16658 matches found
kernel: net/sched: act_mirred: use the backlog for mirred ingress
A potential deadlock flaw was found in net/sched/actmirred.c in the Linux kernel. This may lead to compromised Availability...
kernel: igb: Fix string truncation warnings in igb_set_fw_version
In the Linux kernel, the following vulnerability has been resolved: igb: Fix string truncation warnings in igbsetfwversion Commit 1978d3ead82c "intel: fix string truncation warnings" fixes '-Wformat-truncation=' warnings in igbmain.c by using kasprintf...
kernel: SUNRPC: Fix a suspicious RCU usage warning
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running cthon against an ontap server running pNFS: 57.202521 ============================= 57.202522 WARNING: suspicious RCU usage 57.202523...
kernel: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb-sk in ipvlanprocessv4,6outbound Raw packet from PFPACKET socket ontop of an IPv6-backed ipvlan device will hit WARNONONCE in skmcloop through schdirectxmit path. WARNING: CPU: 2 PID: 0 at net/core/sock.c:775...
kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
A flaw was found in the Linux kernel's netfilter component, specifically within the nfnetlinkqueue module. A local attacker with low privileges could trigger a race condition by calling nfreinject without the required rcureadlock in the instancedestroyrcu function. This could lead to suspicious R...
kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fix incorrect list API usage The Linux kernel CVE team has assigned CVE-2024-36006 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-36006-c032@gregkh/T...
kernel: ipvlan: add ipvlan_route_v6_outbound() helper
In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlanroutev6outbound helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlanprocessv6outbound by moving the flowi6 struct used for the route lookup in an non...
Exploit for Incorrect Authorization in Apache Ofbiz
CVE-2024-38856 For Ethical Usage only, Any harmful or malicio...
SUSE CVE-2024-41989
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent...
Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 8 (5.4.4-157)
This update provides stability and performance improvements. Vulnerability id: VSTOR-76224 A stability fix for the Backup Gateway service. Vulnerability id: VSTOR-81226 Improved the size calculation of erasure coding files. Vulnerability id: VSTOR-88511 Decreased the memory consumption by...
org.jenkins-ci.main:jenkins-test-harness (1.623), org.jenkins-ci.main:jenkins-war (1.623) +2 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.623)
org.jenkins-ci.main:jenkins-core MAVEN version 1.623 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.623 - org.jenkins-ci.main:jenkins-war 1.623 -...
PYSEC-2024-67
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent...
ROS-20240807-01
Vulnerability in the implementation of ColladaParser::ExtractDataObjectFromChannel function of the Open Asset Import Library Assimp 3D models Open Asset Import Library Assimp is related to memory usage after release. Exploitation of the vulnerability could allow an attacker acting remotely to gai...
ROS-20240807-09
A vulnerability in the V8 JavaScript script handler of the Google Chrome browser is related to an improperly implemented security checks for the standard. Exploitation of the vulnerability could allow an attacker, acting remotely, to perform a sandbox exit using a specially crafted HTML page A...
SUSE CVE-2024-41055
In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfnsectionvalid Commit 5ec8e8ea8b77 "mm/sparsemem: fix race in accessing memorysection-usage" changed pfnsectionvalid to add a READONCE call around "ms-usage" to fix a race with sectiondeactiva...
SUSE CVE-2024-41056
In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Use strnlen on name fields in V1 wmfw files Use strnlen instead of strlen on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size...
SUSE CVE-2024-42094
In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIGCPUMASKOFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code...
SUSE CVE-2024-42227
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix overlapping copy within dmlcoremodeprogramming WHY &modelib-mp.Watermark and &locals-Watermark are the same address. memcpy may lead to unexpected behavior. HOW memmove should be used...
Account Manipulation
github.com/navidrome/navidrome is vulnerable to Account Manipulation. The vulnerability is due to the insecure usage of the MD5 hashing algorithm to generate Gravatar URLs, which allows attackers to change another user's information under a controlled email address...