CVE-2024-53047 mptcp: init: protect sched with rcu_read_lock

In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcureadlock Enabling CONFIGPROVERCULIST with its dependence CONFIGRCUEXPERT creates this splat when an MPTCP socket is created: ============================= WARNING: suspicious RCU usage 6.12.0-rc...

CVE-2024-50304 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: Fix suspicious RCU usage warning in iptunnelfind The per-netns IP tunnel hash table is protected by the RTNL mutex and iptunnelfind is only called from the control path where the mutex is taken. Add a lockdep...

CVE-2024-53042 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: Fix suspicious RCU usage warning in iptunnelinitflow There are code paths from which the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning 1. Fix by using...

CVE-2024-50304

The CVE-2024-50304 entry concerns the Linux kernel IPv4 ip_tunnel subsystem. A suspicious RCU usage warning in ip_tunnel_find() was addressed by adding a lockdep check to hlist_for_each_entry_rcu(), validating that the RTNL mutex is held. The per-netns IP tunnel hash table is protected by the RTN...

CVE-2024-53042

CVE-2024-53042 affects the Linux kernel’s ipv4/ip_tunnel code. The issue arises from paths where ip_tunnel_init_flow() is invoked without holding the RCU read lock, triggering a suspicious RCU usage warning. The fix uses l3mdev_master_upper_ifindex_by_index() to acquire the RCU read lock before c...

Why Italy Sells So Much Spyware

Interesting analysis: Although much attention is given to sophisticated, zero-click spyware developed by companies like Israel’s NSO Group, the Italian spyware marketplace has been able to operate relatively under the radar by specializing in cheaper tools. According to an Italian Ministry of...

CVE-2024-21539

Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...

CVE-2024-21539

The CVE-2024-21539 issue affects @eslint/plugin-kit versions before 0.2.3, which are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can drive higher CPU usage and crash the program. A fixed version is 0.2.3 or later. Other connected sour...

CVE-2024-21539

Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...

CVE-2024-21539

Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...

CVE-2024-21539

Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability...

Module-ScanDeps 权限许可和访问控制问题漏洞

Module-ScanDeps is an application by Roderich Schupp Personal Developer. A security vulnerability exists in Module-ScanDeps versions prior to 1.36 that stems from improper input validation, which could lead to a local attacker executing arbitrary shell commands by opening a pesky pipe or passing ...

ROS-20241119-02

Vulnerability of cxl/region components of Linux kernel is related to the use of uninitialized resource in the cxlregionattach function in drivers/cxl/core/region.c. Exploitation of the the vulnerability could allow an attacker to cause a denial of service A vulnerability in the tls component of t...

ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...

CVE-2020-3548

A vulnerability in the Transport Layer Security TLS protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause high CPU usage on an affected device, resulting in a denial of service DoS condition. The...

CVE-2020-3548 Cisco Email Security Appliance Denial Of Service Vulnerability

A vulnerability in the Transport Layer Security TLS protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause high CPU usage on an affected device, resulting in a denial of service DoS condition. The...

Improper access of prompt data by another user.

Description Another user can able to see the prompts data of a particular users. Proof of Concept let promptid be the prompt id of user 1 visit http://127.0.0.1:8080/prompts/promptid from another users user 2 session user 2 can see the user 1 promptid's data. Previously it was reported by some on...

Exploit for Improper Input Validation in Saleor

saleor-platform All Saleor services started from a single repo...

Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

Crafting a very large and well crafted string can increase the CPU usage and crash the program. POC js const ConfigCommentParser = require"@eslint/plugin-kit"; var str = ""; for var i = 0; i 1000000; i++ str += " "; str += "A"; console.log"start" var parser = new ConfigCommentParser;...

GHSA-7Q7G-4XM8-89CQ Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

Crafting a very large and well crafted string can increase the CPU usage and crash the program. POC js const ConfigCommentParser = require"@eslint/plugin-kit"; var str = ""; for var i = 0; i 1000000; i++ str += " "; str += "A"; console.log"start" var parser = new ConfigCommentParser;...