CVE-2024-28787

IBM Security Verify Access and IBM Application Gateway are affected by CVE-2024-28787, with Information Disclosure and potential Denial of Service via a specially crafted HTTP request. Affected products/versions: IBM Security Verify Access Container and Appliance 10.0.0–10.0.7, IBM Application Ga...

CVE-2024-27268

CVE-2024-27268 affects IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4. The vulnerability allows a remote attacker to trigger a denial of service by sending a specially crafted request, causing the server to consume memory resources. NVD metrics list a CVSS v3.1 base score of 7...

CVE-2024-30266

CVE-2024-30266 affects the Wasmtime WebAssembly runtime. The 19.0.0 release contained a regression that can cause a guest WebAssembly module to panic the host runtime when executed, potentially impacting host stability. The issue is addressed in Wasmtime 19.0.1. Multiple sources (NVD/NIST entry, ...

CVE-2024-30250

Astro-Shield (KindSpells) vulnerability CVE-2024-30250 affects versions 1.2.0–1.3.1, where injecting a correct SRI attribute into code causes the injected resource to be considered legitimate by CSP, enabling bypass of cross-origin allow-lists. Root cause: the SRI hash is added to the CSP header,...

CVE-2024-29182

CVE-2024-29182 affects Collabora Online (LibreOffice-based online suite). The vulnerability is a stored cross-site scripting flaw where an attacker can embed an XSS payload in document text referenced by a field; when a user hovers the text to display a tooltip, the payload could execute in the u...

CVE-2024-28871

LibHTP vulnerability CVE-2024-28871 affects LibHTP 0.5.46, which may parse malformed HTTP traffic causing high CPU. A patch is in 0.5.47. Public details indicate a DoS impact; no workarounds are listed in the provided documents. Ubuntu/Red Hat advisories corroborate the patch and impact.

CVE-2024-28182

CVE-2024-28182 affects nghttp2

CVE-2024-3250

CVE-2024-3250 affects Canonical’s Pebble service manager. The issue arises from the read-file API used by the pebble pull command, which, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble ran as root. This could enable access to sensitive ...

CVE-2024-22189

The CVE concerns quic-go prior to v0.42.0 where an attacker can cause memory exhaustion on the peer by flooding with NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is expected to reply with RETIRE_CONNECTION_ID frames for each retirement; an attacker can prevent most of the...

CVE-2024-31080

CVE-2024-31080 affects the X.Org X11 server’s ProcXIGetSelectedEvents() (and related ProcXIPassiveGrabDevice/ProcRenderAddGlyphs functions per advisories). A heap-based buffer over-read occurs when byte-swapped length values are used in replies, potentially leaking heap memory and causing segment...

CVE-2024-2759

The CVE-2024-2759 entry concerns the Apaczka plugin for PrestaShop (versions 1–4). The vulnerability is an improper access control that allows information gathering from saved templates without authentication. Affected component: Apaczka plugin for PrestaShop; root cause: access control flaw; imp...

CVE-2024-26809

The CVE-2024-26809 vulnerability is in the Linux kernel's netfilter nft_set_pipapo code. The clone path previously could destroy elements using a stale view of the lookup table, risking double-destroy of elements; the fix ensures clone uses a current view to perform destruction. A patch sequence ...

CVE-2024-3262

CVE-2024-3262 is an information-exposure vulnerability in Request Tracker (RT) affecting RT 4.x. The issue arises because ticket/application data could be stored in a user’s browser cache, allowing a local attacker with access to the device to retrieve sensitive information even after session ter...

CVE-2024-20800

CVE-2024-20800 affects Adobe Experience Manager versions 6.5.19 and earlier. The issue is a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable web pages, potentially leading to arbitrary code executio...

CVE-2024-26800

CVE-2024-26800 affects the Linux kernel TLS backlog decryption path. The issue is a use-after-free when crypto_aead_decrypt returns -EBUSY and tls_do_decryption waits for async decryptions; if any completes with an error, tls_do_decryption returns -EBADMSG and tls_decrypt_sg releases memory that ...

CVE-2024-26791

CVE-2024-26791 — Linux kernel: btrfs dev-replace: properly validate device names. A syzbot report indicated device name buffers passed to device replace could read beyond end (getname_kernel) due to insufficient termination checks. The fix adds a helper that validates both source and target devic...

CVE-2024-26789

CVE-2024-26789 concerns the Linux kernel crypto path for ARM64 AES-CTR. The bit-sliced NEON implementation could perform out-of-bounds reads when processing short inputs or tail blocks that do not align to 128-byte blocks, because it would jump into the plain NEON helper which handles memory in 1...

CVE-2024-26786

Technical details not publicly disclosed in the provided documents. CVE-2024-26786: Linux kernel iommufd fix for iopt_access_list_id overwrite; adds new_id and updates iopt_access_list_id only on success (root cause: iova alignment check failure).

CVE-2024-26784

Mode C: Normal CVE-2024-26784 details confirmed. Affected software: Linux kernel (ARM) scmi_perf_domain driver. Issue: NULL dereference during module removal when the device-tree entry '#power-domain-cells' is missing, causing probe to bail early but remove() to run with uninitialized state. Root...

CVE-2024-29008

CVE-2024-29008 concerns Apache CloudStack’s extraconfig (additional VM configuration) feature. In KVM environments, incorrect access control allows users who can deploy or modify VMs to configure extra VM settings even when the feature is disabled, enabling attachment of host devices (storage dis...