Intel DSA 访问控制错误漏洞

Intel DSA is a driver update tool from Intel Intel. It can detect user drivers, update the installed drivers to the latest version, support intel series of graphics cards, audio, network cards and chipset drivers, i-card users must have. An Access Control Error vulnerability exists in Intel DSA...

kernel: keys: Fix overwrite of key expiration on instantiation

In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set ...

kernel: block: fix request.queuelist usage in flush

A vulnerability was found in the Linux kernel's block subsystem, where the issue arises when the request queue list is not properly initialized for the first request in the PREFLUSH/POSTFLUSH sequences, leading to potential kernel crashes due to improper list manipulation...

PT-2024-8843 · Intel · Oneapi Math Kernel Library

Name of the Vulnerable Software and Affected Versions: oneAPI Math Kernel Library versions prior to 2024.2 Description: The issue is related to an uncontrolled search path in the oneAPI Math Kernel Library, which may allow an authenticated user to potentially enable escalation of privilege via...

PT-2024-8718 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 3 Description: A vulnerability has been identified in the affected application where it does not properly invalidate sessions when the associated user is deleted, disabled, or their permissions are...

PT-2024-34149

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 34.11.0 Description: The issue concerns a client-side path traversal vulnerability via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated G...

Nomysoft Informatics Nomysem 安全漏洞

Nomysoft Informatics Nomysem is an application from Nomysoft Informatics, Inc. A security vulnerability exists in Nomysoft Informatics Nomysem versions prior to 13.10.2024 that stems from an improper privilege management vulnerability that allows collection of user-supplied data...

PT-2024-8715

Name of the Vulnerable Software and Affected Versions Solid Edge SE2024 versions prior to V224.0 Update 9 Description A DLL hijacking issue has been identified, which could allow an attacker to execute arbitrary code by placing a crafted DLL file on the system. The vulnerability is related to an...

HCL Traveler 安全漏洞

HCL Traveler is a software from HCL Corporation, USA. used to provide automatic, bi-directional, wireless synchronization between HCL Domino servers and wireless handheld devices. A security vulnerability exists in HCL Traveler versions prior to 3.0.11 that stems from susceptibility to a control...

PT-2024-8157 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the implementation of the SMB protocol in Windows operating systems, specifically involving the use of memory after it has been freed. This can be exploited by a...

PT-2024-32883 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Description: A stack-based buffer overflow in IPsec allows a remote unauthenticated attacker to cause a denial of service. Recommendations: For versions prior to 22.7R2.3, update to version...

Moxa EDS-P510 Telnet Access

The vulnerability of Moxa EDS-P510 microcontroller-based software is related to the use of pre-installed credentials. Exploiting this vulnerability can allow an attacker to remotely access applications via Telnet, in order to execute commands or modify settings...

PT-2024-34918

Name of the Vulnerable Software and Affected Versions Made I.T. Forms versions from n/a through 2.8.0 Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to remote code execution RCE. The...

Double-free in libpcap before 1.10.5 with remote packet capture support.

...

PT-2024-34862 · Unknown · Gopi.R Twitter Plugin

Name of the Vulnerable Software and Affected Versions: Gopi.R Twitter Plugin versions prior to 7.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS in the Twitter real-time searc...

PT-2024-34841 · Unknown · Digfish Geotagged Media

Name of the Vulnerable Software and Affected Versions: Digfish Geotagged Media versions prior to 0.3.0 Description: The issue is related to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS vulnerability. This allows for Reflected XSS attacks...

AZL-53321 CVE-2024-50209 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a check for memory allocation allocpbl can return error when memory allocation fails. Driver is not checking the status on one of the instances...

DEBIAN-CVE-2024-50205

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in applyconstrainttosize The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The...

UBUNTU-CVE-2024-50205

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in applyconstrainttosize The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The...

trustee 授权问题漏洞

trustee is a component of Confidential Containers open source. An Authorization Problem vulnerability exists in trustee prior to version 0.8.2, which stems from the fact that an ART Attestation Results Token token generated by the AS may be manipulated by a MITM attacker, but can still be...