Vulnerability ID : CVE-2024-21899

First published on : 08-03-2024 17:15:22
Last modified on : 08-03-2024 21:19:43

Description :
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVE ID : CVE-2024-21899
Source : [email protected]
CVSS Score : 9.8

References :
https://www.qnap.com/en/security-advisory/qsa-24-09 | source : [email protected]

Vulnerability : CWE-287

Vulnerability ID : CVE-2024-2184

First published on : 11-03-2024 01:15:50
Last modified on : 11-03-2024 01:32:29

Description :
Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe.

CVE ID : CVE-2024-2184
Source : f98c90f0-e9bd-4fa7-911b-51993f3571fd
CVSS Score : 9.8

References :
https://psirt.canon/advisory-information/cp2024-002/ | source : f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-2370

First published on : 11-03-2024 13:15:52
Last modified on : 11-03-2024 13:15:52

Description :
Unrestricted file upload vulnerability in ManageEngine Desktop Central affecting version 9, build 90055. This vulnerability could allow a remote attacker to upload a malicious file to the system without any credentials provided.

CVE ID : CVE-2024-2370
Source : [email protected]
CVSS Score : 9.8

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-file-upload-vulnerability-manageengine-desktop-central | source : [email protected]

Vulnerability : CWE-434

Vulnerability ID : CVE-2024-2353

First published on : 10-03-2024 08:15:05
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2353
Source : [email protected]
CVSS Score : 8.8

References :
https://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.md | source : [email protected]
https://vuldb.com/?ctiid.256313 | source : [email protected]
https://vuldb.com/?id.256313 | source : [email protected]

Vulnerability : CWE-78

Vulnerability ID : CVE-2024-2282

First published on : 08-03-2024 02:15:51
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component Login Page. The manipulation of the argument useremail leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256049 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2282
Source : [email protected]
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/boyiddha%20utomated-Mess-Management-System/SQL%20Injection%20Login.md | source : [email protected]
https://vuldb.com/?ctiid.256049 | source : [email protected]
https://vuldb.com/?id.256049 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-0670

First published on : 11-03-2024 15:15:47
Last modified on : 11-03-2024 15:15:47

Description :
Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges

CVE ID : CVE-2024-0670
Source : [email protected]
CVSS Score : 8.8

References :
https://checkmk.com/werk/16361 | source : [email protected]

Vulnerability : CWE-427

Vulnerability ID : CVE-2024-2338

First published on : 08-03-2024 20:15:45
Last modified on : 08-03-2024 21:19:43

Description :
PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex expressions to be provided as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic masking is enabled, this will lead to privilege escalation to superuser after the label is created. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.

CVE ID : CVE-2024-2338
Source : f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS Score : 8.0

References :
https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/f55daadba3fa8226029687964aa8889d01a79778 | source : f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2339

First published on : 08-03-2024 20:15:46
Last modified on : 08-03-2024 21:19:43

Description :
PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a masking function for a column and place malicious code in that function. When a privileged user applies the masking rules using the static masking or the anonymous dump method, the malicious code is executed and can grant escalated privileges to the malicious user. PostgreSQL Anonymizer v1.2 does provide a protection against this risk with the restrict_to_trusted_schemas option, but that protection is incomplete. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.

CVE ID : CVE-2024-2339
Source : f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS Score : 8.0

References :
https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/e517b38e62e50871b04011598e73a7308bdae9d9 | source : f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Vulnerability : CWE-20

Vulnerability ID : CVE-2024-25951

First published on : 09-03-2024 06:15:50
Last modified on : 11-03-2024 01:32:39

Description :
A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system.

CVE ID : CVE-2024-25951
Source : [email protected]
CVSS Score : 8.0

References :
https://www.dell.com/support/kbdoc/en-us/000222591/dsa-2024-089-security-update-for-dell-idrac8-local-racadm-vulnerability | source : [email protected]

Vulnerability : CWE-1288

Vulnerability ID : CVE-2024-23608

First published on : 11-03-2024 16:15:07
Last modified on : 11-03-2024 16:15:07

Description :
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVE ID : CVE-2024-23608
Source : [email protected]
CVSS Score : 7.8

References :
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html | source : [email protected]

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-23609

First published on : 11-03-2024 16:15:08
Last modified on : 11-03-2024 16:15:08

Description :
An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVE ID : CVE-2024-23609
Source : [email protected]
CVSS Score : 7.8

References :
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html | source : [email protected]

Vulnerability : CWE-755

Vulnerability ID : CVE-2024-23610

First published on : 11-03-2024 16:15:08
Last modified on : 11-03-2024 16:15:08

Description :
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVE ID : CVE-2024-23610
Source : [email protected]
CVSS Score : 7.8

References :
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html | source : [email protected]

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-23611

First published on : 11-03-2024 16:15:08
Last modified on : 11-03-2024 16:15:08

Description :
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVE ID : CVE-2024-23611
Source : [email protected]
CVSS Score : 7.8

References :
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html | source : [email protected]

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-23612

First published on : 11-03-2024 16:15:08
Last modified on : 11-03-2024 16:15:08

Description :
An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVE ID : CVE-2024-23612
Source : [email protected]
CVSS Score : 7.8

References :
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html | source : [email protected]

Vulnerability : CWE-755

Vulnerability ID : CVE-2024-1696

First published on : 11-03-2024 17:15:46
Last modified on : 11-03-2024 17:15:46

Description :
In Santesoft Sante FFT Imaging versions 1.4.1 and prior once a user opens a malicious DCM file on affected FFT Imaging installations, a local attacker could perform an out-of-bounds write, which could allow for arbitrary code execution.

