AZL-67818 CVE-2024-35794 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen syncthread during suspend 1 commit f52f5c71f3d4 "md: fix stopping sync thread" remove MDRECOVERYFROZEN from mdstopwrites and doesn't realize that dm-raid relies on mdstopwrites to frozen syncthread...

UBUNTU-CVE-2024-35794

In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen syncthread during suspend 1 commit f52f5c71f3d4 "md: fix stopping sync thread" remove MDRECOVERYFROZEN from mdstopwrites and doesn't realize that dm-raid relies on mdstopwrites to frozen syncthread...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a mass storage function attempting to queue requests from the main thread, but other threads may have disabl...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a problematic thread synchronization...

Cross-Site Scripting (XSS)

prestashop/prestashop is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the customer thread feature allowing malicious file uploads through the front-office contact form. When an admin opens the attached file in back office, arbitrary JavaScript will be executed which can...

K000139618: MySQL vulnerabilities CVE-2024-21054, CVE-2024-21009, CVE-2024-20993, and CVE-2024-21102

Security Advisory Description CVE-2024-21054 Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access...

CVE-2024-34716 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

PrestaShop is an open source e-commerce web application. A cross-site scripting XSS vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled throu...

CVE-2024-34716

PrestaShop CVE-2024-34716 is a XSS flaw affecting 8.1.0–8.1.5 when the customer-thread feature flag is enabled. An attacker can upload a malicious file via the front-office contact form and trigger script execution when an admin opens the attachment in back office, potentially leaking session dat...

UBUNTU-CVE-2024-30258

FastDDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed RTPS packet, the subscriber crashes when creating pthread. This can remotely crash any Fast-DD...

PT-2024-26130 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions 8.1.0 through 8.1.5 Description: A cross-site scripting XSS vulnerability is present in PrestaShop when the customer-thread feature flag is enabled. This allows a hacker to upload a malicious file containing an XSS that wi...

CVE-2024-34716: Improper Neutralization of Input During Web Page Generation

PrestaShop is an open source e-commerce web application. A cross-site scripting XSS vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled throu...

CVE-2024-1930

No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the opensession D-Bus method. For each...

PT-2024-9782

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a spinlock race in kernel thread creation. Context switching retains the correct lock owner across the switch from 'prev' to 'next' tasks, relying on interrupts...

D-Link D-View security vulnerability

D-Link D-View is a web-based design network device management software from China's D-Link Corporation. A security vulnerability exists in D-Link D-View, which originates from a TftpSendFileThread directory traversal information disclosure vulnerability...

PT-2024-3620

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition in the Bluetooth subsystem of the Linux kernel leads to a use-after-free issue. When an SCO connection is established and the SCO socket is subsequently released, timeou...

CVE-2024-27060 thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tbportupdatecredits Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BUG: kernel NULL pointer dereference, address: 0000000000000020 PF: supervisor read...

CVE-2024-27003

In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clksummary Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clksummary through debugfs. Failure to do so would result in a...

CVE-2024-26944 btrfs: zoned: fix use-after-free in do_zone_finish()

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free in dozonefinish Shinichiro reported the following use-after-free triggered by the device replace operation in fstests btrfs/070. BTRFS info device nullb1: scrub: finished on devid 1 with status: 0...

kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the hidpsessionthread can lead to a use-after-free vulnerability. This occurs when a timer is active while its deletion function is called, causing memory to be accessed after it has been freed. A local attacker could...

PT-2024-25662

Name of the Vulnerable Software and Affected Versions O-RAN E2T I-Release affected versions not specified Description The issue concerns the O-RAN E2T I-Release Prometheus metric Increment function, which can crash in sctpThread.cpp. This crash occurs when the Increment function is called for...