CVE-2024-3171

CVE-2024-3171 affects Google Chrome (Chromium) before 122.0.6261.57. It is a use-after-free in Accessibility that can lead to heap corruption when a user is persuaded to perform specific UI gestures. The issue requires user interaction and is mitigated by updating to Chrome 122.0.6261.57 or later...

CVE-2023-7013

CVE-2023-7013 affects Google Chrome’s Compositing component. The vulnerability arises from an inappropriate implementation that could allow a remote attacker to spoof the security UI via a crafted HTML page. Affected software is Chrome; root cause is within the Compositing path leading to UI spoo...

CVE-2024-2884

CVE-2024-2884 describes an out-of-bounds read in V8 (Chrome’s JavaScript engine) that could be triggered by a crafted HTML page. Affected product: Google Chrome (Linux/Mac/Windows) with versions prior to 121.0.6167.139. Root cause is an out-of-bounds memory access in V8, allowing remote attackers...

CVE-2024-6336 Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure

A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a depende...

CVE-2024-6336

CVE-2024-6336 describes a security misconfiguration in GitHub Enterprise Server where sensitive information could be disclosed to unauthorized users by exploiting the organization ruleset feature. An organization member could change the visibility of a dependent repository from private to public,...

CVE-2024-6336 Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure

A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Server by exploiting organization ruleset feature. This attack required an organization member to explicitly change the visibility of a depende...

PT-2024-37549 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14 Description: A Security Misconfiguration issue in GitHub Enterprise Server allowed unauthorized users to access sensitive information by exploiting the organization ruleset feature. This require...

Cookie Tossing

Overview Affected versions of this package are vulnerable to Cookie Tossing due to a missing Host- prefix on the gitpodiojwt2 session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JW...

CVE-2024-34724

CVE-2024-34724 describes a race condition in the kernel function _UnrefAndMaybeDestroy (pmr.c) that can enable arbitrary code execution and local escalation of privilege without user interaction. The vulnerability is rooted in race timing within memory/reference handling, allowing a local attacke...

CVE-2024-34726

The CVE-2024-34726 issue is in PVRSRV_MMap (pvr_bridge_k.c) of the PVR bridge kernel module. A logic error in PVRSRV_MMap can allow arbitrary code execution, enabling local kernel escalation of privilege with no extra execution privileges and without user interaction. The available documents do n...

CVE-2024-34721

CVE-2024-34721 describes an information-disclosure in Android’s MediaProvider.java, in ensureFileColumns, where improper input validation may allow a user to disclose files owned by another user. This is a local disclosure with no extra execution privileges required and does not require user inte...

CVE-2024-34723

Summary: CVE-2024-34723 describes a logic error in Android’s ParcelableListBinder.java (onTransact) that could enable local elevation of privilege by stealing the mAllowlistToken to launch an app from the background, without extra privileges or user interaction. The vulnerability is tied to how P...

CVE-2024-34725

The CVE-2024-34725 entry describes a race condition in DevmemIntUnexportCtx of devicemem_server.c that can allow arbitrary code execution and local privilege escalation in the kernel, with no extra privileges or user interaction required. Connected records (Red Hat, NVD, CVE lists, OSV) confirm t...

CVE-2024-34722

CVE-2024-34722 is an Android BLE legacy-pairing authentication bypass caused by an incorrect protocol implementation in smp_proc_rand of smp_act.cc. The issue enables remote elevation of privilege with no extra privileges or user interaction, as described across multiple sources (NVD, Red Hat CVE...

CVE-2024-31320

CVE-2024-31320 relates to Android’s setSkipPrompt in AssociationRequest.java, where an attacker could establish a companion device association without user confirmation, enabling local elevation of privilege with no user interaction. The Red Hat and CNVD entries align on an Android elevation-of-p...

CVE-2024-31335

The CVE-2024-31335 entry concerns a logic error in DevmemIntChangeSparse2 within devicemem_server.c that can enable arbitrary code execution with local privilege elevation in the kernel. Connected sources indicate affected components include Android’s kernel-related stack and PowerVR-GPU subcompo...

CVE-2024-34720

CVE-2024-34720 affects Google Android: a logic error in com_android_internal_os_ZygoteCommandBuffer.cpp (ZygoteCommandBuffer.nativeForkRepeatedly) may enable arbitrary code execution in any app’s zygote processes, causing local privilege escalation with no extra privileges or user interaction req...

CVE-2024-31339

CVE-2024-31339 affects Google Android: a memory corruption via use-after-free in multiple functions of StatsService.cpp can lead to local escalation of privilege with no user interaction. The issue impacts the Statsd component and is listed in Android Security Bulletin details for 2024-07-01/07-0...

CVE-2024-31331

CVE-2024-31331 affects the Android Framework, specifically a logic error in PackageManagerService.java setMimeGroup that can hide the service from Settings. This can enable local elevation of privilege with high impact (confidentiality/integrity/availability). Exploitation requires local access a...

CVE-2024-31332

CVE-2024-31332 affects Google Android Framework components, where a missing permission check allows bypassing restrictions on adding new Wi‑Fi connections. This enables local elevation of privilege with no extra execution privileges and no user interaction. Root cause: permission check gaps in mu...