CVE ID : CVE-2024-1696
Source : [email protected]
CVSS Score : 7.8

References :
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-065-01 | source : [email protected]

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-28197

First published on : 11-03-2024 20:15:07
Last modified on : 11-03-2024 20:15:07

Description :
Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie was handled according to best practices, it was accessible on subdomains of the ZITADEL instance. An attacker could take advantage of this and provide a malicious link hosted on the subdomain to the user to gain access to the victim’s account in certain scenarios. A possible victim would need to login through the malicious link for this exploit to work. If the possible victim already had the cookie present, the attack would not succeed. The attack would further only be possible if there was an initial vulnerability on the subdomain. This could either be the attacker being able to control DNS or a XSS vulnerability in an application hosted on a subdomain. Versions 2.46.0, 2.45.1, and 2.44.3 have been patched. Zitadel recommends upgrading to the latest versions available in due course. Note that applying the patch will invalidate the current cookie and thus users will need to start a new session and existing sessions (user selection) will be empty. For self-hosted environments unable to upgrade to a patched version, prevent setting the following cookie name on subdomains of your Zitadel instance (e.g. within your WAF): `__Secure-zitadel-useragent`.

CVE ID : CVE-2024-28197
Source : [email protected]
CVSS Score : 7.5

References :
https://github.com/zitadel/zitadel/security/advisories/GHSA-mq4x-r2w3-j7mr | source : [email protected]

Vulnerability : CWE-269

Vulnerability ID : CVE-2024-28184

First published on : 09-03-2024 01:15:07
Last modified on : 11-03-2024 01:32:39

Description :
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

CVE ID : CVE-2024-28184
Source : [email protected]
CVSS Score : 7.4

References :
https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598 | source : [email protected]
https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r | source : [email protected]

Vulnerability : CWE-829

Vulnerability ID : CVE-2024-28187

First published on : 11-03-2024 20:15:07
Last modified on : 11-03-2024 20:15:07

Description :
SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-28187
Source : [email protected]
CVSS Score : 7.2

References :
https://github.com/inunosinsi/soycms/commit/9b0e452f628df28dec69cd72b6b55db21066cbf8 | source : [email protected]
https://github.com/inunosinsi/soycms/security/advisories/GHSA-qg3q-hfgc-5jmm | source : [email protected]

Vulnerability : CWE-78

Vulnerability ID : CVE-2024-26313

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.13.P3 HF1 (6.13.0.3.1) is also a fixed release.

CVE ID : CVE-2024-26313
Source : [email protected]
CVSS Score : 7.3

References :
https://archerirm.com | source : [email protected]
https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/717102 | source : [email protected]

Vulnerability ID : CVE-2024-28122

First published on : 09-03-2024 01:15:06
Last modified on : 11-03-2024 01:32:39

Description :
JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.

CVE ID : CVE-2024-28122
Source : [email protected]
CVSS Score : 6.8

References :
https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29 | source : [email protected]
https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21 | source : [email protected]
https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259 | source : [email protected]

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-28120

First published on : 11-03-2024 22:15:55
Last modified on : 11-03-2024 22:15:55

Description :
codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender when receiving an external message. This allows an attacker to host a website that will steal the user's Codeium api-key, and thus impersonate the user on the backend autocomplete server. This issue has not been addressed. Users are advised to monitor the usage of their API key.

CVE ID : CVE-2024-28120
Source : [email protected]
CVSS Score : 6.5

References :
https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63p | source : [email protected]
https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chrome | source : [email protected]

Vulnerability : CWE-200
Vulnerability : CWE-284

Vulnerability ID : CVE-2024-27297

First published on : 11-03-2024 22:15:55
Last modified on : 11-03-2024 22:15:55

Description :
Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-27297
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/NixOS/nix/commit/f8170ce9f119e5e6724eb81ff1b5a2d4c0024000 | source : [email protected]
https://github.com/NixOS/nix/security/advisories/GHSA-2ffj-w4mj-pg37 | source : [email protected]
https://hackmd.io/03UGerewRcy3db44JQoWvw | source : [email protected]

Vulnerability : CWE-367

Vulnerability ID : CVE-2024-27938

First published on : 11-03-2024 22:15:55
Last modified on : 11-03-2024 22:15:55

Description :
Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has 'authorised' to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with `<CR><LF>` line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly `<CR><LF>.<CR><LF>`. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue.

CVE ID : CVE-2024-27938
Source : [email protected]
CVSS Score : 5.3

References :
https://github.com/postalserver/postal/commit/0140dc4 | source : [email protected]
https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2 | source : [email protected]
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide | source : [email protected]
https://www.postfix.org/smtp-smuggling.html | source : [email protected]

Vulnerability : CWE-116

Vulnerability ID : CVE-2024-28176

First published on : 09-03-2024 01:15:07
Last modified on : 11-03-2024 01:32:39

Description :
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

CVE ID : CVE-2024-28176
Source : [email protected]
CVSS Score : 4.9

References :
https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 | source : [email protected]
https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b | source : [email protected]
https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q | source : [email protected]

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-28198

First published on : 11-03-2024 20:15:07
Last modified on : 11-03-2024 20:15:07

Description :
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.

