CVE-2024-26758 md: Don't ignore suspended array in md_check_recovery()

In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore suspended array in mdcheckrecovery mddevsuspend never stop syncthread, hence it doesn't make sense to ignore suspended array in mdcheckrecovery, which might cause syncthread can't be unregistered. After commit...

DEBIAN-CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

UBUNTU-CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

PT-2024-23238 · Anope +3 · Anope +3

Name of the Vulnerable Software and Affected Versions: Anope versions prior to 2.0.15 Description: The issue allows resetting the password of a suspended account. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where th...

Anope 安全漏洞

Anope is a set of open source IRC services open sourced by Anope IRC Services. A security vulnerability exists in Anope versions prior to 2.0.15, which stems from a vulnerability that does not prevent an attacker from resetting the password of a suspended account...

CVE-2024-30187

Anope before 2.0.15 does not prevent resetting the password of a suspended account...

PT-2024-21501

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the handling of suspended arrays in the md check recovery function. The issue arises when the mddev suspend function does...

TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...

ProcessStomping - A Variation Of ProcessOverwriting To Execute Shellcode On An Executable'S Section

A variation of ProcessOverwriting to execute shellcode on an executable's section What is it For a more detailed explanation you can read my blog post Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on a targeted sectio...

Guidance on Microsoft Signed Drivers Being Used Maliciously

Executive Summary: Microsoft was recently informed that drivers certified by Microsoft’s Windows Hardware Developer Program MWHDP were being used maliciously in post-exploitation activity. In these attacks, the attacker gained administrative privileges on compromised systems before using the...

SUSE CVE-2015-3179

login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account...

SUSE CVE-2015-3180

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

SUSE CVE-2016-5412

arch/powerpc/kvm/book3shvrmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIGKVMBOOK3S64HV is enabled, allows guest OS users to cause a denial of service host OS infinite loop by making a HCEDE hypercall during the existence of a suspended transaction...

SUSE CVE-2018-1082

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site...

RCE vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by attackers able to modify .ci.yml files in SCM. This plugin has been suspended...

GHSA-PHR4-94XX-259M Jenkins build-publisher plugin vulnerable to cross-site request forgery

A cross-site request forgery CSRF vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint. There is currently no workaround or patc...