US-CERT Vulnerability Summary for the Week of August 5, 2024
Bulletins provide weekly summaries of new vulnerabilities. Patch information is provided when available.
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
High Vulnerabilities
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info | Patch Info |
|---|---|---|---|---|---|
| 10web–Slider by 10Web Responsive Image Slider | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-08-08 | 8.8 | CVE-2024-7150 | [email protected] [email protected] [email protected] [email protected] |
| Alien Technology–ALR-F800 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 9.8 | CVE-2024-7580 | [email protected] [email protected] [email protected] [email protected] |
| Alien Technology–ALR-F800 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 7.3 | CVE-2024-7578 | [email protected] [email protected] [email protected] [email protected] |
| AMD–3rd Gen AMD EPYC Processors | Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest’s memory or UMC seed resulting in loss of confidentiality and integrity. | 2024-08-05 | 7.9 | CVE-2024-21980 | [email protected] |
| Apache Software Foundation–Apache CloudStack | CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure. Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated. | 2024-08-07 | 8.8 | CVE-2024-42062 | [email protected] [email protected] [email protected] |
| Apache Software Foundation–Apache OFBiz | Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don’t explicitly check user’s permissions because they rely on the configuration of their endpoints). | 2024-08-05 | 8.1 | CVE-2024-38856 | [email protected] [email protected] [email protected] [email protected] |
| Arm Ltd–Bifrost GPU Kernel Driver | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0. | 2024-08-05 | 7.8 | CVE-2024-2937 | [email protected] |
| Arm Ltd–Bifrost GPU Kernel Driver | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0. | 2024-08-05 | 7.8 | CVE-2024-4607 | [email protected] |
| asterisk–asterisk | Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue. | 2024-08-08 | 7.4 | CVE-2024-42365 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Calibre–Calibre | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. | 2024-08-06 | 9.8 | CVE-2024-6782 | [email protected] [email protected] |
| Calibre–Calibre | Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. | 2024-08-06 | 7.5 | CVE-2024-6781 | [email protected] [email protected] |
| Canonical Ltd.–wpa_supplicant | An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist. | 2024-08-07 | 8.8 | CVE-2024-5290 | [email protected] [email protected] |
| Cisco–Cisco Small Business IP Phones | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level. | 2024-08-07 | 9.8 | CVE-2024-20450 | [email protected] |
| Cisco–Cisco Small Business IP Phones | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level. | 2024-08-07 | 9.8 | CVE-2024-20454 | [email protected] |
| Cisco–Cisco Small Business IP Phones | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly. These vulnerabilities exist because HTTP packets are not properly checked for errors. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the remote interface of an affected device. A successful exploit could allow the attacker to cause a DoS condition on the device. | 2024-08-07 | 7.5 | CVE-2024-20451 | [email protected] |
| codename065–MultiPurpose | The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization of untrusted input through the ‘wpeden_post_meta’ post meta. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. | 2024-08-08 | 8.8 | CVE-2024-7486 | [email protected] [email protected] |
| codename065–News Flash | The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the newsflash_post_meta meta value. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. | 2024-08-08 | 7.2 | CVE-2024-7560 | [email protected] [email protected] |
| crmperks–CRM Perks Forms WordPress Form Builder | The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the ‘handle_uploaded_files’ function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible. | 2024-08-06 | 7.2 | CVE-2024-7484 | [email protected] [email protected] [email protected] |
| Delta Electronics–DIAScreen | A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code. | 2024-08-06 | 7.8 | CVE-2024-7502 | [email protected] |
| ForIP Tecnologia–Administrao PABX | A vulnerability was found in ForIP Tecnologia Administração PABX 1.x. It has been rated as critical. Affected by this issue is some unknown functionality of the file /authMonitCallcenter of the component monitcallcenter. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273554 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 7.3 | CVE-2024-7461 | [email protected] [email protected] [email protected] [email protected] |
| Google–Chrome | Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-6988 | [email protected] [email protected] |
| Google–Chrome | Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-6989 | [email protected] [email protected] |
| Google–Chrome | Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-6991 | [email protected] [email protected] |
| Google–Chrome | Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 8.8 | CVE-2024-6994 | [email protected] [email protected] |
| Google–Chrome | Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 8.8 | CVE-2024-6997 | [email protected] [email protected] |
| Google–Chrome | Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 8.8 | CVE-2024-6998 | [email protected] [email protected] |
| Google–Chrome | Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 8.8 | CVE-2024-7000 | [email protected] [email protected] |
| Google–Chrome | Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | 2024-08-06 | 8.8 | CVE-2024-7532 | [email protected] [email protected] |
| Google–Chrome | Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-7533 | [email protected] [email protected] |
| Google–Chrome | Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-7534 | [email protected] [email protected] |
| Google–Chrome | Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-7535 | [email protected] [email protected] |
| Google–Chrome | Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-7536 | [email protected] [email protected] |
| Google–Chrome | Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-08-06 | 8.8 | CVE-2024-7550 | [email protected] [email protected] |
| gopiplus–Horizontal scrolling announcements | The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin’s ‘hsas-shortcode’ shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-08-06 | 8.8 | CVE-2023-5000 | [email protected] [email protected] [email protected] |
| Halo Service Solutions–HaloITSM | HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability. | 2024-08-06 | 9.8 | CVE-2024-6202 | [email protected] |
| Halo Service Solutions–HaloITSM | HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability. | 2024-08-06 | 8 | CVE-2024-6200 | [email protected] |
| Halo Service Solutions–HaloITSM | HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim’s account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability. | 2024-08-06 | 8.3 | CVE-2024-6203 | [email protected] |
| Hewlett Packard Enterprise (HPE)–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | 2024-08-06 | 9.8 | CVE-2024-42394 | [email protected] |
| Hewlett Packard Enterprise (HPE)–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | 2024-08-06 | 9.8 | CVE-2024-42395 | [email protected] |
| Hewlett Packard Enterprise (HPE)–Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | 2024-08-06 | 9.8 | CVE-2024-42393 | [email protected] |
| Hitachi–Hitachi Tuning Manager | Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00. | 2024-08-06 | 8.6 | CVE-2024-5828 | [email protected] |
| Huawei–HarmonyOS | Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-08-08 | 9.3 | CVE-2024-42037 | [email protected] |
| Huawei–HarmonyOS | Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality. | 2024-08-08 | 8.4 | CVE-2024-42035 | [email protected] |
| Huawei–HarmonyOS | Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability. | 2024-08-08 | 8.8 | CVE-2024-42038 | [email protected] |
| itsourcecode–Airline Reservation System | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been classified as critical. Affected is the function login/login2 of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273624. | 2024-08-06 | 7.3 | CVE-2024-7498 | [email protected] [email protected] [email protected] [email protected] |
| itsourcecode–Bike Delivery System | A vulnerability, which was classified as critical, was found in itsourcecode Bike Delivery System 1.0. Affected is an unknown function of the file contact_us_action.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273648. | 2024-08-06 | 7.3 | CVE-2024-7505 | [email protected] [email protected] [email protected] [email protected] |
| Janobe — School Attendance Monitoring System | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘Users in ‘/report/printlogs.php’ parameter. | 2024-08-06 | 9.8 | CVE-2024-33974 | [email protected] |
| Janobe–E-Negosyo System | SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in ‘id’ in ‘/admin/orders/controller.php’ parameter | 2024-08-06 | 9.8 | CVE-2024-33957 | [email protected] |
| Janobe–E-Negosyo System | SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in ‘phonenumber’ in ‘/passwordrecover.php’ parameter. | 2024-08-06 | 9.8 | CVE-2024-33958 | [email protected] |
| Janobe–E-Negosyo System | Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via ‘view’ parameter in ‘/admin/products/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33975 | [email protected] |
| Janobe–E-Negosyo System | Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via ‘id’ parameter in ‘/admin/user/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33976 | [email protected] |
| Janobe–E-Negosyo System | Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via ‘view’ parameter in /admin/orders/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33977 | [email protected] |
| Janobe–E-Negosyo System | Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via ‘category’ parameter in ‘/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33978 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘code’ in ‘/admin/mod_reservation/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33962 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘end’ in ‘/admin/mod_reports/printreport.php’ parameter. | 2024-08-06 | 9.8 | CVE-2024-33960 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘categ’ in ‘/admin/mod_reports/printreport.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33959 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘code’ in ‘/admin/mod_reservation/controller.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33961 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘id’ in ‘/admin/mod_room/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33963 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘id’ in ‘/admin/mod_users/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33964 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘view’ in ‘/tubigangarden/admin/mod_accomodation/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33965 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘xtsearch’ in ‘/admin/mod_reports/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33966 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘view’ in ‘Attendance’ and ‘YearLevel’ in ‘/AttendanceMonitoring/report/attendance_print.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33967 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘Attendance’ and ‘YearLevel’ in ‘/AttendanceMonitoring/report/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33968 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘id’ in ‘/AttendanceMonitoring/department/index.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33969 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘studid’ in ‘/candidate/controller.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33970 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘username’ in ‘/login.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33971 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘events’ in ‘/report/event_print.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33972 | [email protected] |
| Janobe–Janobe PayPal | SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following ‘Attendance’ and ‘YearLevel’ in ‘/report/attendance_print.php’ parameter. | 2024-08-06 | 7.5 | CVE-2024-33973 | [email protected] |
| Janobe–Janobe PayPal | Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘q’, ‘arrival’, ‘departure’ and ‘accomodation’ parameters in ‘/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33979 | [email protected] |
| Janobe–Janobe PayPal | Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘start’ parameter in ‘/admin/mod_reports/printreport.php’. | 2024-08-06 | 7.1 | CVE-2024-33980 | [email protected] |
| Janobe–Janobe PayPal | Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘start’ parameter in ‘/admin/mod_reports/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33981 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘StudentID’ parameter in ‘/AttendanceMonitoring/student/controller.php’. | 2024-08-06 | 7.1 | CVE-2024-33982 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘Attendance’, ‘attenddate’ and ‘YearLevel’ parameters in ‘/AttendanceMonitoring/report/attendance_print.php’. | 2024-08-06 | 7.1 | CVE-2024-33983 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘Attendance’, ‘attenddate’ and ‘YearLevel’ parameters in ‘/AttendanceMonitoring/report/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33984 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘View’ parameter in ‘/course/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33985 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘View’ parameter in ‘/department/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33986 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘Attendance’, ‘attenddate’, ‘YearLevel’, ‘eventdate’, ‘events’, ‘Users’ and ‘YearLevel’ parameters in ‘/report/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33987 | [email protected] |
| Janobe–School Attendance Monitoring System | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘Attendance’, ‘attenddate’ and ‘YearLevel’ parameters in ‘/report/attendance_print.php’. | 2024-08-06 | 7.1 | CVE-2024-33988 | [email protected] |
