PT-2024-5419

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.7.0-rc7 Description The issue is related to an out-of-bounds read in the bond option arp ip targets set function. If newval-string is an empty string, newval-string+1 will point to the byte after the string,...

PT-2024-5206 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions 12 through 12L Description: The issue is related to errors in privilege management, specifically in the setSkipPrompt function of AssociationRequest.java. This could allow an attacker to establish a companion device associati...

kernel: netfilter: nf_tables: use timestamp to check for set element timeout

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system...

Prototype Pollution

@cahil/utils is vulnerable to Prototype Pollution. The vulnerability is due to missing checks in the set function, allowing attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

Prototype Pollution

@cat5th/key-serializer is vulnerable to Prototype Pollution. The vulnerability is due to passing crafted arguments with the proto property using functions like query, set, default.query, and default.set. The vulnerability allows attackers to alter the behavior of all objects inheriting from the...

CVE-2024-39014: Improperly Controlled Modification of Object Prototype Attributes

ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

PT-2024-28324 · Unknown · Cahil/Utils

Name of the Vulnerable Software and Affected Versions: cahil/utils version 2.3.2 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties using the set function. This is a result of prototype pollution in the cahil/utils...

cahil utils security vulnerability

cahil utils is a variety of utilities from the individual developer Cahil Foley that provide assistance when developing JS or TS projects. A security vulnerability exists in cahil utils version v2.3.2, which stems from a prototype contamination via function set inclusion, allowing an attacker to...

CVE-2024-39014

ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

CVE-2024-6403

A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifiBasicSet of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched...

PT-2024-37598 · Tenda · Tenda A301

Name of the Vulnerable Software and Affected Versions: Tenda A301 version 15.13.08.12 Description: A critical issue was found in the function fromSetWirelessRepeat of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to a stack-based buffer overflow. This issue can...

PT-2024-10143 · Wavlink · Wavlink Ac3000

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 M33A8.V5030.210505 Description: Multiple OS command injection vulnerabilities exist in the set add routing functionality of the internet.cgi script. A specially crafted HTTP request can lead to arbitrary command execution. An...

PT-2024-37186

Name of the Vulnerable Software and Affected Versions: parisneo/lollms version 9.4.0 Description: A path traversal issue in the "/set personality config" endpoint allows an attacker to overwrite the configs/config.yaml file, potentially leading to remote code execution by modifying server...

PT-2024-10508

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a buffer overflow in the netfilter component of the Linux kernel. This can be exploited to cause a denial of service. The problem occurs when destroying all sets,...

New Medusa Android Trojan Targets Banking Users Across 7 Countries

Cybersecurity researchers have discovered an updated version of an Android banking trojan called Medusa that has been used to target users in Canada, France, Italy, Spain, Turkey, the U.K., and the U.S. The new fraud campaigns, observed in May 2024 and active since July 2023, manifested through...

kernel: netfilter: nf_tables: use timestamp to check for set element timeout

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: netfilter: nf_tables: disallow anonymous set with timeout flag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFTSETEVAL to ensure legacy meters still work...

kernel: netfilter: nf_tables: use timestamp to check for set element timeout

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system...

CVE-2024-5013

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible...

UBUNTU-CVE-2024-37354

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new key 450 108 8192 ------------ cu...