CVE ID : CVE-2024-28198
Source : [email protected]
CVSS Score : 4.6

References :
https://github.com/OpenOLAT/OpenOLAT/commit/23e6212e9412c3b099436159b8c8935321c91872 | source : [email protected]
https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-pqvm-h9mg-434c | source : [email protected]
https://track.frentix.com/issue/OO-7553/XXE-injection-in-draw.io-endpoint | source : [email protected]

Vulnerability : CWE-611

Vulnerability ID : CVE-2024-28180

First published on : 09-03-2024 01:15:07
Last modified on : 11-03-2024 01:32:39

Description :
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

CVE ID : CVE-2024-28180
Source : [email protected]
CVSS Score : 4.3

References :
https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298 | source : [email protected]
https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a | source : [email protected]
https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502 | source : [email protected]
https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g | source : [email protected]

Vulnerability : CWE-409

Vulnerability ID : CVE-2024-1123

First published on : 09-03-2024 07:15:07
Last modified on : 11-03-2024 01:32:39

Description :
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.

CVE ID : CVE-2024-1123
Source : [email protected]
CVSS Score : 6.5

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail= | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/351926d4-a9be-4fbd-bdf2-8bbff41d97ef?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1125

First published on : 09-03-2024 07:15:08
Last modified on : 11-03-2024 01:32:39

Description :
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.

CVE ID : CVE-2024-1125
Source : [email protected]
CVSS Score : 6.5

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043888%40eventprime-event-calendar-management&new=3043888%40eventprime-event-calendar-management&sfp_email=&sfph_mail= | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/b5278afb-9db3-4b1d-bb2f-e6595f0ac6dc?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1320

First published on : 09-03-2024 07:15:08
Last modified on : 11-03-2024 01:32:39

Description :
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-1320
Source : [email protected]
CVSS Score : 6.5

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043888%40eventprime-event-calendar-management&new=3043888%40eventprime-event-calendar-management&sfp_email=&sfph_mail= | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e82e1c5-0ed4-4dee-9990-976591693eb5?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1987

First published on : 08-03-2024 06:15:52
Last modified on : 08-03-2024 14:02:57

Description :
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-1987
Source : [email protected]
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3047285%40wp-members%2Ftrunk&old=3025452%40wp-members%2Ftrunk&sfp_email=&sfph_mail=#file5 | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/631e1061-50b1-4df2-b876-37b4cd3e2478?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1767

First published on : 09-03-2024 07:15:09
Last modified on : 11-03-2024 01:32:39

Description :
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-1767
Source : [email protected]
CVSS Score : 6.4

References :
https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=219324%40blocksy&new=219324%40blocksy&sfp_email=&sfph_mail= | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/fdeab668-9094-485f-aa01-13ba5c10ea89?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1851

First published on : 08-03-2024 07:15:05
Last modified on : 08-03-2024 14:02:57

Description :
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists.

CVE ID : CVE-2024-1851
Source : [email protected]
CVSS Score : 6.3

References :
https://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.php | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e256b0-e4e3-4f41-842c-80aa2b80af72?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-2298

First published on : 08-03-2024 07:15:06
Last modified on : 08-03-2024 14:02:57

Description :
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing products.

CVE ID : CVE-2024-2298
Source : [email protected]
CVSS Score : 4.3

References :
https://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.php | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4d0176-3b7d-4de5-95ec-365873e6f13b?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1124

First published on : 09-03-2024 07:15:08
Last modified on : 11-03-2024 01:32:39

Description :
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.

CVE ID : CVE-2024-1124
Source : [email protected]
CVSS Score : 4.3

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043888%40eventprime-event-calendar-management&new=3043888%40eventprime-event-calendar-management&sfp_email=&sfph_mail= | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/346049ca-1bc5-4e02-9f38-d1f64338709d?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1870

First published on : 09-03-2024 10:15:06
Last modified on : 11-03-2024 01:32:29

Description :
The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access or higher, to update the license key.

CVE ID : CVE-2024-1870
Source : [email protected]
CVSS Score : 4.3

References :
https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/src/License/ActivationForm.php#L356 | source : [email protected]
https://plugins.trac.wordpress.org/changeset/3045582/colibri-page-builder/trunk/src/License/ActivationForm.php?contextall=1&old=2888093&old_path=%2Fcolibri-page-builder%2Ftrunk%2Fsrc%2FLicense%2FActivationForm.php | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/130637ce-d70a-4831-8b88-a2a6e8a95c42?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1400

First published on : 11-03-2024 22:15:54
Last modified on : 11-03-2024 22:15:54

Description :
The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplicateForm function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to duplicate arbitrary posts and pages.

CVE ID : CVE-2024-1400
Source : [email protected]
CVSS Score : 4.3

References :
https://plugins.trac.wordpress.org/changeset/3046896/mollie-forms/trunk/classes/Admin.php | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/43c4ca71-0bf0-4529-97d9-2349f96bbb9e?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-1645

First published on : 11-03-2024 22:15:54
Last modified on : 11-03-2024 22:15:54

Description :
The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export payment data collected by this plugin.