| Janobe–School Event Management System | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the ‘eventdate’ and ‘events’ parameters in ‘port/event_print.php’. | 2024-08-06 | 7.1 | CVE-2024-33989 | [email protected] |
| Janobe–School Event Management System | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the ‘id’ and ‘view’ parameters in ‘/user/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33990 | [email protected] |
| Janobe–School Event Management System | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the ‘view’ parameter in ‘/eventwinner/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33991 | [email protected] |
| Janobe–School Event Management System | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the ‘view’ parameter in ‘/student/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33992 | [email protected] |
| Janobe–School Event Management System | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the ‘view’ parameter in /candidate/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33993 | [email protected] |
| Janobe–School Event Management System | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the ‘view’ parameter in ‘/event/index.php’. | 2024-08-06 | 7.1 | CVE-2024-33994 | [email protected] |
| JetBrains–TeamCity | In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions | 2024-08-06 | 7.5 | CVE-2024-43114 | [email protected] |
| JFrog–Artifactory | JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning. | 2024-08-05 | 9.3 | CVE-2024-6915 | [email protected] |
| Journyx–Journyx (jtime) | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password. | 2024-08-07 | 8.8 | CVE-2024-6890 | bbf0bd87-ece2-41be-b873-96928ee8fab9 |
| Journyx–Journyx (jtime) | Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. | 2024-08-08 | 8.8 | CVE-2024-6891 | bbf0bd87-ece2-41be-b873-96928ee8fab9 |
| Journyx–Journyx (jtime) | The “soap_cgi.pyc” API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. | 2024-08-08 | 7.5 | CVE-2024-6893 | bbf0bd87-ece2-41be-b873-96928ee8fab9 |
| jupyterhub–jupyterhub | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue. | 2024-08-08 | 7.2 | CVE-2024-41942 | [email protected] [email protected] [email protected] |
| kaizencoders–Traffic Manager | The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page’ parameter in the ‘UserWebStat’ AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-08-06 | 7.2 | CVE-2024-7485 | [email protected] [email protected] [email protected] |
| KAON Group–AR2140 | Firmware in KAON AR2140 routers prior to version 4.2.16 is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal of the router. | 2024-08-08 | 7.2 | CVE-2024-3659 | [email protected] [email protected] |
| mailcow–mailcow-dockerized | mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of the user’s browser. This could lead to unauthorized actions, data theft, or further exploitation of the affected system. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 7.6 | CVE-2024-41959 | [email protected] [email protected] |
| mainwp–MainWP Child Reports | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is only exploitable on multisite instances. | 2024-08-08 | 8.8 | CVE-2024-7492 | [email protected] [email protected] [email protected] |
| matrix-org–matrix-react-sdk | matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user’s account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. This was patched in matrix-react-sdk 3.105.0. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected. Users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-06 | 7.7 | CVE-2024-42347 | [email protected] [email protected] |
| Microsoft–Dynamics CRM Service Portal Web Resource | An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link. | 2024-08-06 | 8.2 | CVE-2024-38166 | [email protected] |
| Microsoft–Microsoft Copilot Studio | An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network. | 2024-08-06 | 8.5 | CVE-2024-38206 | [email protected] |
| Microsoft–Windows 10 Version 1809 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Backup, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful. Microsoft is developing a security update to mitigate this threat, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE. This CVE will be updated, and customers will be notified when the official mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs. Details A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows Backup potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of VBS. For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability. Microsoft is developing a security update that will mitigate this vulnerability, but it is not yet available. This CVE will be updated with new information and links to the security updates once available. We highly encourage customers subscribe to Security Update Guide notifications to be alerted of updates. See Microsoft Technical Security Notifications and Security Update Guide Notification System News: Create your profile now – Microsoft Security Response Center. Microsoft is not aware of any attempts to exploit this vulnerability. However, a public presentation regarding this vulnerability was hosted at BlackHat on August 7, 2024. The presentation was appropriately coordinated with Microsoft but may change the threat landscape. Customers concerned with these risks should reference the guidance provided in the Recommended Actions section to protect their systems. Recommended Actions The following recommendations do not mitigate the vulnerability but can be used to reduce the risk of exploitation until the security update is available. Configure “Audit Object Access” settings to monitor attempts to access files, such as handle creation, read / write operations, or modifications to security descriptors. Audit File System – Windows 10 | Microsoft Learn Apply a basic audit policy on a file or folder – Windows 10 | Microsoft Learn Audit users with permission to perform Backup and Restore operations to ensure only the appropriate users can perform these operations. Audit: Audit the use of Backup and Restore privilege (Windows 10) – Windows 10 | Microsoft Learn Implement an Access Control List or Discretionary Access Control Lists to restrict the access or modification of Backup files and perform Restore operations to appropriate users, for example administrators only. Access Control overview | Microsoft Learn Discretionary Access Control Lists (DACL) Auditing sensitive privileges used to identify access, modification, or replacement of Backup related files could help indicate attempts to exploit this vulnerability. Audit Sensitive Privilege Use – Windows 10 | Microsoft Learn | 2024-08-08 | 7.3 | CVE-2024-38202 | [email protected] |
| MongoDB Inc–MongoDB Server | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue | 2024-08-07 | 7.3 | CVE-2024-7553 | [email protected] [email protected] [email protected] |
| Mozilla–Firefox for iOS | Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129. | 2024-08-06 | 9.8 | CVE-2024-43111 | [email protected] [email protected] |
| Mozilla–Firefox | Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 9.8 | CVE-2024-7521 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 9.1 | CVE-2024-7522 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 9.1 | CVE-2024-7525 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1. | 2024-08-06 | 9.8 | CVE-2024-7528 | [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129. | 2024-08-06 | 9.8 | CVE-2024-7530 | [email protected] [email protected] |
| Mozilla–Firefox | Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 8.8 | CVE-2024-7519 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1. | 2024-08-06 | 8.8 | CVE-2024-7520 | [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 8.8 | CVE-2024-7527 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 8.1 | CVE-2024-7529 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | ANGLE failed to initialize parameters which led to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. | 2024-08-06 | 7.5 | CVE-2024-7526 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| N/A — N/A | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 were discovered to contain a shell injection vulnerability via the interface check_config. | 2024-08-06 | 9.8 | CVE-2024-39228 | [email protected] [email protected] |
| N/A — N/A | A SQL injection vulnerability in /smsa/teacher_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the “username” parameter. | 2024-08-07 | 9.8 | CVE-2024-41237 | [email protected] [email protected] |
| N/A — N/A | D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service. | 2024-08-06 | 9.8 | CVE-2024-41616 | [email protected] [email protected] |
| N/A — N/A | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. | 2024-08-07 | 9.8 | CVE-2024-42005 | [email protected] [email protected] [email protected] |
| N/A — N/A | An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system. | 2024-08-07 | 7.8 | CVE-2024-41308 | [email protected] |
| N/A — N/A | An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system. | 2024-08-07 | 7.8 | CVE-2024-41309 | [email protected] |
| N/A — N/A | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. | 2024-08-07 | 7.5 | CVE-2024-41990 | [email protected] [email protected] [email protected] |
| N/A — N/A | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. | 2024-08-07 | 7.5 | CVE-2024-41991 | [email protected] [email protected] [email protected] |
| N/A — N/A | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. | 2024-08-07 | 7.8 | CVE-2024-43199 | [email protected] [email protected] [email protected] |
| n/a–DataGear | A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of special elements used in an expression language statement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273697 was assigned to this vulnerability. | 2024-08-06 | 8.8 | CVE-2024-7552 | [email protected] [email protected] [email protected] [email protected] |
| N/A–N/A | SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection. | 2024-08-07 | 9.8 | CVE-2024-34479 | [email protected] |
| N/A–N/A | SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view_category.php id SQL Injection. | 2024-08-07 | 9.8 | CVE-2024-34480 | [email protected] |
| N/A–N/A | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability. | 2024-08-06 | 9.8 | CVE-2024-39225 | [email protected] [email protected] |
| N/A–N/A | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data. | 2024-08-06 | 9.8 | CVE-2024-39226 | [email protected] [email protected] |
| N/A–N/A | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. | 2024-08-07 | 7.5 | CVE-2024-41989 | [email protected] [email protected] [email protected] |
| n/a–n/a | An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. | 2024-08-06 | 9.6 | CVE-2024-28739 | [email protected] |
| n/a–n/a | A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024. | 2024-08-06 | 9.1 | CVE-2024-33897 | [email protected] [email protected] [email protected] |
| n/a–n/a | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config. | 2024-08-06 | 9.8 | CVE-2024-39227 | [email protected] [email protected] |
| n/a–n/a | SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.php | 2024-08-05 | 9.8 | CVE-2024-40498 | [email protected] |
| n/a–n/a | Insecure Permissions vulnerability in UAB Lexita PanteraCRM CMS v.401.152 and Patera CRM CMS v.402.072 allows a remote attacker to execute arbitrary code via modification of the X-Forwarded-For header component. | 2024-08-05 | 9.8 | CVE-2024-40530 | [email protected] |
| n/a–n/a | An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version. | 2024-08-06 | 9.1 | CVE-2024-41270 | [email protected] |
| n/a–n/a | An issue in UAB Lexita PanteraCRM CMS v.401.152 and Patera CRM CMS v.402.072 allows a remote attacker to escalate privileges via the user profile management function. | 2024-08-05 | 8.8 | CVE-2024-40531 | [email protected] |
| n/a–n/a | A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. | 2024-08-06 | 8.8 | CVE-2024-41226 | [email protected] [email protected] |
| n/a–n/a | dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php. | 2024-08-05 | 8.8 | CVE-2024-41376 | [email protected] |
| n/a–n/a | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlinks during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system’s hard disk. | 2024-08-08 | 7.5 | CVE-2023-33206 | [email protected] [email protected] |
| n/a–n/a | PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later, | 2024-08-06 | 7.5 | CVE-2024-30170 | [email protected] [email protected] |
| n/a–n/a | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information. | 2024-08-05 | 7.5 | CVE-2024-42010 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| n/a–n/a | 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient. | 2024-08-06 | 7 | CVE-2024-42219 | [email protected] [email protected] |
| n/a–PostgreSQL | Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. | 2024-08-08 | 8.8 | CVE-2024-7348 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 |
| nuxt–icon | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at `/api/_nuxt_icon/[name]`. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure. The `new URL` constructor is used to parse the final path. This constructor can be passed a relative scheme or path in order to change the host the request is sent to. This constructor is also very tolerant of poorly formatted URLs. As a result we can pass a path prefixed with the string `http:`. This has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example `http:127.0.0.1:8080`. This would allow us to send requests to a local server. This issue has been addressed in release version 1.4.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 8.6 | CVE-2024-42352 | [email protected] |
| nuxt–nuxt | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. The `getTextAssetContent` function does not check for path traversals, this could allow an attacker to read arbitrary files over the RPC WebSocket. The WebSocket server does not check the origin of the request leading to cross-site-websocket-hijacking. This may be intentional to allow certain configurations to work correctly. Nuxt Devtools authentication tokens are placed within the home directory of the current user. The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the *authenticated* `writeStaticAssets` function to create a new Component, Nitro Handler or `app.vue` file which will run automatically as the file is changed. This vulnerability has been addressed in release version 1.3.9. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 8.8 | CVE-2024-23657 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| nuxt–nuxt | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts. | 2024-08-05 | 8.8 | CVE-2024-34344 | [email protected] |
