CVE-2022-48665

CVE-2022-48665 concerns the Linux kernel exFAT code, where using an int as the sector index can overflow on large-capacity partitions (e.g., 512-byte sectors with >2 TB). The vulnerability is described as a memory/overflow issue in exfat handling that could affect large partitions. Connected a...

CVE-2022-48658

CVE-2022-48658 affects the Linux kernel:mm/slub: flush_cpu_slab()/__free_slab() invocations were moved out of IRQ context into a global workqueue. When flush_all_cpu_locked() runs from task context, a WQ_MEM_RECLAIM-enabled workqueue may flush the global workqueue, causing a dependency issue duri...

CVE-2022-48656

CVE-2022-48656 relates to a refcount leak in Linux kernel dmaengine: ti: k3-udma-private (of_xudma_dev_get). The issue stems from a missing of_node_put() in the error/fail path, causing a reference leak. The fix moves of_node_put() before the check to ensure proper reference handling. Impact is m...

CVE-2022-48655

CVE-2022-48655 in the Linux kernel: vulnerability in the SCMI firmware path (arm_scmi) where reset domains descriptors could be accessed by index, risking out-of-bounds due to SCMI driver misbehavior. The root cause is lack of an internal consistency check before domain descriptor accesses. The f...

CVE-2022-48646

CVE-2022-48646 affects the Linux kernel; it fixes a NULL pointer dereference in sfc/siena within efx_hard_start_xmit. The patch prevents a potential NULL dereference in the network path, addressing a local-execution vulnerability. The CVSS v3.1 base score is 6.2 (MEDIUM) with LOCAL exploitability...

CVE-2022-48632

CVE-2022-48632 — The Linux kernel flaw in the i2c mlxbf driver allows a stack overflow via an unbounded memcpy loop in mlxbf_i2c_smbus_start_transaction() because the upper bound of operation->length is not checked and data_idx increments. Public docs in connected Nessus advisories reference t...

CVE-2022-48631

The CVE-2022-48631 issue affects the Linux kernel’s ext4 extents parsing. Specifically, ext4_ext_binsearch_idx() could operate on an extent header with eh_depth > 0 when eh_entries is 0, leading to garbage indices and kernel crash (BUG at fs/ext4/extents.c:2258) observed in the provided traces...

CVE-2024-25050

CVE-2024-25050 affects IBM i versions 7.2–7.5 and IBM Rational Development Studio for i versions 7.2–7.5. The root cause is an unqualified library call in the networking and compiler infrastructure, allowing a local user to execute user-controlled code with elevated (administrator) privileges. Im...

CVE-2024-33883

CVE-2024-33883 : The Node.js module ejs (Embedded JavaScript templates) , up to version before 3.1.10, lacks certain pollution protection, enabling local attackers to potentially cause a denial of service. The connected IBM/Astra Linux references confirm the same description. Reported impact: den...

CVE-2024-4252

CVE-2024-4252 concerns the Tenda i22 gateway (firmware 1.0.0.3(4687)). The issue is a stack-based buffer overflow in the function formSetUrlFilterRule caused by manipulation of the argument groupIndex. It enables remote initiation of an attack and has been classified as high severity (CVSS 3.x: A...

CVE-2024-4251

CVE-2024-4251 affects Tenda i21 1.0.0.14(4656). The flaw is in the function fromDhcpSetSer of the file /goform/DhcpSetSe, where manipulation of the arguments dhcpStartIp, dhcpEndIp, dhcpGw, dhcpMask, dhcpLeaseTime, dhcpDns1, and dhcpDns2 leads to a stack-based buffer overflow. Impact is described...

CVE-2024-25048

IBM CVE-2024-25048 affects IBM MQ Appliance 9.3 CD and LTS, where a heap-based buffer overflow results from improper bounds checking when handling malformed requests. The vulnerability can allow a remote authenticated attacker to overflow memory, potentially executing arbitrary code or causing th...

CVE-2023-1000

CVE-2023-1000 affects cyanomiko dcnnt-py up to 0.9.0, where the main function in dcnnt/plugins/notifications.py under Notification Handler permits remote command injection due to input handling weaknesses. Exploitation can be performed remotely, with impact described as command execution by an at...

CVE-2024-4246

CVE-2024-4246 affects Tenda i21 firmware 1.0.0.14(4656). The vulnerability targets the function formQosManageDouble_auto, where manipulating the ssidIndex argument causes a stack-based buffer overflow. This enables remote initiation of an attack. Documents consistently identify the affected devic...

CVE-2024-4245

CVE-2024-4245 concerns a vulnerability in Tenda i21 1.0.0.14(4656) where the function formQosManageDouble_user is affected. The issue arises from improper handling of the argument ssidIndex , which leads to a stack-based buffer overflow. The vulnerability is described as allowing remote exploitat...

CVE-2024-3034

CVE-2024-3034 affects the BackUpWordPress plugin for WordPress. It enables Directory Traversal via the hmbkp_directory_browse parameter in all versions up to 3.13. Exploitation requires administrator-level access or higher. The description and impact are stated in the provided sources; no explici...

CVE-2023-52722

CVE-2023-52722 affects Artifex Ghostscript prior to 10.03.1 where SAFER mode in psi/zmisc1.c can allow eexec seeds outside the Type 1 standard. Connected advisories confirm affected Ghostscript versions and provide remediation guidance: upgrade to Ghostscript 10.03.1 or newer (or applicable patch...

CVE-2024-4243

Summary: CVE-2024-4243 affects Tenda W9 1.0.0.7(4456) in the /goform/wifiSSIDset endpoint, specifically the formwrlSSIDset function. The vulnerability arises from sanitization/handling of the ssidIndex parameter, leading to a stack-based buffer overflow. Exploitation is possible remotely, and the...

CVE-2024-3052

CVE-2024-3052 affects SiLabs Z-Wave over IP Gateway (Z/IP Gateway). Connected sources describe a Denial of Service caused by malformed S2 Nonce Get command classes that can crash the gateway, with a hard reset required to recover. Reported vulnerable context includes SiLabs Z-Wave over IP Gateway...

CVE-2024-3051

CVE-2024-3051 affects SiLabs Z/IP Gateway (Z-Wave over IP Gateway). Concrete details in connected sources show a Denial of Service via Malformed Device Reset Locally command classes, causing the gateway to stop acknowledging frames from the end device during the outage. CNNVD notes vulnerable ver...