CVE ID : CVE-2024-1645
Source : [email protected]
CVSS Score : 4.3

References :
https://plugins.trac.wordpress.org/browser/mollie-forms/trunk/classes/Admin.php#L904 | source : [email protected]
https://plugins.trac.wordpress.org/changeset/3046896/mollie-forms/trunk/classes/Admin.php | source : [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/353c244f-6d5d-47d6-988e-33da722a02f9?source=cve | source : [email protected]

Vulnerability ID : CVE-2024-2271

First published on : 08-03-2024 00:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability classified as critical has been found in keerti1924 Online-Book-Store-Website 1.0. This affects an unknown part of the file /shop.php of the component HTTP POST Request Handler. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256041 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2271
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20Online-Book-Store-Website/Blind%20SQL%20Injection%20%20Shop/Blind%20SQL%20Injection%20Shop.php%20.md | source : [email protected]
https://vuldb.com/?ctiid.256041 | source : [email protected]
https://vuldb.com/?id.256041 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2272

First published on : 08-03-2024 00:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability classified as critical was found in keerti1924 Online-Book-Store-Website 1.0. This vulnerability affects unknown code of the file /home.php of the component HTTP POST Request Handler. The manipulation of the argument product_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256042 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2272
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20Online-Book-Store-Website/Blind%20SQL%20Injection%20%20Home/Blind%20SQL%20Injection%20Home.php%20.md | source : [email protected]
https://vuldb.com/?ctiid.256042 | source : [email protected]
https://vuldb.com/?id.256042 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2281

First published on : 08-03-2024 02:15:51
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256048. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2281
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/boyiddha%20utomated-Mess-Management-System/BROKEN%20ACCESS%20CONTROL%20.md | source : [email protected]
https://vuldb.com/?ctiid.256048 | source : [email protected]
https://vuldb.com/?id.256048 | source : [email protected]

Vulnerability : CWE-284

Vulnerability ID : CVE-2024-2283

First published on : 08-03-2024 02:15:51
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability classified as critical has been found in boyiddha Automated-Mess-Management-System 1.0. Affected is an unknown function of the file /member/view.php. The manipulation of the argument date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256050 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2283
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/boyiddha%20utomated-Mess-Management-System/SQL%20Injection%20member-view.php%20.md | source : [email protected]
https://vuldb.com/?ctiid.256050 | source : [email protected]
https://vuldb.com/?id.256050 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2329

First published on : 09-03-2024 08:15:06
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_resource_icon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2329
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-list_resource_icon.md | source : [email protected]
https://vuldb.com/?ctiid.256280 | source : [email protected]
https://vuldb.com/?id.256280 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2330

First published on : 09-03-2024 09:15:05
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2330
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/jikedaodao/cve/blob/main/NS-ASG-sql-addmacbind.md | source : [email protected]
https://vuldb.com/?ctiid.256281 | source : [email protected]
https://vuldb.com/?id.256281 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2331

First published on : 09-03-2024 10:15:06
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability was found in SourceCodester Tourist Reservation System 1.0. It has been declared as critical. This vulnerability affects the function ad_writedata of the file System.cpp. The manipulation of the argument ad_code leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256282 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2331
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/wkeyi0x1/vul-report/blob/main/Tourist%20Reservation%20System%20using%20C%2B%2B%20with%20Free%20Source%20Code/buffer-overflow-1.md | source : [email protected]
https://vuldb.com/?ctiid.256282 | source : [email protected]
https://vuldb.com/?id.256282 | source : [email protected]

Vulnerability : CWE-120

Vulnerability ID : CVE-2024-2332

First published on : 09-03-2024 14:15:51
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256283.

CVE ID : CVE-2024-2332
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/vanitashtml/CVE-Dumps/blob/main/Blind%20SQL%20Injection%20Manage%20Category%20-%20Mobile%20Management%20Store.md | source : [email protected]
https://vuldb.com/?ctiid.256283 | source : [email protected]
https://vuldb.com/?id.256283 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2333

First published on : 09-03-2024 16:15:42
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256284.

CVE ID : CVE-2024-2333
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/0x404Ming/CVE_Hunter/blob/main/SQLi-3.md | source : [email protected]
https://vuldb.com/?ctiid.256284 | source : [email protected]
https://vuldb.com/?id.256284 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2351

First published on : 09-03-2024 23:15:49
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument cat_id/brand_id/keyword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256303.

CVE ID : CVE-2024-2351
Source : [email protected]
CVSS Score : 6.3

References :
https://docs.qq.com/doc/DYklCV0thWnRaaWpY | source : [email protected]
https://vuldb.com/?ctiid.256303 | source : [email protected]
https://vuldb.com/?id.256303 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2352

First published on : 10-03-2024 02:16:08
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.

