CVE-2024-0435

CVE-2024-0435 describes a self-targeted cross-site scripting (XSS) flaw in a chat feature. The vulnerability allows a user to inject XSS payloads into a chat message that executes when the message is sent and on subsequent page loads. According to the sources, exploitation requires the user to ha...

CVE-2024-0798

The CVE-2024-0798 entry relates to mintplex-labs/anything-llm, where users with the default role can delete documents uploaded by admin via a crafted DELETE to /api/system/remove-document. The root cause is improper access-control checks that allow unauthorized document deletion, risking data int...

CVE-2024-0436

Technical details (affected product/version, root cause specifics, exploit scenarios, or remediation) are not publicly available in the provided Connected documents. Monitor for updates from NVD/Red Hat/OSV and other feeds to obtain concrete data.

CVE-2022-48626

CVE-2022-48626 affects the Linux kernel moxart MMC host driver. A use-after-free occurs when the mmc host structure is accessed after being freed in moxart_remove(). The fix saves the device’s base register and uses it instead of dereferencing the freed pointer. Connected sources confirm this is ...

CVE-2021-46905

CVE-2021-46905 : Linux kernel vulnerability where a NULL-pointer dereference was introduced in net: hso during tty device unregistration after a minor was released. The issue arose because the serial device table could be accessed post-release of the minor by hso_serial_tty_unregister(), leading ...

CVE-2023-52472

CVE-2023-52472 : Linux kernel vulnerability in crypto: rsa where a NULL dereference could occur if mpi_alloc() allocation fails. The fix adds a check for allocation failure to satisfy static analyzers; current small allocations are unlikely to fail, but the patch is implemented to prevent NULL de...

CVE-2023-52470

CVE-2023-52470: Linux kernel vulnerability fixed in drm/radeon driver. The issue was a potential NULL pointer dereference in radeon_crtc_init() if the alloc_workqueue call failed. The published fix adds a check for the alloc_workqueue return value to avoid dereferencing a NULL pointer. Affected c...

CVE-2024-27359

The CVE-2024-27359 issue affects WithSecure products (Client Security 15; Server Security 15; Email and Server Security 15; Elements Endpoint Protection 17+; Client Security for Mac 15; Elements Endpoint Protection for Mac 17+; Linux Security 64 12.0 / Linux Protection 12.0; Atlant 1.0.35-1). Roo...

CVE-2023-43051

IBM Cognos Analytics is affected by CVE-2023-43051 (XSS) in versions 11.1.7, 11.2.4, and 12.0.0, enabling embedding of arbitrary JavaScript in the Web UI and potentially credential disclosure within a trusted session. The issue is addressed by upgrading to: 12.0.2 for 12.0.x, 11.2.4 FP3 for 11.2....

CVE-2022-34357

CVE-2022-34357 affects IBM Cognos Analytics Mobile Server versions 11.1.7, 11.2.4, and 12.0.0. Root cause: weak or absent rate limiting allows unlimited HTTP requests from a single user, leading to Denial of Service and service unavailability for other users. Remediation provided in connected doc...

CVE-2023-32344

CVE-2023-32344 affects IBM Cognos Analytics versions 11.1.7, 11.2.4 FP? and 12.0.0, with a form action hijacking flaw that lets an attacker modify the form action to reference an arbitrary path. Root cause and impact are described across multiple sources (IBM Cognos Analytics documentation and ad...

CVE-2023-38359

CVE-2023-38359 - IBM Cognos Analytics XSS : The vulnerability affects IBM Cognos Analytics versions 11.1.7, 11.2.4, and 12.0.0 where untrusted input in the Web UI can be used to embed arbitrary JavaScript, potentially exposing credentials within a trusted session. Root cause: cross-site scripting...

CVE-2024-26605

CVE-2024-26605 relates to a Linux kernel issue where a last‑minute revert in 6.7-final could deadlock when enabling ASPM during probe of Qualcomm PCIe controllers. The root cause is a potential recursive locking of pci_bus_sem between a read lock and a write/lock path, leading to a deadlock, evid...

CVE-2024-26604

CVE-2024-26604 concerns the Linux kernel. The issue arises from reverting the change that removed redundant NULL checks for ktype in kobject handling. The description and connected docs indicate this revert was done because of reported problems, and there is no publicly provided fix or patch deta...

CVE-2024-26601

CVE-2024-26601 is a Linux kernel vulnerability in the ext4 block allocator. The issue arises when a fast commit replay causes mb_free_blocks() to mark blocks as free that are already free, corrupting the buddy bitmap. The fix reintroduces mb_regenerate_buddy() and regenerates the buddy after a bl...

CVE-2024-26602

CVE-2024-26602 affects the Linux kernel’s membarrier path. The fix targets the sys_membarrier interface by introducing a lock on the path to serialize accesses and prevent extremely high call frequency, which could otherwise cause global slowdowns. Affected component: sched/membarrier. Root cause...

CVE-2024-26600

CVE-2024-26600 details (Linux kernel): A NULL pointer dereference in the TI PHY/OMAP USB2 PHY driver could be triggered when an external phy does not implement send_srp(), causing a wakeup path to call a NULL function. The issue manifests during idle Ethernet gadget wakeups and leads to a kernel ...

CVE-2023-2331486

Technical details for CVE-2023-2331486 are not publicly available in the provided documents. Monitor for updates.

CVE-2024-1165

Brizy – Page Builder (WordPress)

CVE-2024-1758

CVE-2024-1758 affects the SuperFaktura WooCommerce plugin for WordPress. The vulnerability is a Server-Side Request Forgery (SSRF) in the wc_sf_url_check function present in all versions up to 1.40.3. Exploitation requires authenticated access at subscriber level or higher, enabling an attacker t...