| NVIDIA–GPU Display Driver, vGPU Software, Cloud Gaming | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. | 2024-08-08 | 7.8 | CVE-2024-0107 | [email protected] |
| NVIDIA–Mellanox OS | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to cause a failure by attacking the switch. A successful exploit of this vulnerability might lead to denial of service. | 2024-08-08 | 7.5 | CVE-2024-0101 | [email protected] |
| NVIDIA–NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 series, Jetson TX2 NX, Jetson TX1, Jetson Nano series | NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping attempt. A successful exploit of this vulnerability may lead to denial of service, code execution, and escalation of privileges. | 2024-08-08 | 8.7 | CVE-2024-0108 | [email protected] |
| Open WebUI–Open WebUI | Attacker controlled files can be uploaded to arbitrary locations on the web server’s filesystem by abusing a path traversal vulnerability. | 2024-08-07 | 8.8 | CVE-2024-6707 | bbf0bd87-ece2-41be-b873-96928ee8fab9 |
| Pimax–Pimax Play | Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker. | 2024-08-05 | 8.8 | CVE-2024-41889 | [email protected] [email protected] [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager. | 2024-08-05 | 8.4 | CVE-2024-21481 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU. | 2024-08-05 | 8.4 | CVE-2024-23381 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption while processing graphics kernel driver request to create DMA fence. | 2024-08-05 | 8.4 | CVE-2024-23382 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption when kernel driver attempts to trigger hardware fences. | 2024-08-05 | 8.4 | CVE-2024-23383 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker. | 2024-08-05 | 8.4 | CVE-2024-23384 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption while processing IOCTL call to set metainfo. | 2024-08-05 | 8.4 | CVE-2024-33021 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption while allocating memory in HGSL driver. | 2024-08-05 | 8.4 | CVE-2024-33022 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events. | 2024-08-05 | 8.4 | CVE-2024-33023 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table. | 2024-08-05 | 8.4 | CVE-2024-33027 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released. | 2024-08-05 | 8.4 | CVE-2024-33028 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time. | 2024-08-05 | 8.4 | CVE-2024-33034 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS during music playback of ALAC content. | 2024-08-05 | 7.5 | CVE-2024-21479 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA. | 2024-08-05 | 7.5 | CVE-2024-23352 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI. | 2024-08-05 | 7.5 | CVE-2024-23353 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption when keymaster operation imports a shared key. | 2024-08-05 | 7.8 | CVE-2024-23355 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Memory corruption during session sign renewal request calls in HLOS. | 2024-08-05 | 7.8 | CVE-2024-23356 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing fragments of MBSSID IE from beacon frame. | 2024-08-05 | 7.5 | CVE-2024-33010 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero. | 2024-08-05 | 7.5 | CVE-2024-33011 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon. | 2024-08-05 | 7.5 | CVE-2024-33012 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length. | 2024-08-05 | 7.5 | CVE-2024-33013 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing ESP IE from beacon/probe response frame. | 2024-08-05 | 7.5 | CVE-2024-33014 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report. | 2024-08-05 | 7.5 | CVE-2024-33015 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame. | 2024-08-05 | 7.5 | CVE-2024-33018 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing the received TID-to-link mapping action frame. | 2024-08-05 | 7.5 | CVE-2024-33019 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while processing TID-to-link mapping IE elements. | 2024-08-05 | 7.5 | CVE-2024-33020 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length. | 2024-08-05 | 7.5 | CVE-2024-33024 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. | 2024-08-05 | 7.5 | CVE-2024-33025 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp. | 2024-08-05 | 7.5 | CVE-2024-33026 | [email protected] |
| Raisecom–MSG1200 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpn_config_mod of the file /vpn/list_ip_network.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273560. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 9.8 | CVE-2024-7467 | [email protected] [email protected] [email protected] [email protected] |
| Raisecom–MSG1200 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpn_config_mod of the file /vpn/list_service_manage.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273561 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 9.8 | CVE-2024-7468 | [email protected] [email protected] [email protected] [email protected] |
| Raisecom-MSG1200 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been declared as critical. This vulnerability affects the function sslvpn_config_mod of the file /vpn/list_vpn_web_custom.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273562 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 9.8 | CVE-2024-7469 | [email protected] [email protected] [email protected] [email protected] |
| Raisecom-MSG1200 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the function sslvpn_config_mod of the file /vpn/vpn_template_style.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273563. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 9.8 | CVE-2024-7470 | [email protected] [email protected] [email protected] [email protected] |
| Red Hat–Red Hat Enterprise Linux 8 | A flaw was found in libnbd. The client did not always correctly verify the NBD server’s certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic. | 2024-08-05 | 7.4 | CVE-2024-7383 | [email protected] [email protected] [email protected] [email protected] |
| reputeinfosystems–Appointment Booking Calendar Plugin and Scheduling Plugin BookingPress | The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user’s identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user’s email. This is only exploitable when the ‘Auto login user after successful booking’ setting is enabled. | 2024-08-08 | 9.8 | CVE-2024-7350 | [email protected] [email protected] [email protected] |
| Ricoh Company, Ltd.–JavaTM Platform | Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the product may be affected by some known TLS1.0 and TLS1.1 vulnerabilities. As for the specific products/models/versions of MFPs and printers that contain JavaTM Platform, see the information provided by the vendor. | 2024-08-06 | 7.5 | CVE-2024-41995 | [email protected] [email protected] [email protected] |
| Samsung Mobile — Samsung Notes | Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code with Samsung Notes privilege. | 2024-08-07 | 7.8 | CVE-2024-34622 | [email protected] |
| Samsung Mobile — Samsung Notes | Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code with Samsung Notes privilege. | 2024-08-07 | 7.8 | CVE-2024-34623 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service. | 2024-08-07 | 8.4 | CVE-2024-34620 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. | 2024-08-07 | 7.3 | CVE-2024-34612 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. | 2024-08-07 | 7.3 | CVE-2024-34614 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability. | 2024-08-07 | 7.5 | CVE-2024-34619 | [email protected] |
| shahriar0822–The Next | The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the wpeden_post_meta post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. | 2024-08-08 | 8.8 | CVE-2024-7561 | [email protected] [email protected] |
| shopware–shopware | Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. | 2024-08-08 | 8.3 | CVE-2024-42355 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| shopware–shopware | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it’s possible to call from Twig any statically callable PHP function/method. It’s not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. | 2024-08-08 | 8.3 | CVE-2024-42356 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| shopware–shopware | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the `aggregations` object. The `name` field in this `aggregations` object is vulnerable SQL-injection and can be exploited using SQL parameters. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. | 2024-08-08 | 7.3 | CVE-2024-42357 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| Tenda–A301 | A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 9.8 | CVE-2024-7581 | [email protected] [email protected] [email protected] [email protected] |
| Tenda–i22 | A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function formApPortalAccessCodeAuth of the file /goform/apPortalAccessCodeAuth. The manipulation of the argument accessCode/data/acceInfo leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 9.8 | CVE-2024-7582 | [email protected] [email protected] [email protected] [email protected] |
| Tenda–i22 | A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the function formApPortalOneKeyAuth of the file /goform/apPortalOneKeyAuth. The manipulation of the argument data leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 9.8 | CVE-2024-7583 | [email protected] [email protected] [email protected] [email protected] |
| Tenda–i22 | A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formApPortalPhoneAuth of the file /goform/apPortalPhoneAuth. The manipulation of the argument data leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 8.8 | CVE-2024-7584 | [email protected] [email protected] [email protected] [email protected] |
| Tenda–i22 | A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the file /goform/apPortalAuth. The manipulation of the argument webUserName/webUserPassword leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 8.8 | CVE-2024-7585 | [email protected] [email protected] [email protected] [email protected] |
| The Document Foundation–LibreOffice | Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway. This issue affects LibreOffice: from 24.2 before 24.2.5. | 2024-08-05 | 7.8 | CVE-2024-6472 | [email protected] |
| thimpress–LearnPress WordPress LMS Plugin | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-08-08 | 8.8 | CVE-2024-7548 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| TOTOLINK–CP450 | A vulnerability, which was classified as critical, was found in TOTOLINK CP450 4.1.0cu.747_B20191224. Affected is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273558 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 8.8 | CVE-2024-7465 | [email protected] [email protected] [email protected] [email protected] |
| TOTOLINK–CP900 | A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273556. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 8.8 | CVE-2024-7463 | [email protected] [email protected] [email protected] [email protected] |
| TOTOLINK–N350RT | A vulnerability classified as critical has been found in TOTOLINK N350RT 9.3.5u.6139_B20201216. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273555. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 8.8 | CVE-2024-7462 | [email protected] [email protected] [email protected] [email protected] |
| unitecms–Blox Page Builder | The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘handleUploadFile’ function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site’s server which may make remote code execution possible. | 2024-08-06 | 8.8 | CVE-2024-6315 | [email protected] [email protected] |
| Unknown–Himer | The lacks CSRF checks allowing a user to invite any user to any group (including private groups) | 2024-08-05 | 8.1 | CVE-2024-2232 | [email protected] |
| Unknown–Product | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks | 2024-08-06 | 8.8 | CVE-2024-6720 | [email protected] |
| Vonets–VAR1200-H | Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and WiFi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication using hard-coded administrator credentials. These accounts cannot be disabled. | 2024-08-08 | 7.5 | CVE-2024-41161 | [email protected] |
| vrcx-team–VRCX | VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC’s API side. Users who use the older version of VRCX must update their installation to continue using VRCX. | 2024-08-08 | 9 | CVE-2024-42366 | [email protected] [email protected] |
| Webnus–Modern Events Calendar | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the ‘mec_fes_form’ AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. | 2024-08-07 | 8.5 | CVE-2024-6522 | [email protected] [email protected] [email protected] [email protected] |
| wpbakery–WPBakery Visual Composer | The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the ‘layout_name’ parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. | 2024-08-06 | 8.8 | CVE-2024-5709 | [email protected] [email protected] |
| Zscaler–Client Connector | An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2. | 2024-08-06 | 9.8 | CVE-2024-23483 | [email protected] |
| Zscaler–Client Connector | Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled. | 2024-08-06 | 7.5 | CVE-2024-23456 | [email protected] |
| Zscaler–Client Connector | While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190. | 2024-08-06 | 7.8 | CVE-2024-23458 | [email protected] |
| Zscaler–Client Connector | The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2. | 2024-08-06 | 7.8 | CVE-2024-23460 | [email protected] |
| ZTE–ZXV10 XT802 | There is a permission and access control vulnerability of ZTE’s ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords. | 2024-08-08 | 7.1 | CVE-2024-22069 | [email protected] |
Medium Vulnerabilities
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info | Patch Info |
|---|---|---|---|---|---|
