CVE-2024-46733

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve leaks in cowfilerange In the buffered write path, the dirty page owns the qgroup reserve until it creates an orderedextent. Therefore, any errors that occur before the orderedextent is created must free...

CVE-2024-46733 btrfs: fix qgroup reserve leaks in cow_file_range

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve leaks in cowfilerange In the buffered write path, the dirty page owns the qgroup reserve until it creates an orderedextent. Therefore, any errors that occur before the orderedextent is created must free...

nvme: fix reconnection fail due to reserved tag allocation

...

CVE-2023-46809

CVE-2023-46809 affects Node.js runtimes that bundle an unpatched OpenSSL or use a dynamically linked OpenSSL version; exposed to the Marvin Attack when PKCS #1 v1.5 padding is allowed during RSA decryption with a private key. This is a timing/side-channel vulnerability affecting confidentiality a...

CVE-2023-46809

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/hkario/marvin/, if PCKS 1 v1.5 padding is allowed when performing RSA descryption using a privat...

CVE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

CVE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

CVE-2023-30583

CVE-2023-30583 : In Node.js 20, the fs.openAsBlob() API can bypass the experimental permission model when the file system read restriction is enabled with --allow-fs-read, due to a missing check in fs.openAsBlob(). The description notes this as part of the experimental feature set. Remediation/fi...

CVE-2023-30582

CVE-2023-30582: In Node.js (version 20) under the experimental permission model, using --allow-fs-read with a non-* argument enables monitoring of files via fs.watchFile, bypassing read restrictions. This is tied to an incomplete permission model. The connected IBM bulletin references Spectrum Co...

CVE-2023-30582

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a...

CVE-2023-30584

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an...

CVE-2023-30587

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the...

SUSE CVE-2024-44972

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

DEBIAN-CVE-2024-44972

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clear page dirty inside extentwritelockedrange BUG For subpage + zoned case, the following workload can lead to rsv data leak at unmount time: mkfs.btrfs -f -s 4k $dev mount $dev $mnt fsstress -w -n 8 -d $mnt -s...

PT-2024-25080 · Qualcomm · Qualcomm Snapdragon Auto

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Auto affected versions not specified Description: Memory corruption occurs when gralloc clients request a very high reserved size for calculating total metadata size. This issue is related to the calculation of total...

SUSE CVE-2024-6597

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

PT-2024-11508 · Undefined · Undefined

"Source": "CVE FEED", "Title": "CVE-2022-1443 - Apache HTTP Server SQL Injection", "Content": "CVE ID : CVE-2022-1443 Published : Aug. 19, 2024, 3:15 p.m. | 26 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1789. Reason: This candidate is ...

CVE-2024-35686

The CVE-2024-35686 entry concerns a Missing Authorization vulnerability in Automattic Sensei LMS and Sensei Pro (WC Paid Courses). Connected documents provide concrete details: affected versions include Sensei LMS up to 4.23.1 and Sensei Pro (WC Paid Courses) up to 4.23.1.1.23.1. The issue is cat...

SUSE CVE-2024-42283

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthopgrp contains two reserved fields that are not initialized by nlaputnhgroup, and carry garbage. This can be observed e.g. with strace edited for clarity: ip...

AZL-47838 CVE-2024-42283 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthopgrp contains two reserved fields that are not initialized by nlaputnhgroup, and carry garbage. This can be observed e.g. with strace edited for clarity: ip...