CVE-2024-49776

A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service DoS via a crafted TS video file...

SUSE CVE-2024-52531

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soupheaderparseparamliststrict. There is a plausible way to reach this remotely via soupmessageheadersgetcontenttype e.g., an application may want to retrieve the content type of a request or...

libsoup 缓冲区错误漏洞

libsoup is a GNOME HTTP client/server library from the GNOME Project. A security vulnerability exists in libsoup versions prior to 3.6.1, which stems from a buffer overflow in applications that allow UTF-8 conversions to be performed in the soupheaderparseparamliststrict...

wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param

...

SUSE CVE-2024-50165

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve param-string when parsing mount options In bpfparseparam, keep the value of param-string intact so it can be freed later. Otherwise, the kmalloc area pointed to by param-string will be leaked as shown below:...

CVE-2024-50165 bpf: Preserve param->string when parsing mount options

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve param-string when parsing mount options In bpfparseparam, keep the value of param-string intact so it can be freed later. Otherwise, the kmalloc area pointed to by param-string will be leaked as shown below:...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the failure to properly preserve param-string when parsing the mount option...

CVE-2024-52020

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at wizfix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

GHSA-J9WP-X5Q5-XH2F Funadmin Cross-site Scripting vulnerability

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...

CVE-2024-48228

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...

Malware in capi-param-builder

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2024-33997

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A memory leak issue has been identified in the Linux kernel, specifically in the bpf parse param function. The problem occurs when parsing mount options, where the value of param-strin...

SUSE CVE-2024-47712

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilcparsejoinbssparam In the wilcparsejoinbssparam function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to...

Malicious code in capi-param-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e4506a65382f9502c37e84c02f2a48ef665a903470e3c981ab60a5c8ef9f6d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9438 Malicious code in capi-param-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e4506a65382f9502c37e84c02f2a48ef665a903470e3c981ab60a5c8ef9f6d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-40603

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Memcpy-param-overlap. The crash state includes repeat, repeat, and p ere. No information is provided...

CVE-2023-45359: Improper Encoding or Escaping of Output

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup...

CVE-2024-8942

Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting XSS, due to the lack of input validation, affecting the “idformmsgtitle” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their...

PT-2024-13392 · Temenos · Temenos T24 Browser

Name of the Vulnerable Software and Affected Versions: Temenos T24 Browser version R19.40 Description: A reflected Cross-Site Scripting XSS issue was discovered, allowing a remote attacker to execute arbitrary JavaScript code. This is achieved via the skin parameter in the "about.jsp" and...

VulnCheck KEV: CVE-2024-8956

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can...