| Alien Technology–ALR-F800 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-07 | 6.3 | CVE-2024-7579 | [email protected] [email protected] [email protected] [email protected] |
| AMD–3rd Gen AMD EPYC Processors | Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest’s UMC seed potentially allowing reading of memory from a decommissioned guest. | 2024-08-05 | 6 | CVE-2023-31355 | [email protected] |
| AMD–3rd Gen AMD EPYC Processors | Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption. | 2024-08-05 | 6 | CVE-2024-21978 | [email protected] |
| ameliabooking–Booking for Appointments and Events Calendar Amelia | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. | 2024-08-08 | 5.3 | CVE-2024-6552 | [email protected] [email protected] [email protected] |
| Avaya–Aura System Manager | A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support. | 2024-08-08 | 6.5 | CVE-2024-7477 | [email protected] |
| Avaya–Aura System Manager | An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitrary files on the system. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support. | 2024-08-08 | 4.2 | CVE-2024-7480 | [email protected] |
| bradvin–Lightbox & Modal Popup WordPress Plugin FooBox | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 2.7.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-08-08 | 6.4 | CVE-2024-5668 | [email protected] [email protected] |
| Calibre–Calibre | Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. | 2024-08-06 | 5.4 | CVE-2024-7008 | [email protected] [email protected] |
| Calibre–Calibre | Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. | 2024-08-06 | 4.2 | CVE-2024-7009 | [email protected] [email protected] |
| Cisco–Cisco Adaptive Security Appliance (ASA) Software | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device. | 2024-08-07 | 5.4 | CVE-2024-20443 | [email protected] |
| Cisco–Cisco Identity Services Engine Software | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have Admin privileges on an affected device. | 2024-08-07 | 4.8 | CVE-2024-20479 | [email protected] |
| daniyalahmedk–Fuse Social Floating Sidebar | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and including, 5.4.10 due to insufficient validation of SVG files. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-08-08 | 6.4 | CVE-2024-5226 | [email protected] [email protected] [email protected] [email protected] |
| Dell–Dell Update (DU) | Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. | 2024-08-06 | 6.5 | CVE-2024-28962 | [email protected] |
| Dorsett Controls–InfoScan | Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. | 2024-08-08 | 5.3 | CVE-2024-39287 | [email protected] [email protected] |
| Dorsett Controls–InfoScan | The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure. | 2024-08-08 | 5.3 | CVE-2024-42408 | [email protected] [email protected] |
| Dorsett Controls–InfoScan | Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login. | 2024-08-08 | 5.3 | CVE-2024-42493 | [email protected] [email protected] |
| galdub–Folders Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | 2024-08-06 | 6.4 | CVE-2024-7317 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| GitLab–GitLab | ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking. | 2024-08-08 | 6.5 | CVE-2024-2800 | [email protected] [email protected] |
| GitLab–GitLab | A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories. | 2024-08-08 | 6.8 | CVE-2024-3035 | [email protected] [email protected] |
| GitLab–GitLab | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc files. | 2024-08-08 | 6.5 | CVE-2024-4210 | [email protected] [email protected] |
| GitLab–GitLab | Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline. | 2024-08-08 | 6.5 | CVE-2024-5423 | [email protected] [email protected] |
| GitLab–GitLab | An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. | 2024-08-08 | 5.3 | CVE-2024-3958 | [email protected] [email protected] |
| GitLab–GitLab | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded. | 2024-08-08 | 5.7 | CVE-2024-6329 | [email protected] [email protected] |
| GitLab–GitLab | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server. | 2024-08-08 | 4.3 | CVE-2024-3114 | [email protected] [email protected] |
| GitLab–GitLab | A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances. | 2024-08-08 | 4.4 | CVE-2024-4207 | [email protected] [email protected] |
| GitLab–GitLab | An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy. | 2024-08-08 | 4.2 | CVE-2024-4784 | [email protected] [email protected] |
| GitLab–GitLab | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specific manner. | 2024-08-08 | 4.9 | CVE-2024-7554 | [email protected] |
| GitLab–GitLab | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch. | 2024-08-08 | 4.3 | CVE-2024-7610 | [email protected] |
| Google–Chrome | Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 4.7 | CVE-2024-6995 | [email protected] [email protected] |
| Google–Chrome | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 4.3 | CVE-2024-6999 | [email protected] [email protected] |
| Google–Chrome | Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 4.3 | CVE-2024-7001 | [email protected] [email protected] |
| Google–Chrome | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low) | 2024-08-06 | 4.3 | CVE-2024-7004 | [email protected] [email protected] |
| Google–Chrome | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low) | 2024-08-06 | 4.3 | CVE-2024-7005 | [email protected] [email protected] |
| Google-Chrome | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 2024-08-06 | 4.3 | CVE-2024-7003 | [email protected] [email protected] |
| Halo Service Solutions–HaloITSM | HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability. | 2024-08-06 | 5.3 | CVE-2024-6201 | [email protected] |
| Hewlett Packard Enterprise (HPE)–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. | 2024-08-06 | 5.3 | CVE-2024-42396 | [email protected] |
| Hewlett Packard Enterprise (HPE)–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. | 2024-08-06 | 5.3 | CVE-2024-42397 | [email protected] |
| Hewlett Packard Enterprise–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. | 2024-08-06 | 5.3 | CVE-2024-42398 | [email protected] |
| Hewlett Packard Enterprise–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. | 2024-08-06 | 5.3 | CVE-2024-42399 | [email protected] |
| Hewlett Packard Enterprise–HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. | 2024-08-06 | 5.3 | CVE-2024-42400 | [email protected] |
| Hitachi–Hitachi Device Manager | Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before 8.8.7-00. | 2024-08-06 | 6.7 | CVE-2024-5963 | [email protected] |
| Huawei–HarmonyOS | Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-08-08 | 6.2 | CVE-2024-42030 | [email protected] |
| Huawei–HarmonyOS | Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity and confidentiality. | 2024-08-08 | 6.9 | CVE-2024-42033 | [email protected] |
| Huawei–HarmonyOS | LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-08-08 | 6.6 | CVE-2024-42034 | [email protected] |
| Huawei–HarmonyOS | Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability | 2024-08-08 | 4 | CVE-2023-7265 | [email protected] |
| Huawei–HarmonyOS | Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-08-08 | 4.4 | CVE-2024-42032 | [email protected] |
| IBM–InfoSphere Information Server | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 297429 | 2024-08-06 | 4.3 | CVE-2024-39751 | [email protected] [email protected] |
| itsourcecode–Airline Reservation System | A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273622 is the identifier assigned to this vulnerability. | 2024-08-06 | 6.3 | CVE-2024-7496 | [email protected] [email protected] [email protected] [email protected] |
| itsourcecode–Airline Reservation System | A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273623. | 2024-08-06 | 6.3 | CVE-2024-7497 | [email protected] [email protected] [email protected] [email protected] |
| itsourcecode–Airline Reservation System | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file flights.php. The manipulation of the argument departure_airport_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273625 was assigned to this vulnerability. | 2024-08-06 | 6.3 | CVE-2024-7499 | [email protected] [email protected] [email protected] [email protected] |
| itsourcecode–Airline Reservation System | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function save_settings of the file admin/admin_class.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273626 is the identifier assigned to this vulnerability. | 2024-08-06 | 6.3 | CVE-2024-7500 | [email protected] [email protected] [email protected] [email protected] |
| itsourcecode–Laravel Accounting System | A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273621 was assigned to this vulnerability. | 2024-08-06 | 6.3 | CVE-2024-7495 | [email protected] [email protected] [email protected] [email protected] |
| itsourcecode–Tailoring Management System | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /setlogo.php. The manipulation of the argument bgimg leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273649 was assigned to this vulnerability. | 2024-08-06 | 6.3 | CVE-2024-7506 | [email protected] [email protected] [email protected] [email protected] |
| Journyx–Journyx (jtime) | Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application. | 2024-08-08 | 6.1 | CVE-2024-6892 | bbf0bd87-ece2-41be-b873-96928ee8fab9 |
| kubean-io–kubean | Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean’s deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 6 | CVE-2024-41820 | [email protected] [email protected] [email protected] |
| leap13–Premium Addons for Elementor | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘check_temp_validity’ and ‘update_template_title’ functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles. | 2024-08-08 | 4.3 | CVE-2024-6824 | [email protected] [email protected] [email protected] [email protected] |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: if (max_size < PAGE_SIZE) max_size = PAGE_SIZE; whereas: blk_validate_limits() makes it an error: if (WARN_ON_ONCE(lim->max_segment_size < PAGE_SIZE)) return -EINVAL; The change from one to the other, exposed sdhci which was setting maximum segment size too low in some circumstances. Fix the maximum segment size when it is too low. | 2024-08-07 | 5.5 | CVE-2024-42242 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn’t be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs — __close_session() doesn’t mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e (“libceph: behave in mon_fault() if cur_mon < 0”) and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused. To fix this: – clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop() – bail from delayed_work() if monc->cur_mon is cleared, similar to how it’s done in mon_fault() and finish_hunting() (based on monc->hunting) – call cancel_delayed_work_sync() after the session is closed | 2024-08-07 | 5.5 | CVE-2024-42232 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I’ve been seeing elusive “Bad page state”s (often on flags when freeing, yet the flags shown are not bad: PG_locked had been set and cleared??), and VM_BUG_ON_PAGE(page_ref_count(page) == 0)s from deferred_split_scan()’s folio_put(), and a variety of other BUG and WARN symptoms implying double free by deferred split and large folio migration. 6.7 commit 9bcef5973e31 (“mm: memcg: fix split queue list crash when large folio migration”) was right to fix the memcg-dependent locking broken in 85ce2c517ade (“memcontrol: only transfer the memcg data for migration”), but missed a subtlety of deferred_split_scan(): it moves folios to its own local list to work on them without split_queue_lock, during which time folio->_deferred_list is not empty, but even the “right” lock does nothing to secure the folio and the list it is on. Fortunately, deferred_split_scan() is careful to use folio_try_get(): so folio_migrate_mapping() can avoid the race by folio_undo_large_rmappable() while the old folio’s reference count is temporarily frozen to 0 – adding such a freeze in the !mapping case too (originally, folio lock and unmapping and no swap cache left an anon folio unreachable, so no freezing was needed there: but the deferred split queue offers a way to reach it). | 2024-08-07 | 5.5 | CVE-2024-42234 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() used to work with NULL pointers before the conversion to ptdescs. Since crst_table_free() can be called with a NULL pointer (error handling in crst_table_upgrade() add an explicit check. Also add the same check to base_crst_free() for consistency reasons. In real life this should not happen, since order two GFP_KERNEL allocations will not fail, unless FAIL_PAGE_ALLOC is enabled and used. | 2024-08-07 | 5.5 | CVE-2024-42235 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string ‘s’ could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 – 1] == ‘\n’) followed closely by an OOB write in the form `str[0 – 1] = ‘\0’`. There is already a validating check to catch strings that are too long. Let’s supply an additional check for invalid strings that are too short. | 2024-08-07 | 5.5 | CVE-2024-42236 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load() to be done before the block is processed. The check that the length of a block payload does not exceed the number of remaining bytes in the firwmware file buffer was being done near the end of the loop iteration. However, some code before that check used the length field without validating it. | 2024-08-07 | 5.5 | CVE-2024-42237 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp_power_up() if a block header is longer than the amount of data left in the file. The previous code in cs_dsp_load() and cs_dsp_load_coeff() would loop while there was enough data left in the file for a valid region. This protected against overrunning the end of the file data, but it didn’t abort the file processing with an error. | 2024-08-07 | 5.5 | CVE-2024-42238 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: bpf: Fail bpf_timer_cancel when callback is being cancelled Given a schedule: timer1 cb timer2 cb bpf_timer_cancel(timer2); bpf_timer_cancel(timer1); Both bpf_timer_cancel calls would wait for the other callback to finish executing, introducing a lockup. Add an atomic_t count named ‘cancelling’ in bpf_hrtimer. This keeps track of all in-flight cancellation requests for a given BPF timer. Whenever cancelling a BPF timer, we must check if we have outstanding cancellation requests, and if so, we must fail the operation with an error (-EDEADLK) since cancellation is synchronous and waits for the callback to finish executing. This implies that we can enter a deadlock situation involving two or more timer callbacks executing in parallel and attempting to cancel one another. Note that we avoid incrementing the cancelling counter for the target timer (the one being cancelled) if bpf_timer_cancel is not invoked from a callback, to avoid spurious errors. The whole point of detecting cur->cancelling and returning -EDEADLK is to not enter a busy wait loop (which may or may not lead to a lockup). This does not apply in case the caller is in a non-callback context, the other side can continue to cancel as it sees fit without running into errors. Background on prior attempts: Earlier versions of this patch used a bool ‘cancelling’ bit and used the following pattern under timer->lock to publish cancellation status. lock(t->lock); t->cancelling = true; mb(); if (cur->cancelling) return -EDEADLK; unlock(t->lock); hrtimer_cancel(t->timer); t->cancelling = false; The store outside the critical section could overwrite a parallel requests t->cancelling assignment to true, to ensure the parallely executing callback observes its cancellation status. It would be necessary to clear this cancelling bit once hrtimer_cancel is done, but lack of serialization introduced races. Another option was explored where bpf_timer_start would clear the bit when (re)starting the timer under timer->lock. This would ensure serialized access to the cancelling bit, but may allow it to be cleared before in-flight hrtimer_cancel has finished executing, such that lockups can occur again. Thus, we choose an atomic counter to keep track of all outstanding cancellation requests and use it to prevent lockups in case callbacks attempt to cancel each other while executing in parallel. | 2024-08-07 | 5.5 | CVE-2024-42239 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the clear_bhb_loop() before the TF flag is cleared. This causes the #DB handler (exc_debug_kernel()) to issue a warning because single-step is used outside the entry_SYSENTER_compat() function. To address this issue, entry_SYSENTER_compat() should use CLEAR_BRANCH_HISTORY after making sure the TF flag is cleared. The problem can be reproduced with the following sequence: $ cat sysenter_step.c int main() { asm(“pushf; pop %ax; bts $8,%ax; push %ax; popf; sysenter”); } $ gcc -o sysenter_step sysenter_step.c $ ./sysenter_step Segmentation fault (core dumped) The program is expected to crash, and the #DB handler will issue a warning. Kernel log: WARNING: CPU: 27 PID: 7000 at arch/x86/kernel/traps.c:1009 exc_debug_kernel+0xd2/0x160 … RIP: 0010:exc_debug_kernel+0xd2/0x160 … Call Trace: <#DB> ? show_regs+0x68/0x80 ? __warn+0x8c/0x140 ? exc_debug_kernel+0xd2/0x160 ? report_bug+0x175/0x1a0 ? handle_bug+0x44/0x90 ? exc_invalid_op+0x1c/0x70 ? asm_exc_invalid_op+0x1f/0x30 ? exc_debug_kernel+0xd2/0x160 exc_debug+0x43/0x50 asm_exc_debug+0x1e/0x40 RIP: 0010:clear_bhb_loop+0x0/0xb0 … </#DB> <TASK> ? entry_SYSENTER_compat_after_hwframe+0x6e/0x8d </TASK> [ bp: Massage commit message. ] | 2024-08-07 | 5.5 | CVE-2024-42240 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it’s possible that PMD-sized page cache can’t be supported by xarray. For example, 512MB page cache on ARM64 when the base page size is 64KB can’t be supported by xarray. It leads to errors as the following messages indicate when this sort of xarray entry is split. WARNING: CPU: 34 PID: 7578 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 \ nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject \ nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse xfs \ libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_net \ net_failover virtio_console virtio_blk failover dimlib virtio_mmio CPU: 34 PID: 7578 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #9 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=–) pc : xas_split_alloc+0xf8/0x128 lr : split_huge_page_to_list_to_order+0x1c4/0x720 sp : ffff8000882af5f0 x29: ffff8000882af5f0 x28: ffff8000882af650 x27: ffff8000882af768 x26: 0000000000000cc0 x25: 000000000000000d x24: ffff00010625b858 x23: ffff8000882af650 x22: ffffffdfc0900000 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffdfc0900000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000018000000000 x15: 52f8004000000000 x14: 0000e00000000000 x13: 0000000000002000 x12: 0000000000000020 x11: 52f8000000000000 x10: 52f8e1c0ffff6000 x9 : ffffbeb9619a681c x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff00010b02ddb0 x5 : ffffbeb96395e378 x4 : 0000000000000000 x3 : 0000000000000cc0 x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000 Call trace: xas_split_alloc+0xf8/0x128 split_huge_page_to_list_to_order+0x1c4/0x720 truncate_inode_partial_folio+0xdc/0x160 shmem_undo_range+0x2bc/0x6a8 shmem_fallocate+0x134/0x430 vfs_fallocate+0x124/0x2e8 ksys_fallocate+0x4c/0xa0 __arm64_sys_fallocate+0x24/0x38 invoke_syscall.constprop.0+0x7c/0xd8 do_el0_svc+0xb4/0xd0 el0_svc+0x44/0x1d8 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Fix it by disabling PMD-sized page cache when HPAGE_PMD_ORDER is larger than MAX_PAGECACHE_ORDER. As Matthew Wilcox pointed, the page cache in a shmem file isn’t represented by a multi-index entry and doesn’t have this limitation when the xarry entry is split until commit 6b24ca4a1a8d (“mm: Use multi-index entries in the page cache”). | 2024-08-07 | 5.5 | CVE-2024-42241 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series “mm/filemap: Limit page cache size to that supported by xarray”, v2. Currently, xarray can’t support arbitrary page cache size. More details can be found from the WARN_ON() statement in xas_split_alloc(). In our test whose code is attached below, we hit the WARN_ON() on ARM64 system where the base page size is 64KB and huge page size is 512MB. The issue was reported long time ago and some discussions on it can be found here [1]. [1] https://www.spinics.net/lists/linux-xfs/msg75404.html In order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one supported by xarray and avoid PMD-sized page cache if needed. The code changes are suggested by David Hildenbrand. PATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray PATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path PATCH[4] avoids PMD-sized page cache for shmem files if needed Test program ============ # cat test.c #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <fcntl.h> #include <errno.h> #include <sys/syscall.h> #include <sys/mman.h> #define TEST_XFS_FILENAME “/tmp/data” #define TEST_SHMEM_FILENAME “/dev/shm/data” #define TEST_MEM_SIZE 0x20000000 int main(int argc, char **argv) { const char *filename; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret; if (pgsize != 0x10000) { fprintf(stderr, “64KB base page size is required\n”); return -EPERM; } system(“echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled”); system(“rm -fr /tmp/data”); system(“rm -fr /dev/shm/data”); system(“echo 1 > /proc/sys/vm/drop_caches”); /* Open xfs or shmem file */ filename = TEST_XFS_FILENAME; if (argc > 1 && !strcmp(argv[1], “shmem”)) filename = TEST_SHMEM_FILENAME; fd = open(filename, O_CREAT | O_RDWR | O_TRUNC); if (fd < 0) { fprintf(stderr, “Unable to open <%s>\n”, filename); return -EIO; } /* Extend file size */ ret = ftruncate(fd, TEST_MEM_SIZE); if (ret) { fprintf(stderr, “Error %d to ftruncate()\n”, ret); goto cleanup; } /* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (buf == (void *)-1) { fprintf(stderr, “Unable to mmap <%s>\n”, filename); goto cleanup; } fprintf(stdout, “mapped buffer at 0x%p\n”, buf); ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); if (ret) { fprintf(stderr, “Unable to madvise(MADV_HUGEPAGE)\n”); goto cleanup; } /* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE); if (ret) { fprintf(stderr, “Error %d to madvise(MADV_POPULATE_WRITE)\n”, ret); goto cleanup; } /* Punch the file to enforce xarray split */ ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE – pgsize, pgsize); if (ret) fprintf(stderr, “Error %d to fallocate()\n”, ret); cleanup: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd); return 0; } # gcc test.c -o test # cat /proc/1/smaps | grep KernelPageSize | head -n 1 KernelPageSize: 64 kB # ./test shmem : ————[ cut here ]———— WARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon \ drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 \ virtio_net sha1_ce net_failover failover virtio_console virtio_blk \ dimlib virtio_mmio CPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TC —truncated— | 2024-08-07 | 5.5 | CVE-2024-42243 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 (“USB: serial: use generic method if no alternative is provided in usb serial layer”), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ] | 2024-08-07 | 5.5 | CVE-2024-42244 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: Revert “sched/fair: Make sure to try to detach at least one movable task” This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignore env.max_loop if all tasks examined to that point were pinned. The goal of the patch was to make it more likely to be able to detach a task buried in a long list of pinned tasks. However, this has the unfortunate side effect of creating an O(n) iteration in detach_tasks(), as we now must fully iterate every task on a cpu if all or most are pinned. Since this load balance code is done with rq lock held, and often in softirq context, it is very easy to trigger hard lockups. We observed such hard lockups with a user who affined O(10k) threads to a single cpu. When I discussed this with Vincent he initially suggested that we keep the limit on the number of tasks to detach, but increase the number of tasks we can search. However, after some back and forth on the mailing list, he recommended we instead revert the original patch, as it seems likely no one was actually getting hit by the original issue. | 2024-08-07 | 5.5 | CVE-2024-42245 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing the kernel to potentially freeze up. Neil suggested: This will propagate -EPERM up into other layers which might not be ready to handle it. It might be safer to map EPERM to an error we would be more likely to expect from the network system – such as ECONNREFUSED or ENETDOWN. ECONNREFUSED as error seems reasonable. For programs setting a different error can be out of reach (see handling in 4fbac77d2d09) in particular on kernels which do not have f10d05966196 (“bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean”), thus given that it is better to simply remap for consistent behavior. UDP does handle EPERM in xs_udp_send_request(). | 2024-08-07 | 5.5 | CVE-2024-42246 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the kernel issues kernel warnings because swap_endian() tries to load a 128-bit IPv6 address from an unaligned memory location: Kernel: unaligned access to 0x55f4688c in wg_allowedips_insert_v6+0x2c/0x80 [wireguard] (iir 0xf3010df) Kernel: unaligned access to 0x55f46884 in wg_allowedips_insert_v6+0x38/0x80 [wireguard] (iir 0xf2010dc) Avoid such unaligned memory accesses by instead using the get_unaligned_be64() helper macro. [Jason: replace src[8] in original patch with src+8] | 2024-08-07 | 5.5 | CVE-2024-42247 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for of_node The pdev->dev.of_node can be NULL if the “serial” node is absent. Add a NULL check to return an error in such cases. | 2024-08-07 | 5.5 | CVE-2024-42248 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll routine when iterating xarray, otherwise: Even with RCU read lock held, only the slot of the radix tree is ensured to be pinned there, while the data structure (e.g. struct cachefiles_req) stored in the slot has no such guarantee. The poll routine will iterate the radix tree and dereference cachefiles_req accordingly. Thus RCU read lock is not adequate in this case and spinlock is needed here. | 2024-08-07 | 5.5 | CVE-2024-42250 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Logsign–Unifed SecOPS Platform | Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_response_json_result endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-24680. | 2024-08-06 | 6.5 | CVE-2024-7564 | [email protected] |
| mailcow–mailcow-dockerized | mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized access to other accounts that are otherwise secured with 2FA. To exploit this vulnerability, the attacker must first have access to an account within the system and possess the credentials of the target account that has 2FA enabled. By leveraging these credentials, the attacker can circumvent the 2FA process and gain access to the protected account. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 6.6 | CVE-2024-41958 | [email protected] [email protected] |
| michaelrsweet–pdfio | PDFio is a simple C library for reading and writing PDF files. There is a denial of service (DOS) vulnerability in the TTF parser. Maliciously crafted TTF files can cause the program to utilize 100% of the Memory and enter an infinite loop. This can also lead to a heap-buffer-overflow vulnerability. An infinite loop occurs in the read_camp function by nGroups value. The ttf.h library is vulnerable. A value called nGroups is extracted from the file, and by changing that value, you can cause the program to utilize 100% of the Memory and enter an infinite loop. If the value of nGroups in the file is small, an infinite loop will not occur. This library, whether used as a standalone binary or as part of another application, is vulnerable to DOS attacks when parsing certain types of files. Automated systems, including web servers that use this code to convert PDF submissions into plaintext, can be DOSed if an attacker uploads a malicious TTF file. This issue has been addressed in release version 1.3.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-06 | 6.2 | CVE-2024-42358 | [email protected] [email protected] |
