CVE-2024-57964

The CVE-2024-57964 entry concerns the HVAC Energy Saving Program, where insecure loading of Dynamic Link Libraries is the root cause. The vulnerability can allow a local attacker to disclose information or execute arbitrary code on affected systems, with a CVSS v3.1 base score of 7.3 ( HIGH ) and...

CVE-2024-57964 Insecure Loading of Dynamic Link Libraries in HVAC Energy Saving Program

Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose information or execute arbitray code on affected systems. This issue affects HVAC Energy Saving Program:...

CVE-2024-57964: Uncontrolled Search Path Element

Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose information or execute arbitray code on affected systems. This issue affects HVAC Energy Saving Program:...

Hitachi HVAC Energy Saving Program security vulnerability

Hitachi HVAC Energy Saving Program is an energy saving program project of Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi HVAC Energy Saving Program that originates from an unsafe loading of a dynamic link library, which could lead to local code execution or information...

Creative SVG File Upload to Local File Inclusion Vulnerability Affecting 90,000 Sites Patched in Jupiter X Core WordPress Plugin

📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

A malicious manifests can lead to DoS due to unchecked array bound access via network in ollama/ollama

This report is not public...

Wordfence Intelligence Weekly WordPress Vulnerability Report (February 3, 2025 to February 9, 2025)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

Cisco Expressway XSS

The vulnerability in the web interface for managing microprogramming software in Cisco Expressway is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

curl: Format string vulnerability, curl_msnprintf() function

Summary: A vulnerability has been identified in the curl library’s formatted output functions specifically in curlmsnprintf and its related functions. When a malicious attacker-controlled format string containing the %hn conversion specifier is passed, the function incorrectly attempts to write t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: devmap: provide rxq after redirect rxq contains a pointer to the device from which the redirect occurred. Currently, the BPF program executed after a redirect via BPFMAPTYPEDEVMAP does not have this pointer set. This is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix XDP program unloading while removing the driver The commit 6533e558c650 “i40e: Fix reset path while removing the driver” introduced a new PF state "I40EINREMOVE" to prevent modification of the XDP program while the driv...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed null pointer dereference in resolveprogtype for BPFPROGTYPEEXT When loading an EXT program without specifying attr-attachprogfd, prog-aux-dstprog will be null. At this point, calling resolveprogtype anywhere results in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpfprog/attachment RCU flavors Uprobes always use bpfprogrunarrayuprobe under tasks-trace-RCU protection. However, it is possible to attach a non-sleepable BPF program to an uprobe; non-sleepable BPF...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Consider returning from setmemoryro when using bpfproglockro setmemoryro may fail, leaving memory unprotected. Check its return value and treat it as an error...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Added null check for toppipetoprogram in commitplanesforstream This commit addresses a null pointer dereference issue in the commitplanesforstream function at line 4140. The issue could occur when toppipetoprogra...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xstcpsetupsocket When using a BPF program on kernelconnect, the call can return -EPERM. This causes xstcpsetupsocket to loop forever, filling up the syslog and potentially...

Zyxel DSL CPE OS Command Injection Vulnerability

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42246)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42246 advisory. - In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of...

[SECURITY] Fedora 40 Update: stalld-1.19.8-1.fc40

The stalld program monitors the set of system threads, looking for threads that are ready-to-run but have not been given processor time for some threshold period. When a starving thread is found, it is given a temporary boost using the SCHEDDEADLINE policy. The default is to allow 10 microseconds...

[SECURITY] Fedora 41 Update: stalld-1.19.8-1.fc41

The stalld program monitors the set of system threads, looking for threads that are ready-to-run but have not been given processor time for some threshold period. When a starving thread is found, it is given a temporary boost using the SCHEDDEADLINE policy. The default is to allow 10 microseconds...