CVE-2024-26678

CVE-2024-26678 affects the Linux kernel’s x86/efistub pathway. The vulnerability arises from using a 1:1 file:memory mapping for the PE/COFF .compat section, which is an 8-byte dummy section containing the 32-bit entrypoint address of a 64-bit kernel image when booted from 32-bit firmware (CONFIG...

CVE-2024-26677

CVE-2024-26677 : In the Linux kernel’s rxrpc implementation, the vulnerability stems from how delayed ACKs were constructed with a reference serial number, making them unsuitable as an RTT reference. The issue has been resolved in the kernel by fixing the construction of delayed ACKs to avoid set...

CVE-2023-52636

CVE-2023-52636 involves a flaw in the Linux kernel libceph messenger (net/ceph/messenger_v1.c) where a short read of a socket footer may lead to read_partial_sparse_msg_data() not bailing as intended. When the socket is ready for a subsequent read, the sparse-read state machine can misinterpret p...

CVE-2024-26671

CVE-2024-26671 describes a Linux kernel IO hang caused by blk-mq wakeup/race where __add_wait_queue() can be reordered with blk_mq_get_driver_tag() on tag failure, leading __sbitmap_queue_wake_up() to miss the waiter and not wake up, while blk_mq_mark_tag_wait() cannot obtain a driver tag. The fi...

CVE-2024-29086

CVE-2024-29086 affects OpenHarmony v3.2.4 and earlier. The issue is a local, stack-overflow–driven denial of service in the Arkcompiler runtime, enabling a local attacker to cause a DOS. Root cause identified as a stack overflow. Mitigation: upgrade to a version that contains a fix (no exact patc...

CVE-2024-28951

Summary: CVE-2024-28951 affects OpenHarmony v4.0.0 and earlier and is described as a local-use-after-free vulnerability in the Arkcompiler runtime that allows arbitrary code execution in pre-installed apps. The vulnerability is local, requires privileges, and has a high impact on confidentiality,...

CVE-2024-22180

CVE-2024-22180 affects OpenHarmony versions prior to and including 4.0.0, where a local attacker can trigger a denial-of-service via a use-after-free vulnerability in a camera-related component. The root cause is a use-after-free scenario leading to resource exhaustion or crash, as described acro...

CVE-2024-22177

OpenHarmony vulnerability CVE-2024-22177 affects OpenHarmony v3.2.4 and earlier. A local attacker can cause applications to crash by abusing the get permission flow. Root cause indicated in multiple sources as an improper preservation of permissions. Impact is crash/denial of usability for apps; ...

CVE-2024-21834

Summary of CVE-2024-21834 (OpenHarmony): OpenHarmony v3.2.4 and earlier versions contain a vulnerability that allows a local attacker to cause applications to crash due to a type confusion issue. The impact is described as availability loss (app crashes) with a local attack vector and low privile...

CVE-2024-26663

CVE-2024-26663 — Linux kernel (TIPC) bearer handling : The issue occurs in tipc_nl_bearer_add() when the UDP options attribute is used; it can call tipc_udp_nl_bearer_add() for non-UDP bearers, causing tipc_udp_is_known_peer() to dereference a non-UDP bearer and trigger a general protection fault...

CVE-2024-26661

Public technical details for CVE-2024-26661 are not provided in the connected documents; monitor for updates from vendors/advisories.

CVE-2024-20851

CVE-2024-20851 describes an improper access-control vulnerability in Samsung Data Store prior to version 5.3.00.4 . The issue allows local attackers to launch arbitrary activities with the Samsung Data Store privilege due to inadequate access controls on the component/file/behavior identified in ...

CVE-2024-20849

The CVE-2024-20849 issue affects libsdffextractor, with an out-of-bounds write in the chunk parsing implementation. Versions prior to SMR Apr-2023 Release 1 are vulnerable and could allow local attackers to execute arbitrary code. The available connected document (PT-2024-18758) confirms the affe...

CVE-2024-20846

CVE-2024-20846 describes an out-of-bounds write vulnerability in the libsavsac.so module when decoding hcr. A local attacker could potentially execute arbitrary code due to this flaw in versions prior to SMR Apr-2024 Release 1. A remediation is to update to SMR Apr-2024 Release 1 or later; a temp...

CVE-2024-3160

Intelbras MHDX series (1004, 1008, 1016, 5016) and HDCVI 1008/1016 are reported to be affected by a vulnerability in the HTTP GET Request Handler, involving an unknown part of the file /cap.js. The flaw enables information disclosure and can be triggered remotely. Affected versions are up to 2024...

CVE-2024-3146

CVE-2024-3146 affects DedeCMS 5.7: a cross-site request forgery vulnerability in /src/dede/makehtml_rss_action.php. The issue can be triggered remotely and the public exploit is disclosed (VDB-258921). Root cause and impact are described as CSRF with no stated vendor patch/version in the provided...

CVE-2024-3137

CVE-2024-3137 affects uvdesk/community-skeleton. The issue is described as improper privilege management arising from inadequate access controls. According to the entry, the vulnerability has a CVSSv3 base score of 7.1 (HIGH): network attack vector, low attack complexity, privileges required: LOW...

CVE-2024-3142

CVE-2024-3142 affects Clavister E10/E80 firmware up to 14.00.10. The issue lies in the Setting Handler component, enabling cross-site request forgery (CSRF). Attackers may trigger it remotely, and the exploit has been disclosed publicly. Remediation: upgrade to version 14.00.11 to address the vul...

CVE-2024-30620

CVE-2024-30620 affects Tenda AX1803 v1.0.0.1. The vulnerability is a stack overflow triggered by the serviceName parameter in the function fromAdvSetMacMtuWan. NVD CVSSv3.1 base score 9.8 (CRITICAL): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact: high on confidentiality, integrity, and availability...

CVE-2024-29432

Summary: CVE-2024-29432 affects Alldata v0.4.6 and is a SQL injection flaw exploitable via the tablename parameter in /data/masterdata/datas. The vulnerability details are supported by multiple connected sources, all citing the same description. Affected component: Alldata v0.4.6 (data/masterdata...