| Microsoft–Windows 10 Version 1809 | Summary: Microsoft was notified that an elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS) including a subset of Azure Virtual Machine SKUS; enabling an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn.. Microsoft is developing a security update to mitigate this vulnerability, but it is not yet available. Guidance to help customers reduce the risks associated with this vulnerability and to protect their systems until the mitigation is available in a Windows security update is provided in the Recommended Actions section of this CVE. This CVE will be updated when the mitigation is available in a Windows security update. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert when this update occurs. Details: A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 , and a subset of Azure Virtual Machines (VM) SKUs with a Windows based guestOS supporting VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn. The vulnerability enables an attacker with administrator privileges on the target system to replace current Windows system files with outdated versions. Successful exploitation provides an attacker with the ability to reintroduce previously mitigated vulnerabilities, circumvent VBS security features, and exfiltrate data protected by VBS. Microsoft is developing a security update that will revoke outdated, unpatched VBS system files to mitigate this vulnerability, but it is not yet available. Due to the complexity of blocking such a large quantity of files, rigorous testing is required to avoid integration failures or regressions. This CVE will be updated with new information and links to the security updates once available. We highly encourage customers subscribe to Security Update Guide notifications to be alerted of updates. See Microsoft Technical Security Notifications and Security Update Guide Notification System News: Create your profile now – Microsoft Security Response Center. Microsoft is not aware of any attempts to exploit this vulnerability. However, a public presentation regarding this vulnerability was hosted at BlackHat on August 07th, 2024. The presentation was appropriately coordinated with Microsoft but may change the threat landscape. Customers concerned with these risks should reference the guidance provided in the Recommended Actions section of this CVE to protect their systems. Recommended Actions: The following recommendations do not mitigate the vulnerability but can be used to reduce the risk of exploitation until the security update is available. Configure “Audit Object Access” settings to monitor attempts to access files, such as handle creation, read / write operations, or modifications to security descriptors. Audit File System – Windows 10 | Microsoft Learn Apply a basic audit policy on a file or folder – Windows 10 | Microsoft Learn Auditing sensitive privileges used to identify access, modification, or replacement of VBS related files could help indicacte attempts to exploit this vulnerability. Audit Sensitive Privilege Use – Windows 10 | Microsoft Learn Protect your Azure tenant by investigating administrators and users flagged for risky sign-ins and rotating their credentials. Investigate risk Microsoft Entra ID Protection – Microsoft Entra ID Protection | Microsoft Learn Enabling Multi-Factor Authentication can also help alleviate concerns about compromised accounts or exposure. Enforce multifactor… | 2024-08-08 | 6.7 | CVE-2024-21302 | [email protected] |
| N/A — N/A | A Reflected Cross Site Scripting (XSS) vulnerability was found in ” /smsa/teacher_login.php” in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via the “error” parameter. | 2024-08-07 | 6.1 | CVE-2024-41240 | [email protected] |
| N/A — N/A | A Reflected Cross Site Scripting (XSS) vulnerability was found in ” /smsa/admin_login.php” in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via “error” parameter. | 2024-08-07 | 6.1 | CVE-2024-41241 | [email protected] |
| N/A — N/A | A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via “error” parameter. | 2024-08-07 | 6.1 | CVE-2024-41242 | [email protected] [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve Teacher registration. | 2024-08-07 | 6.5 | CVE-2024-41251 | [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve student registration. | 2024-08-07 | 6.5 | CVE-2024-41252 | [email protected] [email protected] |
| N/A — N/A | A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user’s browser via injecting a crafted payload into the uname parameter. | 2024-08-06 | 6.1 | CVE-2024-41333 | [email protected] [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view MARKS details. | 2024-08-07 | 5.3 | CVE-2024-41243 | [email protected] [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view CLASS details. | 2024-08-07 | 5.3 | CVE-2024-41244 | [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view TEACHER details. | 2024-08-07 | 5.3 | CVE-2024-41245 | [email protected] [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view administrator dashboard. | 2024-08-07 | 5.3 | CVE-2024-41246 | [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new class entry. | 2024-08-07 | 5.3 | CVE-2024-41247 | [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new subject entry. | 2024-08-07 | 5.3 | CVE-2024-41248 | [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view SUBJECT details. | 2024-08-07 | 5.3 | CVE-2024-41249 | [email protected] |
| N/A — N/A | An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view STUDENT details. | 2024-08-07 | 5.3 | CVE-2024-41250 | [email protected] |
| N/A — N/A | An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged ‘X-Forwarded’ or ‘Client-IP’ header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addresses that have logged into user accounts, etc. | 2024-08-07 | 5.3 | CVE-2024-41432 | [email protected] |
| N/A — N/A | A Stored Cross Site Scripting (XSS) vulnerability was found in “/smsa/add_class_submit.php” in Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via “class_name” parameter field. | 2024-08-07 | 4.8 | CVE-2024-41239 | [email protected] [email protected] |
| n/a–FFmpeg | A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651. | 2024-08-06 | 6.3 | CVE-2024-7055 | [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
| n/a–n/a | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR4 fails to validate /etc/initab during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system’s hard disk. | 2024-08-08 | 6.8 | CVE-2023-24064 | [email protected] [email protected] |
| n/a–n/a | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system’s hard disk. | 2024-08-08 | 6.6 | CVE-2023-28865 | [email protected] [email protected] |
| n/a–n/a | ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability. | 2024-08-06 | 6.1 | CVE-2023-40819 | [email protected] [email protected] |
| n/a–n/a | An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafted modification of server configuration. | 2024-08-08 | 6.3 | CVE-2024-37382 | [email protected] |
| n/a–n/a | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php. | 2024-08-05 | 6.1 | CVE-2024-41380 | [email protected] |
| n/a–n/a | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php. | 2024-08-05 | 6.1 | CVE-2024-41381 | [email protected] |
| n/a–n/a | 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms. | 2024-08-06 | 6.3 | CVE-2024-42218 | [email protected] [email protected] |
| n/a–n/a | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR03 fails to validate file attributes during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system’s hard disk. | 2024-08-08 | 4.6 | CVE-2023-40261 | [email protected] [email protected] |
| n/a–n/a | A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the “username” parameter. | 2024-08-08 | 4.3 | CVE-2024-41238 | [email protected] [email protected] |
| n/a–PMWef | A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Application Firewall. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273559. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 5.4 | CVE-2024-7466 | [email protected] [email protected] [email protected] [email protected] |
| nuxt–nuxt | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The `navigateTo` function attempts to blockthe `javascript:` protocol, but does not correctly use API’s provided by `unjs/ufo`. This library also contains parsing discrepancies. The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a javascript: protocol. After this, the URL is parsed using the parseURL function. This function will refuse to parse poorly formatted URLs. Parsing javascript:alert(1) returns null/”” for all values. Next, the protocol of the URL is then checked using the isScriptProtocol function. This function simply checks the input against a list of protocols, and does not perform any parsing. The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the parseURL implementation, bypassing the isScriptProtocol checks. Certain special protocols are identified at the top of parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks. This ONLY has impact after SSR has occured, the `javascript:` protocol within a location header does not trigger XSS. This issue has been addressed in release version 3.12.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 6.3 | CVE-2024-34343 | [email protected] |
| NVIDIA–Mellanox OS | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and escalation of privileges. | 2024-08-08 | 4.2 | CVE-2024-0104 | [email protected] |
| Okta–Okta Verify for Windows | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater. | 2024-08-07 | 5.5 | CVE-2024-7061 | [email protected] [email protected] |
| Open WebUI–Open WebUI | Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. | 2024-08-07 | 6.1 | CVE-2024-6706 | bbf0bd87-ece2-41be-b873-96928ee8fab9 |
| OpenText–ArcSight Intelligence | Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence. | 2024-08-06 | 6.3 | CVE-2024-6357 | [email protected] |
| OpenText–ArcSight Intelligence | Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence. | 2024-08-06 | 6.3 | CVE-2024-6358 | [email protected] |
| OpenText–ArcSight Intelligence | Privilege escalation vulnerability identified in OpenText ArcSight Intelligence. | 2024-08-06 | 6.4 | CVE-2024-6359 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Information disclosure while handling beacon or probe response frame in STA. | 2024-08-05 | 6.5 | CVE-2024-21459 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Information disclosure while handling beacon probe frame during scan entry generation in client side. | 2024-08-05 | 6.5 | CVE-2024-21467 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network. | 2024-08-05 | 6.5 | CVE-2024-23350 | [email protected] |
| Qualcomm, Inc.–Snapdragon | Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus. | 2024-08-05 | 6.2 | CVE-2024-23357 | [email protected] |
| QwikDev–qwik | Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-06 | 6.3 | CVE-2024-41677 | [email protected] [email protected] [email protected] |
| Samsung Mobile–Samsung Email | Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information. | 2024-08-07 | 4 | CVE-2024-34636 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. | 2024-08-07 | 6.2 | CVE-2024-34604 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. | 2024-08-07 | 6.2 | CVE-2024-34605 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. | 2024-08-07 | 6.2 | CVE-2024-34606 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. | 2024-08-07 | 6.2 | CVE-2024-34607 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. | 2024-08-07 | 6.2 | CVE-2024-34608 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background. | 2024-08-07 | 6.2 | CVE-2024-34609 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data. | 2024-08-07 | 5.1 | CVE-2024-34610 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information. | 2024-08-07 | 5.1 | CVE-2024-34611 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption. | 2024-08-07 | 5.1 | CVE-2024-34615 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data. | 2024-08-07 | 5.1 | CVE-2024-34616 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch. | 2024-08-07 | 4 | CVE-2024-34613 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application. | 2024-08-07 | 4 | CVE-2024-34617 | [email protected] |
| Samsung Mobile–Samsung Mobile Devices | Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information. | 2024-08-07 | 4 | CVE-2024-34618 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34621 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34624 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34625 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34626 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34627 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34628 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34629 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34630 | [email protected] |
| Samsung Mobile–Samsung Notes | Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. | 2024-08-07 | 5.5 | CVE-2024-34631 | [email protected] |
| sbouey–Falang multilanguage for WordPress | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete translations and expose the administrator email address. | 2024-08-08 | 5.4 | CVE-2024-6869 | [email protected] [email protected] [email protected] |
| shopware–shopware | Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn’t get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. | 2024-08-08 | 5.3 | CVE-2024-42354 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| SourceCodester–Clinics Patient Management System | A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is some unknown functionality of the file /new_prescription.php. The manipulation of the argument patient leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273620. | 2024-08-05 | 6.3 | CVE-2024-7494 | [email protected] [email protected] [email protected] [email protected] |
| themebeez–Orchid Store | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘orchid_store_activate_plugin’ function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Addonify Floating Cart For WooCommerce plugin if it is installed. | 2024-08-08 | 4.3 | CVE-2024-6987 | [email protected] [email protected] [email protected] |
| themefusecom–Brizy Page Builder | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public use as another user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. On sites where unfiltered_html is enabled, this can lead to the admin unknowingly adding a Stored Cross-Site Scripting payload. | 2024-08-08 | 4.3 | CVE-2024-6254 | [email protected] [email protected] |
