.,Ltd, specifically version 3.7.10 (x64 Build202401261655). The connected documents consistently state a vulnerability to ICMP redirect attacks affecting this device/version. The Red Hat/NVD/CVE entries ...

CVE-2024-34953

An issue in taurusxin ncmdump v1.3.2 allows attackers to cause a Denial of Service DoS via memory exhaustion by supplying a crafted .ncm file...

Exploit for Improper Restriction of Excessive Authentication Attempts in Netgate Pfsense_Plus

CVE-2023-27100 - pfSense Anti-brute force protection bypass...

CVE-2024-27312

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...

CVE-2024-34953

CVE-2024-34953 affects taurusxin ncmdump v1.3.2. The issue allows an attacker to trigger a Denial of Service via memory exhaustion by processing a crafted .ncm file. Affected component is the ncmdump utility; root cause is memory exhaustion triggered by crafted input. Impact is a high-severity Do...

CVE-2024-4323

CVE-2024-4323 is a memory corruption vulnerability in Fluent Bit caused by inadequate bounds checking in the embedded HTTP server’s trace request handling. The issue allows heap buffer overflow from copying request data without proper validation, potentially leading to Denial of Service, informat...

CVE-2024-35989

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms During the removal of the idxd driver, registered offline callback is invoked as part of the clean up process. However, on systems with only one CPU online, no valid...

CVE-2024-35988

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix TASKSIZE on 64-bit NOMMU On NOMMU, userspace memory can come from anywhere in physical RAM. The current definition of TASKSIZE is wrong if any RAM exists above 4G, causing spurious failures in the userspace access...

CVE-2024-35998

The CVE-2024-35998 entry corresponds to a Linux kernel fix for a potential deadlock in CIFS (smb3) related to lock ordering in cifs_sync_mid_result. Coverity identified a thread deadlock caused by acquiring TCP_Server_Info.srv_lock while holding TCP_Server_Info.mid_lock. The connected Astra/Tence...

CVE-2024-35996

Technical details for CVE-2024-35996 are not provided in the supplied documents. The description summarizes kernel-mitigation changes, but there are no explicit affected products, versions, impacts, or fixes. Monitor vendor advisories for updates.

CVE-2024-35985

CVE-2024-35985 concerns the Linux kernel vulnerability where the eevdf scheduler could yield an out-of-bounds vlag and a NULL-deref in certain edge cases. The connected Astra/Nessus documents reiterate that reweight_eevdf() could compute vlag beyond the intended bound, since the vlag is used with...

CVE-2024-35980

The CVE-2024-35980 issue affects the Linux kernel on arm64 when KVM is involved. The root cause is a TLBI RANGE operand sorting bug: the value passed to TLBI RANGE was not correctly derived during live migration, causing incomplete TLB flushing and potential crashes on the destination VM or misse...

CVE-2024-35974

CVE-2024-35974 affects the Linux kernel block subsystem. The vulnerability arises from a q->blkg_list corruption introduced when multiple gendisk instances are allocated for a single request queue during disk rebind, allowing a blkg to linger in q->blkg_list during blkcg_init_disk() and thu...

CVE-2024-35970

The CVE-2024-35970 issue affects the Linux kernel AF_UNIX socket path. The root cause is improper handling of OOB data: when an OOB skb is dequeued, unix_sock(sk)->oob_skb is not cleared, causing incorrect uAPI state and potential deadlocks. Repro shows a socketpair exchange where MSG_OOB is u...

CVE-2024-35968

CVE-2024-35968 concerns the Linux kernel driver path in the pds_core module. The issue arises when fw_status == 0xff and the driver attempts a PCI reset via pci_reset_function() from the health thread, which can deadlock because pdsc_stop_health_thread() tries to stop/flush that thread. The publi...

CVE-2024-35966

CVE-2024-35966 (Linux kernel) : A Bluetooth RFCOMM vulnerability where rfcomm_sock_setsockopt_old() could copy data beyond the input length, due to not validating user input in setsockopt. This caused KASAN slab-out-of-bounds access in copy_from_sockptr_offset and related code paths in net/blueto...