CVE ID : CVE-2024-2352
Source : [email protected]
CVSS Score : 6.3

References :
https://github.com/1Panel-dev/1Panel/pull/4131 | source : [email protected]
https://github.com/1Panel-dev/1Panel/pull/4131#issue-2176105990 | source : [email protected]
https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c | source : [email protected]
https://vuldb.com/?ctiid.256304 | source : [email protected]
https://vuldb.com/?id.256304 | source : [email protected]

Vulnerability : CWE-77

Vulnerability ID : CVE-2024-2363

First published on : 10-03-2024 23:15:54
Last modified on : 11-03-2024 01:32:29

Description :
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256318 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE ID : CVE-2024-2363
Source : [email protected]
CVSS Score : 5.3

References :
https://fitoxs.com/vuldb/exploit/exploit_aim_triton.txt | source : [email protected]
https://vuldb.com/?ctiid.256318 | source : [email protected]
https://vuldb.com/?id.256318 | source : [email protected]

Vulnerability : CWE-404

Vulnerability ID : CVE-2024-2277

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Setting/change_password_save of the component Password Reset Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256046 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2277
Source : [email protected]
CVSS Score : 4.3

References :
https://drive.google.com/file/d/1SVYLzbnYzSyun79QBOsRuWuMkzyjclJM/view?usp=drivesdk | source : [email protected]
https://vuldb.com/?ctiid.256046 | source : [email protected]
https://vuldb.com/?id.256046 | source : [email protected]

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-2316

First published on : 08-03-2024 12:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability has been found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This vulnerability affects unknown code of the file /billing/bill/edit/ of the component Update Bill Page. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2316
Source : [email protected]
CVSS Score : 4.3

References :
https://drive.google.com/file/d/1v_Ee2FWlbpLgHYIl88COPp05EHSxUWI0/view?usp=sharing | source : [email protected]
https://vuldb.com/?ctiid.256270 | source : [email protected]
https://vuldb.com/?id.256270 | source : [email protected]

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-2318

First published on : 08-03-2024 13:15:07
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbio_media.sql leads to path traversal: '../filedir'. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256272. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2318
Source : [email protected]
CVSS Score : 4.3

References :
https://gist.github.com/whiteman007/a3b25a7ddf38774329d72930e0cd841a | source : [email protected]
https://vuldb.com/?ctiid.256272 | source : [email protected]
https://vuldb.com/?id.256272 | source : [email protected]

Vulnerability : CWE-24

Vulnerability ID : CVE-2024-2354

First published on : 10-03-2024 11:15:45
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2354
Source : [email protected]
CVSS Score : 4.3

References :
https://github.com/sweatxi/BugHub/blob/main/dreamer_cms_admin_menu_toEdit_csrf.pdf | source : [email protected]
https://vuldb.com/?ctiid.256314 | source : [email protected]
https://vuldb.com/?id.256314 | source : [email protected]

Vulnerability : CWE-352

Vulnerability ID : CVE-2022-43855

First published on : 08-03-2024 18:15:48
Last modified on : 08-03-2024 21:19:43

Description :
IBM SPSS Statistics 26.0, 27.0.1, and 28.0 could allow a local user to create multiple files that could exhaust the file handles capacity and cause a denial of service. IBM X-Force ID: 230235.

CVE ID : CVE-2022-43855
Source : [email protected]
CVSS Score : 6.2

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/239235 | source : [email protected]
https://www.ibm.com/support/pages/node/7130881 | source : [email protected]

Vulnerability : CWE-399

Vulnerability ID : CVE-2023-34980

First published on : 08-03-2024 17:15:22
Last modified on : 08-03-2024 21:19:43

Description :
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627 build 20231225 and later QuTS hero h4.5.4.2626 build 20231225 and later

CVE ID : CVE-2023-34980
Source : [email protected]
CVSS Score : 5.9

References :
https://www.qnap.com/en/security-advisory/qsa-24-12 | source : [email protected]

Vulnerability : CWE-78

Vulnerability ID : CVE-2023-47221

First published on : 08-03-2024 17:15:22
Last modified on : 08-03-2024 21:19:43

Description :
A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later

CVE ID : CVE-2023-47221
Source : [email protected]
CVSS Score : 5.5

References :
https://www.qnap.com/en/security-advisory/qsa-24-13 | source : [email protected]

Vulnerability : CWE-22

Vulnerability ID : CVE-2023-32969

First published on : 08-03-2024 17:15:21
Last modified on : 08-03-2024 21:19:43

Description :
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later

CVE ID : CVE-2023-32969
Source : [email protected]
CVSS Score : 4.9

References :
https://www.qnap.com/en/security-advisory/qsa-24-11 | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-21901

First published on : 08-03-2024 17:15:23
Last modified on : 08-03-2024 21:19:43

Description :
A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 ) and later QTS 4.5.4.2627 build 20231225 and later

CVE ID : CVE-2024-21901
Source : [email protected]
CVSS Score : 4.7

References :
https://www.qnap.com/en/security-advisory/qsa-24-09 | source : [email protected]

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-21900

First published on : 08-03-2024 17:15:22
Last modified on : 08-03-2024 21:19:43

Description :
An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

CVE ID : CVE-2024-21900
Source : [email protected]
CVSS Score : 4.3

References :
https://www.qnap.com/en/security-advisory/qsa-24-09 | source : [email protected]

Vulnerability : CWE-74

Vulnerability ID : CVE-2023-32264

First published on : 08-03-2024 21:15:06
Last modified on : 08-03-2024 21:19:43

Description :
CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code and execute it on the client's computer.

CVE ID : CVE-2023-32264
Source : [email protected]
CVSS Score : 5.8

References :
https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0799355 | source : [email protected]

Vulnerability : CWE-1385

Vulnerability ID : CVE-2024-1441

First published on : 11-03-2024 14:15:06
Last modified on : 11-03-2024 14:15:06

Description :
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.