| TOTOLINK–CP900 | A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the argument telnet_enabled leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273557 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-05 | 6.3 | CVE-2024-7464 | [email protected] [email protected] [email protected] [email protected] |
| Unknown–Community Events | The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 2024-08-05 | 4.8 | CVE-2024-6270 | [email protected] |
| Unknown–Ditty | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. | 2024-08-05 | 5.4 | CVE-2024-6710 | [email protected] |
| Unknown–Gutenberg Blocks with AI by Kadence WP | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | 2024-08-08 | 5.4 | CVE-2024-6884 | [email protected] |
| Unknown–Pinpoint Booking System | The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 2024-08-05 | 5.4 | CVE-2024-3636 | [email protected] |
| Unknown–Search & Filter Pro | The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 2024-08-08 | 4.8 | CVE-2024-6481 | [email protected] |
| Unknown–shortcodes-ultimate-pro | The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | 2024-08-06 | 5.4 | CVE-2024-6766 | [email protected] |
| Unknown–WordPress File Upload | The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks. | 2024-08-07 | 6.1 | CVE-2024-6494 | [email protected] |
| Unknown–WordPress File Upload | The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 2024-08-06 | 6.1 | CVE-2024-6651 | [email protected] |
| Unknown–wp-eMember | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack | 2024-08-05 | 6.1 | CVE-2024-5081 | [email protected] |
| wpbakery–WPBakery Visual Composer | The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-08-06 | 6.4 | CVE-2024-5708 | [email protected] [email protected] |
| wpdevart–Organization chart | The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and ‘node_description’ parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure charts can be extended to subscribers. | 2024-08-07 | 4.9 | CVE-2024-7355 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| wptipsntricks–Accept Stripe Payments | The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s accept_stripe_payment_ng shortcode in all versions up to, and including, 2.0.86 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-08-07 | 5.4 | CVE-2024-7353 | [email protected] [email protected] [email protected] [email protected] |
| XjSv–Cooked | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 5.4 | CVE-2024-41816 | [email protected] [email protected] |
| Zscaler–Client Connector | An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190. | 2024-08-06 | 6.5 | CVE-2023-28806 | [email protected] |
| Zscaler–Client Connector | In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1 | 2024-08-06 | 4.9 | CVE-2024-23464 | [email protected] |
Low Vulnerabilities
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info | Patch Info |
|---|---|---|---|---|---|
| biscuit-auth–biscuit | Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a `ThirdPartyBlock` request can be sent, providing only the necessary info to generate a third-party block and to sign it: 1. the public key of the previous block (used in the signature), 2. the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. Tokens with third-party blocks containing `trusted` annotations generated through a third party block request. This has been addressed in version 4 of the specification. Users are advised to update their implementations to conform. There are no known workarounds for this vulnerability. | 2024-08-05 | 3 | CVE-2024-42350 | [email protected] [email protected] |
| Google–Chrome | Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | 2024-08-06 | 3.1 | CVE-2024-6996 | [email protected] [email protected] |
| Huawei–HarmonyOS | Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-08-08 | 2.5 | CVE-2024-42036 | [email protected] |
| Icinga–ipl-web | ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release. | 2024-08-05 | 3.9 | CVE-2024-41811 | [email protected] [email protected] |
| juzaweb–CMS | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2024-08-06 | 2.7 | CVE-2024-7551 | [email protected] [email protected] [email protected] [email protected] |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_map_nolock() The vmf->ptl in filemap_fault_recheck_pte_none() is still set from handle_pte_fault(). But at the same time, we did a pte_unmap(vmf->pte). After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table may be racily changed and vmf->ptl maybe fails to protect the actual page table. Fix this by replacing pte_offset_map() with pte_offset_map_nolock(). As David said, the PTL pointer might be stale so if we continue to use it infilemap_fault_recheck_pte_none(), it might trigger UAF. Also, if the PTL fails, the issue fixed by commit 58f327f2ce80 (“filemap: avoid unnecessary major faults in filemap_fault()”) might reappear. | 2024-08-07 | 3.3 | CVE-2024-42233 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: spi: don’t unoptimize message in spi_async() Calling spi_maybe_unoptimize_message() in spi_async() is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the controller driver. spi_maybe_unoptimize_message() is already called in the correct place in spi_finalize_current_message() to balance the call to spi_maybe_optimize_message() in spi_async(). | 2024-08-07 | 3.3 | CVE-2024-42249 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| mailcow–mailcow-dockerized | mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execute arbitrary scripts in the context of the user’s browser. This could lead to data theft, or further exploitation. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability. | 2024-08-05 | 3.8 | CVE-2024-41960 | [email protected] [email protected] |
| NVIDIA–NVIDIA CUDA Toolkit | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm, where an attacker can cause an out-of-bounds read issue by deceiving a user into reading a malformed ELF file. A successful exploit of this vulnerability might lead to denial of service. | 2024-08-08 | 3.3 | CVE-2024-0102 | [email protected] |
| Samsung Mobile — Samsung Notes | Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. | 2024-08-07 | 3.3 | CVE-2024-34632 | [email protected] |
| Samsung Mobile — Samsung Notes | Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. | 2024-08-07 | 3.3 | CVE-2024-34633 | [email protected] |
| Samsung Mobile — Samsung Notes | Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. | 2024-08-07 | 3.3 | CVE-2024-34634 | [email protected] |
| Samsung Mobile — Samsung Notes | Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. | 2024-08-07 | 3.3 | CVE-2024-34635 | [email protected] |
Severity Not Yet Assigned
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info | Patch Info |
|---|---|---|---|---|---|
| Apache Software Foundation–Apache Airflow Providers FAB | Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints. | 2024-08-05 | not yet calculated | CVE-2024-42447 | [email protected] [email protected] |
| Apache Software Foundation–Apache CloudStack | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data. Affected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1. | 2024-08-07 | not yet calculated | CVE-2024-42222 | [email protected] [email protected] [email protected] [email protected] |
| Concrete CMS–Concrete CMS | Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious code. The Concrete CMS team gave this a CVSS v3.1 rank of 2 with vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator and a CVSS v4.0 rank of 1.8 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N . Thanks, m3dium for reporting. | 2024-08-08 | not yet calculated | CVE-2024-7394 | ff5b8ace-8b95-4078-9743-eac1ca5451de ff5b8ace-8b95-4078-9743-eac1ca5451de ff5b8ace-8b95-4078-9743-eac1ca5451de ff5b8ace-8b95-4078-9743-eac1ca5451de |
| Cybozu, Inc.–Cybozu Office | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting ‘search’ under certain conditions in Custom App. | 2024-08-06 | not yet calculated | CVE-2024-39817 | [email protected] [email protected] |
| Gitea–Gitea Open Source Git Server | Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0. | 2024-08-06 | not yet calculated | CVE-2024-6886 | 88ee5874-cf24-4952-aea0-31affedb7ff2 88ee5874-cf24-4952-aea0-31affedb7ff2 |
| Google–gRPC | It’s possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It’s also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4. | 2024-08-06 | not yet calculated | CVE-2024-7246 | [email protected] |
| Hamastar Technology–MeetingHub Paperless Meetings | A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file. | 2024-08-05 | not yet calculated | CVE-2024-6117 | [email protected] |
| Hamastar Technology–MeetingHub Paperless Meetings | A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file. | 2024-08-05 | not yet calculated | CVE-2024-6118 | [email protected] |
| HP Inc.–Poly Clariti Manager | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in the version of JavaScript used. | 2024-08-06 | not yet calculated | CVE-2024-41910 | [email protected] |
| HP Inc.–Poly Clariti Manager | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation. | 2024-08-06 | not yet calculated | CVE-2024-41911 | [email protected] |
| HP Inc.–Poly Clariti Manager | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls. | 2024-08-07 | not yet calculated | CVE-2024-41912 | [email protected] |
| HP Inc.–Poly Clariti Manager | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input. | 2024-08-06 | not yet calculated | CVE-2024-41913 | [email protected] |
| Huawei–HarmonyOS | Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-08-08 | not yet calculated | CVE-2024-42031 | [email protected] |
| Ivanti–Docs@Work | Ivanti Docs@Work for Android, before 2.26.0 is affected by the ‘Dirty Stream’ vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root. | 2024-08-07 | not yet calculated | CVE-2024-37403 | [email protected] |
| Ivanti–EPMM | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information | 2024-08-07 | not yet calculated | CVE-2024-34788 | [email protected] |
| Ivanti–EPMM | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance. | 2024-08-07 | not yet calculated | CVE-2024-36130 | [email protected] |
| Ivanti–EPMM | An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance. | 2024-08-07 | not yet calculated | CVE-2024-36131 | [email protected] |
| Ivanti–EPMM | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. | 2024-08-07 | not yet calculated | CVE-2024-36132 | [email protected] |
| Jenkins Project–Jenkins | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library. | 2024-08-07 | not yet calculated | CVE-2024-43044 | [email protected] |
| Jenkins Project–Jenkins | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users’ “My Views”. | 2024-08-07 | not yet calculated | CVE-2024-43045 | [email protected] |
| Korenix–JetPort 5601v3 | An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issue affects JetPort 5601v3: through 1.2. | 2024-08-05 | not yet calculated | CVE-2024-7395 | [email protected] |
| Korenix–JetPort 5601v3 | Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2. | 2024-08-05 | not yet calculated | CVE-2024-7396 | [email protected] |
| Korenix–JetPort 5601v3 | Improper filering of special characters result in a command (‘command injection’) vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: through 1.2. | 2024-08-05 | not yet calculated | CVE-2024-7397 | [email protected] |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: mm: page_ref: remove folio_try_get_rcu() The below bug was reported on a non-SMP kernel: [ 275.267158][ T4335] ————[ cut here ]———— [ 275.267949][ T4335] kernel BUG at include/linux/page_ref.h:275! [ 275.268526][ T4335] invalid opcode: 0000 [#1] KASAN PTI [ 275.269001][ T4335] CPU: 0 PID: 4335 Comm: trinity-c3 Not tainted 6.7.0-rc4-00061-gefa7df3e3bb5 #1 [ 275.269787][ T4335] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 275.270679][ T4335] RIP: 0010:try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.272813][ T4335] RSP: 0018:ffffc90005dcf650 EFLAGS: 00010202 [ 275.273346][ T4335] RAX: 0000000000000246 RBX: ffffea00066e0000 RCX: 0000000000000000 [ 275.274032][ T4335] RDX: fffff94000cdc007 RSI: 0000000000000004 RDI: ffffea00066e0034 [ 275.274719][ T4335] RBP: ffffea00066e0000 R08: 0000000000000000 R09: fffff94000cdc006 [ 275.275404][ T4335] R10: ffffea00066e0037 R11: 0000000000000000 R12: 0000000000000136 [ 275.276106][ T4335] R13: ffffea00066e0034 R14: dffffc0000000000 R15: ffffea00066e0008 [ 275.276790][ T4335] FS: 00007fa2f9b61740(0000) GS:ffffffff89d0d000(0000) knlGS:0000000000000000 [ 275.277570][ T4335] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 275.278143][ T4335] CR2: 00007fa2f6c00000 CR3: 0000000134b04000 CR4: 00000000000406f0 [ 275.278833][ T4335] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 275.279521][ T4335] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 275.280201][ T4335] Call Trace: [ 275.280499][ T4335] <TASK> [ 275.280751][ T4335] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) [ 275.281087][ T4335] ? do_trap (arch/x86/kernel/traps.c:112 arch/x86/kernel/traps.c:153) [ 275.281463][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.281884][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.282300][ T4335] ? do_error_trap (arch/x86/kernel/traps.c:174) [ 275.282711][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.283129][ T4335] ? handle_invalid_op (arch/x86/kernel/traps.c:212) [ 275.283561][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.283990][ T4335] ? exc_invalid_op (arch/x86/kernel/traps.c:264) [ 275.284415][ T4335] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:568) [ 275.284859][ T4335] ? try_get_folio (include/linux/page_ref.h:275 (discriminator 3) mm/gup.c:79 (discriminator 3)) [ 275.285278][ T4335] try_grab_folio (mm/gup.c:148) [ 275.285684][ T4335] __get_user_pages (mm/gup.c:1297 (discriminator 1)) [ 275.286111][ T4335] ? __pfx___get_user_pages (mm/gup.c:1188) [ 275.286579][ T4335] ? __pfx_validate_chain (kernel/locking/lockdep.c:3825) [ 275.287034][ T4335] ? mark_lock (kernel/locking/lockdep.c:4656 (discriminator 1)) [ 275.287416][ T4335] __gup_longterm_locked (mm/gup.c:1509 mm/gup.c:2209) [ 275.288192][ T4335] ? __pfx___gup_longterm_locked (mm/gup.c:2204) [ 275.288697][ T4335] ? __pfx_lock_acquire (kernel/locking/lockdep.c:5722) [ 275.289135][ T4335] ? __pfx___might_resched (kernel/sched/core.c:10106) [ 275.289595][ T4335] pin_user_pages_remote (mm/gup.c:3350) [ 275.290041][ T4335] ? __pfx_pin_user_pages_remote (mm/gup.c:3350) [ 275.290545][ T4335] ? find_held_lock (kernel/locking/lockdep.c:5244 (discriminator 1)) [ 275.290961][ T4335] ? mm_access (kernel/fork.c:1573) [ 275.291353][ T4335] process_vm_rw_single_vec+0x142/0x360 [ 275.291900][ T4335] ? __pfx_process_vm_rw_single_vec+0x10/0x10 [ 275.292471][ T4335] ? mm_access (kernel/fork.c:1573) [ 275.292859][ T4335] process_vm_rw_core+0x272/0x4e0 [ 275.293384][ T4335] ? hlock_class (a —truncated— | 2024-08-08 | not yet calculated | CVE-2024-42251 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it shouldn’t be a BUG_ON() For reference, this has popped up once in the CI, and we’ll need more info to debug it: 03240 ————[ cut here ]———— 03240 kernel BUG at lib/closure.c:21! 