CVE-2024-53109 nommu: pass NULL argument to vma_iter_prealloc()

In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vmaiterprealloc When deleting a vma entry from a maple tree, it has to pass NULL to vmaiterprealloc in order to calculate internal state of the tree, but it passed a wrong argument. As a result, nommu...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

ASB-A-349678452

In skiaallocfunc of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-319068397

Bulletin has no description...

ASB-A-352631932

In preparetodrawintomask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-334780143

In prepareresponse of lwisperiodicio.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-35867 · WordPress · Socialevolution Wp Find Your Nearest

Name of the Vulnerable Software and Affected Versions: SocialEvolution WP Find Your Nearest versions 0.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This is a Stored XSS problem, which means an...

CVE-2024-52801 Brute force takeover of OpenID Connect session cookies in sftpgo

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

Denial Of Service (DoS)

libexpat.so is vulnerable to Denial Of Service DoS. The vulnerability is due to the improper implementation of the XMLResumeParser function, allowing XMLStopParser to stop or suspend an unstarted parser...

MAL-2024-11148 Malicious code in network-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c54b482b9f7cca52eb2a4e26bd31a8b3ff26517fb8668990aed0cde1cfa1b98b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-36625

Zulip 8.3 is vulnerable to Cross Site Scripting XSS via the replaceemojiwithtext function in uiutil.ts...

CVE-2024-36620

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/imagehistory.go...

CVE-2024-42329

The webdriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. But this function can fail for various reasons without an error description and then the wd-error will be NULL and trying to read from it will result in a crash...

BELL-CVE-2024-53096

Bulletin has no description...

MAL-2024-11044 Malicious code in item-card-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a81192c32a32a9e65a9df93f0952d9c598fd305d701d0495d10d44368c38f291 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11057 Malicious code in node-pyt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4b2431b7afc4767a29701cf852758e5395e59146150977199f8b037405c6efa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11704

A double-free issue could have occurred in secpkcs7decoderstartdecrypt when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox 133, Thunderbird 133, Firefox ESR 128.7,...

CGA-FX37-952J-3XMC

Bulletin has no description...

Advisory ROSA-SA-2024-2534

software: zchunk 1.2.2 OS: ROSA-CHROME packageevrstring: zchunk-1.2.2.2-2 CVE-ID: CVE-2023-46228 BDU-ID: 2023-07324 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c components of the RPM zchunk file size reduction software...

The vulnerability of the software tools for accelerated video processing at the hardware level, the Intel Video Processing Library (VPL), stems from incorrect neutralization of certain elements in the output data. This allows attackers to exploit their privileges.

The vulnerability of the software tools for accelerated video processing at the hardware level, the Intel Video Processing Library VPL, is related to incorrect elimination of certain elements in the output data. Exploiting this vulnerability can allow an attacker to enhance their privileges...