CVE ID : CVE-2024-1441
Source : [email protected]
CVSS Score : 5.5

References :
https://access.redhat.com/security/cve/CVE-2024-1441 | source : [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=2263841 | source : [email protected]

Vulnerability : CWE-193

Vulnerability ID : CVE-2024-2319

First published on : 08-03-2024 14:15:52
Last modified on : 08-03-2024 21:19:43

Description :
Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially crafted JavaScript payload in the upload functionality due to lack of proper sanitisation of JavaScript elements.

CVE ID : CVE-2024-2319
Source : [email protected]
CVSS Score : 5.4

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-django-markdownx | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26309

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker could potentially obtain access to sensitive information via an internal URL.

CVE ID : CVE-2024-26309
Source : [email protected]
CVSS Score : 5.3

References :
https://archerirm.com | source : [email protected]
https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/717102 | source : [email protected]

Vulnerability ID : CVE-2024-2317

First published on : 08-03-2024 12:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2317
Source : [email protected]
CVSS Score : 3.8

References :
https://drive.google.com/file/d/13-Fxw8fw3VP1PvL0fYvDBVlpTDQHyCkc/view?usp=sharing | source : [email protected]
https://vuldb.com/?ctiid.256271 | source : [email protected]
https://vuldb.com/?id.256271 | source : [email protected]

Vulnerability : CWE-285

Vulnerability ID : CVE-2024-2355

First published on : 10-03-2024 12:15:06
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /secret_coder.sql. The manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2355
Source : [email protected]
CVSS Score : 3.7

References :
https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20%5BSecret-Coder-PHP-Project%20Sensitive%20Information%20Disclosure%5D%20on%20secret_coder.sql.md | source : [email protected]
https://vuldb.com/?ctiid.256315 | source : [email protected]
https://vuldb.com/?id.256315 | source : [email protected]

Vulnerability : CWE-540

Vulnerability ID : CVE-2024-2284

First published on : 08-03-2024 03:15:06
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability classified as problematic was found in boyiddha Automated-Mess-Management-System 1.0. Affected by this vulnerability is an unknown functionality of the file /member/chat.php of the component Chat Book. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256051. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2284
Source : [email protected]
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/boyiddha%20utomated-Mess-Management-System/STORED%20XSS%20member-chat.php%20.md | source : [email protected]
https://vuldb.com/?ctiid.256051 | source : [email protected]
https://vuldb.com/?id.256051 | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2285

First published on : 08-03-2024 03:15:06
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0. Affected by this issue is some unknown functionality of the file /member/member_edit.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-256052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2285
Source : [email protected]
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/boyiddha%20utomated-Mess-Management-System/STORED%20XSS%20member-member-edit.php%20.md | source : [email protected]
https://vuldb.com/?ctiid.256052 | source : [email protected]
https://vuldb.com/?id.256052 | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2274

First published on : 08-03-2024 01:15:07
Last modified on : 09-03-2024 17:15:06

Description :
A vulnerability, which was classified as problematic, has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. This issue affects some unknown processing of the file /Home/Index of the component Prescription Dashboard. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256043. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2274
Source : [email protected]
CVSS Score : 2.4

References :
https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk | source : [email protected]
https://vuldb.com/?ctiid.256043 | source : [email protected]
https://vuldb.com/?id.256043 | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2275

First published on : 08-03-2024 01:15:07
Last modified on : 09-03-2024 17:15:07

Description :
A vulnerability, which was classified as problematic, was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. Affected is an unknown function of the component OBS Patient/Gynee Prescription. The manipulation of the argument Patient Title/Full Name/Address/Cheif Complain/LMP/Menstrual Edd/OBS P/OBS Alc/Medicine Name/Medicine Type/Ml/Dose/Days/Comments/Template Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256044. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2275
Source : [email protected]
CVSS Score : 2.4

References :
https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk | source : [email protected]
https://vuldb.com/?ctiid.256044 | source : [email protected]
https://vuldb.com/?id.256044 | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2276

First published on : 08-03-2024 01:15:07
Last modified on : 08-03-2024 14:02:57

Description :
A vulnerability has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Venue_controller/edit_venue/ of the component Edit Venue Page. The manipulation of the argument Venue map leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256045 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2276
Source : [email protected]
CVSS Score : 2.4

References :
https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk | source : [email protected]
https://vuldb.com/?ctiid.256045 | source : [email protected]
https://vuldb.com/?id.256045 | source : [email protected]

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2364

First published on : 10-03-2024 23:15:54
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.

CVE ID : CVE-2024-2364
Source : [email protected]
CVSS Score : 1.8

References :
https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md | source : [email protected]
https://vuldb.com/?ctiid.256320 | source : [email protected]
https://vuldb.com/?id.256320 | source : [email protected]

Vulnerability : CWE-530

Vulnerability ID : CVE-2024-2365

First published on : 11-03-2024 00:15:17
Last modified on : 11-03-2024 01:32:29

Description :
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.

