CVE-2024-6221

CVE-2024-6221 affects corydolphin/flask-cors 4.0.1, where the Access-Control-Allow-Private-Network header can be enabled by default due to an improper access-control configuration. This can allow private network resources to be exposed to external actors. Public-facing advisories (IBM and EU/NVD ...

CVE-2024-42307

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential null pointer use in destroyworkqueue in initcifs error path Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 initcifs error: we previously assumed 'serverclosewq' could be nul...

CVE-2024-42282

In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy netdevice handling Move the freeing of the dummy netdevice from mtkfreedev to mtkremove. Previously, if allocnetdevdummy failed in mtkprobe, eth-dummydev would be NUL...

CVE-2024-42315 exfat: fix potential deadlock on __exfat_get_dentry_set

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential deadlock on exfatgetdentryset When accessing a file with more entries than ESMAXENTRYNUM, the bh-array is allocated in exfatgetentryset. The problem is that the bh-array is allocated with GFPKERNEL. It does n...

CVE-2024-42307 cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential null pointer use in destroyworkqueue in initcifs error path Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 initcifs error: we previously assumed 'serverclosewq' could be nul...

CVE-2024-42282 net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling

In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy netdevice handling Move the freeing of the dummy netdevice from mtkfreedev to mtkremove. Previously, if allocnetdevdummy failed in mtkprobe, eth-dummydev would be NUL...

CVE-2024-42282

In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy netdevice handling Move the freeing of the dummy netdevice from mtkfreedev to mtkremove. Previously, if allocnetdevdummy failed in mtkprobe, eth-dummydev would be NUL...

CVE-2024-42269

CVE-2024-42269 (Linux kernel) : A local DoS via NULL pointer dereference in ip6table_nat_table_init() was resolved. The root cause: ip6table_nat_table_init() accessed net->gen->ptr[...] before per-network entry was allocated. The fix: call register_pernet_subsys() before xt_register_templat...

SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2024:2947-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2947-1 advisory. The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes. The following securit...

kernel: wifi: nl80211: don't free NULL coalescing rule

A possible NULL pointer dereference was observed in the Linux kernel, in net/wireless/nl80211.c. This may lead to a crash...

RHEL 9 : kernel (RHSA-2024:5364)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5364 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: gfs2: Fix kernel NULL pointer...

kernel: vt: fix memory overlapping when deleting chars in the buffer

A flaw was found in the Linux kernel's virtual terminal driver which causes a memory overlapping copy to occur, this overlapping copy can lead to data corruption and could potentially allow an attacker interacting with a virtual terminal to corrupt or expose system memory...

SUSE-SU-2024:2890-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: - CVE-2023-51714: Fixed an incorrect integer overflow check bsc1218413. - CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted can be responded to bsc1227426 - CVE-2023-45935: Fixed NULL pointer...

CVE-2024-41733

In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the...

CVE-2024-41733 Information Disclosure Vulnerability in SAP Commerce

In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the...

CVE-2024-41733

Concrete details from connected sources confirm a candidate vulnerability in SAP Commerce: an information-disclosure issue that allows an attacker to determine whether a given email is associated with a valid user account during registration or login. The impact is confined to confidentiality (lo...

ALSA-2024:5258 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 golang: net/http: memory exhaustion in Request.ParseMultipartForm...

Intel HID Event Filter Installer August 2024 Security Update

Intel has informed HP of a potential security vulnerability in some Intel® Human Interface Device HID Event Filter software installers, which might allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Intel has released updates to mitigate t...

Client Vulnerabilities – Aug 2024

Bulletin ID: AMD-SB-4004 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary Potential vulnerabilities in AMD Secure Processor ASP, and other platform components were reported. Mitigations are being provided in Platform Initialization PI...

PT-2024-27505 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue is being actively exploited. No further details are available about the nature of the issue or its potential impact. Recommendations: At the moment, there is no information...