CVE-2024-8014

Progress Telerik Reporting is affected by CVE-2024-8014 due to an insecure type resolution vulnerability that enables object injection and code execution. Affected versions are prior to 2024 Q3 (18.2.24.924). Remediation is to update to 2024 Q3 (18.2.24.924) or later (per the Nessus/Red Hat/CTTA ...

CVE-2024-8014 Telerik Reporting EntityDataSource Insecure Type Resolution

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-8014 Telerik Reporting EntityDataSource Insecure Type Resolution

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible through object injection via an insecure type resolution vulnerability...

CVE-2024-47663 staging: iio: frequency: ad9834: Validate frequency parameter value

In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9834: Validate frequency parameter value In ad9834writefrequency clkgetrate can return 0. In such case ad9834calcfreqreg call will lead to division by zero. Checking 'if fout clkfreq / 2' doesn't protec...

CVE-2024-47662

The CVE-2024-47662 entry concerns the Linux kernel component drm/amd/display (DCN35 DMCUB diagnostics). The issue is that a diagnostic register read was removed to prevent triggering a security violation when DMCUB timeouts occur, blocking Z8 entry. The fix is to stop reading that register from t...

CVE-2024-47660

CVE-2024-47660 : Linux kernel fsnotify race causing lock contention. When removing watches on a directory with many dentries, __fsnotify_update_child_dentry_flags() races with __fsnotify_parent() on children, risking softlockup reports. The fix, per the bulletin, is to set PARENT_WATCHED only whe...

EulerOS 2.0 SP11 : python-dns (EulerOS-SA-2024-2564)

According to the versions of the python-dns package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an...

WordPress Disc Golf Manager Plugin <= 1.0.0 is vulnerable to PHP Object Injection

Software Disc Golf Manager Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-48026 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID ad0f79b4fc3a Credits LVT-tholv2k Required privilege...

EulerOS 2.0 SP12 : python-dns (EulerOS-SA-2024-2538)

According to the versions of the python-dns package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an...

EulerOS 2.0 SP12 : python-dns (EulerOS-SA-2024-2513)

According to the versions of the python-dns package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an...

EulerOS 2.0 SP11 : python-dns (EulerOS-SA-2024-2590)

According to the versions of the python-dns package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an...

Huawei EulerOS: Security Advisory for python-dns (EulerOS-SA-2024-2538)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python-dns (EulerOS-SA-2024-2513)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Advisory ROSA-SA-2024-2495

Software: libvpx 1.7.0 OS: ROSA Virtualization 2.1 packageevrstring: libvpx-1.7.0-11.rv3 CVE-ID: CVE-2023-44488 BDU-ID: 2023-06350 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the libvpx multimedia library is related to incorrect handling of exceptional states when processing certain special form...

Advisory ROSA-SA-2024-2487

Software: flatpak 1.0.9 OS: rosa-server79 packageevrstring: flatpak-1.0.9-13.res7 CVE-ID: CVE-2021-41133 BDU-ID: 2022-00259 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Flatpak application and environment management tool is related to a lack of blocking in the seccomp filter of mount-related...

Medium: python-dns

Issue Overview: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred...

uPlot 安全漏洞

uPlot is a fast, memory-efficient Canvas 2D-based chart for drawing time series, lines, areas, ohlc, and bars from leeoniya personal developer. A security vulnerability exists in uPlot versions prior to 1.6.31, which stems from a lack of checking whether attributes resolve to object prototypes...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error CVE-2024-41098 In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcmsendmsg for the same socket. CVE-2024-44946 In the Linux...

yt-dlp: Multiple Vulnerabilities

Background yt-dlp is a youtube-dl fork with additional features and fixes. Description Multiple vulnerabilities have been found in yt-dlp. Please review the referenced CVE identifiers for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

CVE-2024-46845

In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a ti...