CVE ID : CVE-2024-2365
Source : [email protected]
CVSS Score : 1.6

References :
https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md | source : [email protected]
https://vuldb.com/?ctiid.256321 | source : [email protected]
https://vuldb.com/?id.256321 | source : [email protected]

Vulnerability : CWE-916

Vulnerability ID : CVE-2024-2313

First published on : 10-03-2024 23:15:53
Last modified on : 11-03-2024 01:32:29

Description :
If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

CVE ID : CVE-2024-2313
Source : [email protected]
CVSS Score : 2.8

References :
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313 | source : [email protected]
https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998 | source : [email protected]

Vulnerability ID : CVE-2024-2314

First published on : 10-03-2024 23:15:53
Last modified on : 11-03-2024 01:32:29

Description :
If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

CVE ID : CVE-2024-2314
Source : [email protected]
CVSS Score : 2.8

References :
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2314 | source : [email protected]
https://github.com/iovisor/bcc/commit/008ea09e891194c072f2a9305a3c872a241dc342 | source : [email protected]

Vulnerability ID : CVE-2024-25114

First published on : 11-03-2024 22:15:54
Last modified on : 11-03-2024 22:15:54

Description :
Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instance in a different "jail" with a unique directory "jailID" name. For security reasons, this directory name is randomly generated and should not be given out to the client. In affected versions of Collabora Online it is possible to use the CELL() function, with the "filename" argument, in the spreadsheet component to get a path which includes this JailID. The impact of this vulnerability in its own is low because it requires to be chained with another vulnerability. Users should upgrade to Collabora Online 23.05.9; Collabora Online 22.05.22; Collabora Online 21.11.10 or higher. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-25114
Source : [email protected]
CVSS Score : 2.6

References :
https://github.com/CollaboraOnline/online/security/advisories/GHSA-2fh2-ppjf-p3xv | source : [email protected]
https://github.com/LibreOffice/online/blob/master/wsd/README | source : [email protected]

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-25327

First published on : 08-03-2024 00:15:49
Last modified on : 08-03-2024 14:02:57

Description :
Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code via the formatCaseNumber parameter of the Citation search function.

CVE ID : CVE-2024-25327
Source : [email protected]
CVSS Score : /

References :
https://packetstormsecurity.com/files/177500/FullCourt-Enterprise-8.2-Cross-Site-Scripting.html | source : [email protected]

Vulnerability ID : CVE-2024-25729

First published on : 08-03-2024 00:15:50
Last modified on : 08-03-2024 14:02:57

Description :
Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last octet.)

CVE ID : CVE-2024-25729
Source : [email protected]
CVSS Score : /

References :
https://github.com/actuator/cve/blob/main/Arris/CVE-2024-25729 | source : [email protected]
https://github.com/actuator/cve/blob/main/Arris/SBG6580.png | source : [email protected]
https://i.ebayimg.com/images/g/DhoAAOSwx0FbhhcN/s-l1600.jpg | source : [email protected]
https://i.ebayimg.com/images/g/z2oAAOSwO1pbQ9BS/s-l1600.jpg | source : [email protected]

Vulnerability ID : CVE-2019-6268

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. for Directory Traversal, as demonstrated by reading /etc/shadow.

CVE ID : CVE-2019-6268
Source : [email protected]
CVSS Score : /

References :
https://packetstormsecurity.com/files/177440/RAD-SecFlow-2-Path-Traversal.html | source : [email protected]
https://www.owasp.org/index.php/Path_Traversal | source : [email protected]

Vulnerability ID : CVE-2024-25845

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions.

CVE ID : CVE-2024-25845
Source : [email protected]
CVSS Score : /

References :
https://security.friendsofpresta.org/modules/2024/03/05/cdcustomfields4orders.html | source : [email protected]
https://www.cleanpresta.com | source : [email protected]

Vulnerability ID : CVE-2024-25848

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions.

CVE ID : CVE-2024-25848
Source : [email protected]
CVSS Score : /

References :
https://addons.prestashop.com/fr/seo-referencement-naturel/39489-ever-ultimate-seo.html | source : [email protected]
https://security.friendsofpresta.org/modules/2024/03/05/everpsseo.html | source : [email protected]
https://www.team-ever.com/prestashop-ever-ultimate-seo/ | source : [email protected]

Vulnerability ID : CVE-2024-25849

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` .

CVE ID : CVE-2024-25849
Source : [email protected]
CVSS Score : /

References :
https://addons.prestashop.com/en/price-management/19507-make-an-offer.html | source : [email protected]
https://security.friendsofpresta.org/modules/2024/03/05/makeanoffer.html | source : [email protected]

Vulnerability ID : CVE-2024-27612

First published on : 08-03-2024 06:15:52
Last modified on : 08-03-2024 14:02:57

Description :
Numbas editor before 7.3 mishandles editing of themes and extensions.

CVE ID : CVE-2024-27612
Source : [email protected]
CVSS Score : /

References :
https://github.com/numbas/Numbas | source : [email protected]
https://www.numbas.org.uk/blog/2024/03/development-update-march-2024/ | source : [email protected]

Vulnerability ID : CVE-2024-27613

First published on : 08-03-2024 06:15:52
Last modified on : 08-03-2024 14:02:57

Description :
Numbas editor before 7.3 mishandles reading of themes and extensions.

CVE ID : CVE-2024-27613
Source : [email protected]
CVSS Score : /

References :
https://github.com/numbas/Numbas | source : [email protected]
https://www.numbas.org.uk/blog/2024/03/development-update-march-2024/ | source : [email protected]

Vulnerability ID : CVE-2024-28753

First published on : 09-03-2024 00:15:59
Last modified on : 11-03-2024 01:32:39

Description :
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.

