Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper handling of the otx2mboxgetrsp error in the octeontx2-pf module...

PT-2024-17881 · Unknown · Taisan Tarzan-Cms

Name of the Vulnerable Software and Affected Versions: taisan tarzan-cms version 1.0.0 Description: A critical issue was found in the Article Management component, specifically affecting the UploadResponse function of the UploadController.java file. The manipulation of the file argument leads to...

DEBIAN-CVE-2024-56707

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2mboxgetrsp errors in otx2dmacflt.c Add error pointer checks after calling otx2mboxgetrsp...

UBUNTU-CVE-2024-56700

In the Linux kernel, the following vulnerability has been resolved: media: wl128x: Fix atomicity violation in fmcsendcmd Atomicity violation occurs when the fmcsendcmd function is executed simultaneously with the modification of the fmdev-respskb value. Consider a scenario where, after passing th...

CVE-2024-54454

An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allows remote attackers to test whether a username is valid or...

CVE-2024-12991

A vulnerability was found in Beijing Longda Jushang Technology DBShop商城系统 3.3 Release 231225. It has been declared as problematic. This vulnerability affects unknown code of the file /home-order. The manipulation of the argument orderStatus with the input %22%3E%3Csvg%20onload=alert5888%3E leads ...

CVE-2024-12985

Overtek OT-E801G OTE801G65.1.1.0 exposes a remote OS command injection via /diag_ping.cmd when action=test and ipaddr is manipulated (e.g., 8.8.8.8%26%26cat%20/etc/passwd). Root cause is likely insufficient input validation in the endpoint handling ipaddr. Impact is OS command execution, with rem...

CVE-2024-12985 Overtek OT-E801G passwd os command injection

A vulnerability classified as critical was found in Overtek OT-E801G OTE801G65.1.1.0. This vulnerability affects unknown code of the file /diagping.cmd?action=test&interface=ppp0.1&ipaddr=8.8.8.8%26%26cat%20/etc/passwd&ipversion=4&sessionKey=test. The manipulation leads to os command injection. T...

CVE-2024-54454

An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allows remote attackers to test whether a username is valid or...

PT-2024-36340 · Kurmi · Kurmi Provisioning Suite

Name of the Vulnerable Software and Affected Versions: Kurmi Provisioning Suite versions prior to 7.9.0.35 Kurmi Provisioning Suite versions 7.10.x through 7.10.0.18 Kurmi Provisioning Suite versions 7.11.x through 7.11.0.15 Description: An issue was discovered in the sendPasswordReinitLink actio...

CVE-2024-54454

CVE-2024-54454 affects Kurmi Provisioning Suite prior to 7.9.0.35, 7.10.x ≤ 7.10.0.18, and 7.11.x ≤ 7.11.0.15. The issue is an observable response discrepancy in the sendPasswordReinitLink action on the unlogged.do page, enabling remote attackers to determine whether a given username is valid (us...

The vulnerability of the scsidebug component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the scsidebug component in the Linux operating system’s kernel is related to the assignment of the NULL pointer in the functions respverify and respreportzones. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-53157

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfsinfo.oppcount may be zero on some platforms during the reboot...

CVE-2024-53156 wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for connrspepid in htcconnectservice I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htchst.c:26:51 index 255 is out of range for type...

Amazon Linux 2 : gnome-shell (ALAS-2024-2714)

The version of gnome-shell installed on the remote host is prior to 3.28.3-34. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2714 advisory. In GNOME Shell through 45.7, a portal helper can be launched automatically without user confirmation based on network respons...

Practice being punched in the face. The realities of incident response preparation

“Everyone has a plan until they get punched in the face.” This Mike Tyson boxing quote perfectly encapsulates the chaos of a cybersecurity breach. TL;DR Accept that your organisation may be breached Train hard. Regularly test incident response plans Build muscle memory Practice getting punched in...

PT-2025-3792 · Iobit · Iobit Protected Folder

Name of the Vulnerable Software and Affected Versions: IObit Protected Folder versions up to 13.6.0.5 Description: A problem has been found in the function 0x8001E000/0x8001E004 in the library IUProcessFilter.sys of the component IOCTL Handler, which leads to null pointer dereference. The...

CVE-2024-53271

A flaw was found in Envoy. In affected versions, Envoy does not properly handle certain HTTP 1.1 responses. Specially-crafted requests may trigger failures or application crashes in networked devices, leading to a denial of service...

Apache Kafka 安全漏洞

Apache Kafka is an open source distributed streaming platform from the Apache USA Foundation. The platform is capable of fetching real-time data for building applications that react in real-time to changes in the data stream. A security vulnerability exists in Apache Kafka versions 0.10.2.0 throu...

Intel Officials Warned Police That US Cities Aren’t Ready for Hostile Drones

In a previously unreported August memo, the Department of Homeland Security urged state and local police to conduct exercises to test their ability to respond to weaponized drones...