03240 kernel BUG at lib/closure.c:21! 03240 Internal error: Oops – BUG: 00000000f2000800 [#1] SMP 03240 Modules linked in: 03240 CPU: 15 PID: 40534 Comm: kworker/u80:1 Not tainted 6.10.0-rc4-ktest-ga56da69799bd #25570 03240 Hardware name: linux,dummy-virt (DT) 03240 Workqueue: btree_update btree_interior_update_work 03240 pstate: 00001005 (nzcv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=–) 03240 pc : closure_put+0x224/0x2a0 03240 lr : closure_put+0x24/0x2a0 03240 sp : ffff0000d12071c0 03240 x29: ffff0000d12071c0 x28: dfff800000000000 x27: ffff0000d1207360 03240 x26: 0000000000000040 x25: 0000000000000040 x24: 0000000000000040 03240 x23: ffff0000c1f20180 x22: 0000000000000000 x21: ffff0000c1f20168 03240 x20: 0000000040000000 x19: ffff0000c1f20140 x18: 0000000000000001 03240 x17: 0000000000003aa0 x16: 0000000000003ad0 x15: 1fffe0001c326974 03240 x14: 0000000000000a1e x13: 0000000000000000 x12: 1fffe000183e402d 03240 x11: ffff6000183e402d x10: dfff800000000000 x9 : ffff6000183e402e 03240 x8 : 0000000000000001 x7 : 00009fffe7c1bfd3 x6 : ffff0000c1f2016b 03240 x5 : ffff0000c1f20168 x4 : ffff6000183e402e x3 : ffff800081391954 03240 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 00000000a8000000 03240 Call trace: 03240 closure_put+0x224/0x2a0 03240 bch2_check_for_deadlock+0x910/0x1028 03240 bch2_six_check_for_deadlock+0x1c/0x30 03240 six_lock_slowpath.isra.0+0x29c/0xed0 03240 six_lock_ip_waiter+0xa8/0xf8 03240 __bch2_btree_node_lock_write+0x14c/0x298 03240 bch2_trans_lock_write+0x6d4/0xb10 03240 __bch2_trans_commit+0x135c/0x5520 03240 btree_interior_update_work+0x1248/0x1c10 03240 process_scheduled_works+0x53c/0xd90 03240 worker_thread+0x370/0x8c8 03240 kthread+0x258/0x2e8 03240 ret_from_fork+0x10/0x20 03240 Code: aa1303e0 d63f0020 a94363f7 17ffff8c (d4210000) 03240 —[ end trace 0000000000000000 ]— 03240 Kernel panic – not syncing: Oops – BUG: Fatal exception 03240 SMP: stopping secondary CPUs 03241 SMP: failed to stop secondary CPUs 13,15 03241 Kernel Offset: disabled 03241 CPU features: 0x00,00000003,80000008,4240500b 03241 Memory Limit: none 03241 —[ end Kernel panic – not syncing: Oops – BUG: Fatal exception ]— 03246 ========= FAILED TIMEOUT copygc_torture_no_checksum in 7200s | 2024-08-08 | not yet calculated | CVE-2024-42252 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock’ is held when setting interrupt latch and mask in pca953x_irq_bus_sync_unlock() in order to avoid races. The other (non-probe) call site pca953x_gpio_set_multiple() ensures the lock is held before calling pca953x_write_regs(). The problem occurred when a request raced against irq_bus_sync_unlock() approximately once per thousand reboots on an i.MX8MP based system. * Normal case 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 * Race case 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 | 2024-08-08 | not yet calculated | CVE-2024-42253 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent error handling in io_alloc_pbuf_ring(). KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341 Call Trace: <TASK> io_put_bl io_uring/kbuf.c:378 [inline] io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 | 2024-08-08 | not yet calculated | CVE-2024-42254 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Dereference auth after NULL check in tpm_buf_check_hmac_response(). Otherwise, unless tpm2_sessions_init() was called, a call can cause NULL dereference, when TCG_TPM2_HMAC is enabled. [jarkko: adjusted the commit message.] | 2024-08-08 | not yet calculated | CVE-2024-42255 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifs_prepare_write() which will make cifs repick the server for the op before renegotiating credits; it then calls cifs_issue_write() which invokes smb2_async_writev() – which re-repicks the server. If a different server is then selected, this causes the increment of server->in_flight to happen against one record and the decrement to happen against another, leading to misaccounting. Fix this by just removing the repick code in smb2_async_writev(). As this is only called from netfslib-driven code, cifs_prepare_write() should always have been called first, and so server should never be NULL and the preparatory step is repeated in the event that we do a retry. The problem manifests as a warning looking something like: WARNING: CPU: 4 PID: 72896 at fs/smb/client/smb2ops.c:97 smb2_add_credits+0x3f0/0x9e0 [cifs] … RIP: 0010:smb2_add_credits+0x3f0/0x9e0 [cifs] … smb2_writev_callback+0x334/0x560 [cifs] cifs_demultiplex_thread+0x77a/0x11b0 [cifs] kthread+0x187/0x1d0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Which may be triggered by a number of different xfstests running against an Azure server in multichannel mode. generic/249 seems the most repeatable, but generic/215, generic/249 and generic/308 may also show it. | 2024-08-08 | not yet calculated | CVE-2024-42256 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Linux–Linux | In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 (“ext4: add nonstring annotations to ext4.h”). Using strscpy() isn’t the right replacement for strncpy(); it should use memtostr_pad() instead. | 2024-08-08 | not yet calculated | CVE-2024-42257 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| Microchip Techology–Advanced Software Framework | Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer overflow. This vulnerability is associated with program files tinydhcpserver.C and program routines lwip_dhcp_find_option. This issue affects Advanced Software Framework: through 3.52.0.2574. ASF is no longer being supported. Apply provided workaround or migrate to an actively maintained framework. | 2024-08-08 | not yet calculated | CVE-2024-7490 | dc3f6da9-85b5-4a73-84a2-2ec90b40fca5 |
| Mozilla–Firefox for iOS | Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129. | 2024-08-06 | not yet calculated | CVE-2024-43112 | [email protected] [email protected] |
| Mozilla–Firefox for iOS | The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129. | 2024-08-06 | not yet calculated | CVE-2024-43113 | [email protected] [email protected] |
| Mozilla–Firefox | Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1. | 2024-08-06 | not yet calculated | CVE-2024-7518 | [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129. | 2024-08-06 | not yet calculated | CVE-2024-7523 | [email protected] [email protected] |
| Mozilla–Firefox | Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in “strict-dynamic” mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1. | 2024-08-06 | not yet calculated | CVE-2024-7524 | [email protected] [email protected] [email protected] [email protected] |
| Mozilla–Firefox | Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1. | 2024-08-06 | not yet calculated | CVE-2024-7531 | [email protected] [email protected] [email protected] [email protected] |
| n/a–n/a | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory structure of the root file system during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system’s hard disk. | 2024-08-08 | not yet calculated | CVE-2023-24062 | [email protected] [email protected] |
| n/a–n/a | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system’s hard disk. | 2024-08-08 | not yet calculated | CVE-2023-24063 | [email protected] [email protected] |
| n/a–n/a | Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component. | 2024-08-06 | not yet calculated | CVE-2024-28740 | [email protected] [email protected] |
| n/a–n/a | K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference. | 2024-08-06 | not yet calculated | CVE-2024-36424 | [email protected] [email protected] |
| n/a–n/a | An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server. | 2024-08-06 | not yet calculated | CVE-2024-39229 | [email protected] [email protected] |
| n/a–n/a | The com.cascadialabs.who (aka Who – Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log. | 2024-08-05 | not yet calculated | CVE-2024-40096 | [email protected] |
| n/a–n/a | A Reflected Cross-site scripting (XSS) vulnerability exists in ‘/search’ in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the ‘keywords’ parameter. | 2024-08-06 | not yet calculated | CVE-2024-40101 | [email protected] [email protected] [email protected] |
| n/a–n/a | A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. | 2024-08-05 | not yet calculated | CVE-2024-41200 | [email protected] |
| n/a–n/a | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header. | 2024-08-05 | not yet calculated | CVE-2024-42008 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| n/a–n/a | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. | 2024-08-05 | not yet calculated | CVE-2024-42009 | [email protected] [email protected] [email protected] [email protected] [email protected] |
| Naukowa i Akademicka Sie Komputerowa – Pastwowy Instytut Badawczy–EZD RP | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa – PaÅ„stwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2. | 2024-08-07 | not yet calculated | CVE-2024-7265 | [email protected] [email protected] [email protected] |
| Naukowa i Akademicka Sie Komputerowa – Pastwowy Instytut Badawczy–EZD RP | Incorrect User Management vulnerability in Naukowa i Akademicka Sie? Komputerowa – Pa?stwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2. | 2024-08-07 | not yet calculated | CVE-2024-7266 | [email protected] [email protected] [email protected] |
| Naukowa i Akademicka Sie Komputerowa – Pastwowy Instytut Badawczy–EZD RP | Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sie? Komputerowa – Pa?stwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before 19.6 | 2024-08-07 | not yet calculated | CVE-2024-7267 | [email protected] [email protected] [email protected] |
| oFono–oFono | oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMS message lists. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23157. | 2024-08-06 | not yet calculated | CVE-2024-7537 | [email protected] |
| oFono–oFono | oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT Commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23190. | 2024-08-06 | not yet calculated | CVE-2024-7538 | [email protected] |
| oFono–oFono | oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CUSD commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23195. | 2024-08-06 | not yet calculated | CVE-2024-7539 | [email protected] |
| oFono–oFono | oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307. | 2024-08-06 | not yet calculated | CVE-2024-7540 | [email protected] |
| oFono–oFono | oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23308. | 2024-08-06 | not yet calculated | CVE-2024-7541 | [email protected] |
| oFono–oFono | oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309. | 2024-08-06 | not yet calculated | CVE-2024-7542 | [email protected] |
| oFono–oFono | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23456. | 2024-08-06 | not yet calculated | CVE-2024-7543 | [email protected] |
| oFono–oFono | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23457. | 2024-08-06 | not yet calculated | CVE-2024-7544 | [email protected] |
| oFono–oFono | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23458. | 2024-08-06 | not yet calculated | CVE-2024-7545 | [email protected] |
| oFono–oFono | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23459. | 2024-08-06 | not yet calculated | CVE-2024-7546 | [email protected] |
| oFono–oFono | oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460. | 2024-08-06 | not yet calculated | CVE-2024-7547 | [email protected] |
| OpenText–ALM Octane. | Improper Neutralization vulnerability (XSS) has been discovered in OpenTextâ„¢ ALM Octane. The vulnerability affects all version prior to version 23.4. The vulnerability could cause remote code execution attack. | 2024-08-05 | not yet calculated | CVE-2024-6361 | [email protected] |
| Red Hat–Red Hat Ansible Automation Platform 2 | A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn’t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing. | 2024-08-07 | not yet calculated | CVE-2024-7143 | [email protected] [email protected] [email protected] |
| Red Hat–Red Hat Enterprise Linux 6 | A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. | 2024-08-05 | not yet calculated | CVE-2024-7409 | [email protected] [email protected] |
| Rocket.Chat–Rocket.Chat | A Server-Side Request Forgery (SSRF) affects Rocket.Chat’s Twilio webhook endpoint before version 6.10.1. | 2024-08-05 | not yet calculated | CVE-2024-39713 | [email protected] |
| Unknown–Ajax Search Lite | The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks. | 2024-08-06 | not yet calculated | CVE-2024-7084 | [email protected] |
| Unknown–Chatbot for WordPress by Collect.chat | The Chatbot for WordPress by Collect.chat ?? WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | 2024-08-05 | not yet calculated | CVE-2024-6498 | [email protected] |
| Unknown–Easy Table of Contents | The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks. | 2024-08-06 | not yet calculated | CVE-2024-7082 | [email protected] |
| Unknown–House Manager | The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 2024-08-07 | not yet calculated | CVE-2024-3973 | [email protected] |
| ZEXELON CO., LTD.–ZWX-2000CSW2-HN | ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an administrative privilege to alter the configuration of the device. | 2024-08-05 | not yet calculated | CVE-2024-39838 | [email protected] [email protected] |
| ZEXELON CO., LTD.–ZWX-2000CSW2-HN | Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device. | 2024-08-05 | not yet calculated | CVE-2024-41720 | [email protected] [email protected] |
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
