CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-25393

The CVE-2024-25393 entry concerns RT-Thread up to version 5.0.2, where a stack buffer overflow exists in net/at/src/at_server.c due to insufficient validation of input length. This vulnerability can enable remote attackers to execute arbitrary code or cause a denial of service. The CVSS score is ...

CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-2214 Missing array size check in _Mtxinit() in the Xtensa port

In Eclipse ThreadX before version 6.4.0, the Mtxinit function in the Xtensa port was missing an array size check causing a memory overwrite. The affected file was ports/xtensa/xcc/src/txcliblock.c...

CVE-2024-2193

A new cache speculation vulnerability, known as Spectre-SRC Speculative Race Conditions, was found in hw. Spectre-SRC is similar to the Spectre v1 and allows speculative use-after-free. The difference between this issue and Spectre V1 is that this issue is based on synchronization primitives with...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: amass, temporal-server, step, kots, temporal-server-fips, ferretdb, trillian, kine, step-ca, k3s, caddy-fips, kube-bench, src, falcosidekick-fips, caddy, trillian-fips, argo-workflows, spicedb, argo-workflows-fips, kube-bench-fips, wavefront-collector-for-kubernetes...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: ferretdb, k3s, spicedb, step, caddy, step-ca, temporal-server, trillian, src, argo-workflows, kots, kine, kube-bench, amass...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: step, nri-prometheus, kubernetes-csi-livenessprobe-fips, external-secrets-fips, nerdctl, nri-kubernetes, crossplane-provider-aws-route53, tigera-operator, timestamp-authority, runc, memcached-exporter, prometheus-statsd-exporter, hubble,...

Code injection

swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a...

RHEL 9 : libX11 (RHSA-2024:1088)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1088 advisory. The libX11 packages contain the core X11 protocol client library. Security Fixes: libX11: InitExt.c can overwrite unintended portions of the Display...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: ferretdb, k3s, spicedb, step, caddy, step-ca, temporal-server, trillian, src, argo-workflows, kots, kine, kube-bench, amass...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: amass, temporal-server, step, kots, temporal-server-fips, ferretdb, trillian, kine, step-ca, k3s, caddy-fips, kube-bench, src, falcosidekick-fips, caddy, trillian-fips, argo-workflows, spicedb, argo-workflows-fips, kube-bench-fips, wavefront-collector-for-kubernetes...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: amass, temporal-server, step, kots, temporal-server-fips, ferretdb, trillian, kine, step-ca, k3s, caddy-fips, kube-bench, src, falcosidekick-fips, caddy, trillian-fips, argo-workflows, spicedb, argo-workflows-fips, kube-bench-fips, wavefront-collector-for-kubernetes...

openSUSE: Security Advisory for nodejs18 (SUSE-SU-2023:0419-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:0589-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2021-3638: hw/display/ati2d: Fix buffer overflow in ati2dblt bsc1188609 - CVE-2023-3180: virtio-crypto: verify src and dst buffer length for sym request bsc1213925 - CVE-2023-3354: io: remove io watch if TLS channel is closed during handshake...

The vulnerability of the tftp_input() function in the src/tftp.c component of the TCP-IP Libslirp emulator allows a hacker to gain access to confidential data.

The vulnerability of the tftpinput function in the src/tftp.c component of the TCP-IP Libslirp emulator relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

Cross-site Scripting (XSS)

Overview markdown-to-jsx is a lightweight, customizable React markdown component. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in...

Medium: jtidy

Issue Overview: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Affected Packages: jtidy Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Vis...