CVE-2024-32669 Possible stack overflow due to a string encoding processing error

Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0...

CVE-2024-23187

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please...

CVE-2024-34455

Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2...

Vulnerabilities fixed in Cisco IP phones

Cisco has fixed vulnerabilities in the firmware of several IP Phone systems. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or gain access to sensitive data on the vulnerable device and thus potentially manipulate phone calls. Cisco has released updates to fix t...

kernel: idpf: fix null-ptr-deref in idpf_features_check

A flaw was found in the idpf module in the Linux kernel. A null pointer dereference can be triggered when the driver attempts to use a resource that has already been released, resulting in a denial of service...

Vulnerabilities fixed in IBM MQ

IBM has fixed vulnerabilities in MQ. A malicious party could exploit the exploit the vulnerabilities to cause a denial-of-service or potentially execute arbitrary code on the vulnerable system. IBM has released updates to fix the vulnerabilities in MQ. For more information, see:...

PT-2024-14882 · Unknown · Dvr Firmware

Name of the Vulnerable Software and Affected Versions: DVR firmware affected versions not specified Description: A flaw has been discovered in the DVR firmware's encryption logic, which is inappropriate and allows for decryption. The issue was found by Vladimir Kononovich, a security researcher...

CVE-2024-32657

Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is...

DEBIAN-CVE-2024-32459

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that stems from the presence of a null pointer dereference. No details of the vulnerability are provided at this time...

Vulnerability fixed in Putty

Putty has fixed a vulnerability in Putty Client. The vulnerability in Putty is in how the ECDSA nonce is created when using NIST P-521. This makes possible for a malicious person to guess the nonce and use using the signed text to retrieve the private key. Putty is also used in the following...

HPESBHF04632 rev.3 - HPE Compute Scale-up Server 3200, Superdome Flex and Superdome Flex 280 servers, Local Buffer Overflow

Potential Security Impact: Local: Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.20.128 HPE Superdome Flex 280 Server - Prior to v1.80.20 HPE Superdome Flex Server - Prior to v3.100.26 CVSS Scores: | CVE | CVSS Vector...

Vulnerabilities fixed in Juniper JunOS

Juniper has fixed vulnerabilities in JunOS and JunOS Evolved. A malicious party could exploit the vulnerabilities to cause a denial-of-service, gain access to sensitive data or to bypass security measures to allow traffic pass through traffic that was not initially authorized. Juniper has release...

Vulnerability fixed in node.js

A vulnerability has been fixed in node.js. A malicious party can exploit the vulnerability to use a command-injection to execute arbitrary code on the system with permissions of the application running in the vulnerable node.js. The developers of node.js have released updates to fix the...

Vulnerability fixed in IBM Websphere Application Server

IBM has fixed a vulnerability in Websphere Application Server. The vulnerability is located in the underlying jose4j library and allows an unauthenticated malicious party to cause a denial-of-service exploit. IBM has released updates to fix the vulnerability in Websphere Application Server. For...

Vulnerabilities fixed in Esri Arcgis Portal

Esri has fixed vulnerabilities in Arcgis Portal. A malicious party could exploit the vulnerabilities to launch a Cross-Site Scripting attack, or perform a Cross-Site-Request-Forgery execution. Such attacks can lead to execution of arbitrary code in the victim's browser, or access to sensitive dat...

UBUNTU-CVE-2024-28871

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available...

CVE-2024-26800

CVE-2024-26800 affects the Linux kernel TLS backlog decryption path. The issue is a use-after-free when crypto_aead_decrypt returns -EBUSY and tls_do_decryption waits for async decryptions; if any completes with an error, tls_do_decryption returns -EBADMSG and tls_decrypt_sg releases memory that ...

PT-2024-21613 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the userfaultfd feature in the Linux kernel, where the src folio is changed after ensuring it's unpinned in UFFDIO MOVE. A commit was made to fix an unexpected chang...

PT-2024-4017

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions 2022 SU5 and prior Description: The issue is related to an unspecified SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager. This vulnerability allows an unauthenticated attacker within th...