CVE ID : CVE-2024-28753
Source : [email protected]
CVSS Score : /

References :
https://dustri.org/b/carrot-disclosure.html | source : [email protected]

Vulnerability ID : CVE-2024-28754

First published on : 09-03-2024 00:15:59
Last modified on : 11-03-2024 01:32:39

Description :
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.

CVE ID : CVE-2024-28754
Source : [email protected]
CVSS Score : /

References :
https://dustri.org/b/carrot-disclosure.html | source : [email protected]

Vulnerability ID : CVE-2023-49340

First published on : 09-03-2024 05:15:08
Last modified on : 11-03-2024 01:32:39

Description :
An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authentication via incorrect access control in the web management portal.

CVE ID : CVE-2023-49340
Source : [email protected]
CVSS Score : /

References :
https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-49340 | source : [email protected]

Vulnerability ID : CVE-2023-49341

First published on : 09-03-2024 05:15:08
Last modified on : 11-03-2024 01:32:39

Description :
An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive information via cleartext credential storage in backup.htm component.

CVE ID : CVE-2023-49341
Source : [email protected]
CVSS Score : /

References :
https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-49341 | source : [email protected]

Vulnerability ID : CVE-2023-50015

First published on : 09-03-2024 05:15:08
Last modified on : 11-03-2024 01:32:39

Description :
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.

CVE ID : CVE-2023-50015
Source : [email protected]
CVSS Score : /

References :
https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-50015 | source : [email protected]

Vulnerability ID : CVE-2023-46426

First published on : 09-03-2024 06:15:50
Last modified on : 11-03-2024 01:32:39

Description :
Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) via gf_fwrite component in at utils/os_file.c.

CVE ID : CVE-2023-46426
Source : [email protected]
CVSS Score : /

References :
https://github.com/gpac/gpac/issues/2642 | source : [email protected]

Vulnerability ID : CVE-2023-46427

First published on : 09-03-2024 06:15:50
Last modified on : 11-03-2024 01:32:39

Description :
An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via null pointer deference in gf_dash_setup_period component in media_tools/dash_client.c.

CVE ID : CVE-2023-46427
Source : [email protected]
CVSS Score : /

References :
https://github.com/gpac/gpac/issues/2641 | source : [email protected]

Vulnerability ID : CVE-2024-28089

First published on : 09-03-2024 07:15:09
Last modified on : 11-03-2024 01:32:29

Description :
Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel) to conduct a DOM-based stored XSS attack that can fetch remote resources. The payload is executed at index.html#advanced_location (aka the Device Location page). This can cause a denial of service or lead to information disclosure.

CVE ID : CVE-2024-28089
Source : [email protected]
CVSS Score : /

References :
https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-28089 | source : [email protected]
https://github.com/actuator/cve/blob/main/Hitron/Hitron_DOM_XSS_POC.gif | source : [email protected]
https://github.com/actuator/cve/blob/main/Hitron/Hitron_DOM_XSS_POC_DOS_ALT.gif | source : [email protected]

Vulnerability ID : CVE-2024-25501

First published on : 09-03-2024 08:15:05
Last modified on : 11-03-2024 01:32:29

Description :
An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.

CVE ID : CVE-2024-25501
Source : [email protected]
CVSS Score : /

References :
https://gist.github.com/Drun1baby/8270239bed2952dbd99cc8d4262728e8 | source : [email protected]

Vulnerability ID : CVE-2024-27698

First published on : 09-03-2024 23:15:49
Last modified on : 09-03-2024 23:15:49

Description :
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVE ID : CVE-2024-27698
Source : [email protected]
CVSS Score : /

References :

Vulnerability ID : CVE-2024-28757

First published on : 10-03-2024 05:15:06
Last modified on : 11-03-2024 01:32:29

Description :
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVE ID : CVE-2024-28757
Source : [email protected]
CVSS Score : /

References :
https://github.com/libexpat/libexpat/issues/839 | source : [email protected]
https://github.com/libexpat/libexpat/pull/842 | source : [email protected]

Vulnerability ID : CVE-2024-28816

First published on : 11-03-2024 03:15:05
Last modified on : 11-03-2024 12:47:42

Description :
Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php.

CVE ID : CVE-2024-28816
Source : [email protected]
CVSS Score : /

References :
https://github.com/AaravRajSIngh/Chatbot/pull/10 | source : [email protected]

Vulnerability ID : CVE-2024-28823

First published on : 11-03-2024 05:15:05
Last modified on : 11-03-2024 12:47:42

Description :
Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.

CVE ID : CVE-2024-28823
Source : [email protected]
CVSS Score : /

References :
https://github.com/awslabs/aws-js-s3-explorer/commit/f62f12960d081895960d0dc6fde8364f25d651b6 | source : [email protected]
https://github.com/awslabs/aws-js-s3-explorer/issues/118 | source : [email protected]

Vulnerability ID : CVE-2022-46070

First published on : 11-03-2024 22:15:54
Last modified on : 11-03-2024 22:15:54

Description :
GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.

CVE ID : CVE-2022-46070
Source : [email protected]
CVSS Score : /

References :
https://s3.amazonaws.com/geovision_downloads/TechNotice/CyberSecurity/Security_Advistory_ASManager-ASM-2022-11.pdf | source : [email protected]

Vulnerability ID : CVE-2024-25854

First published on : 11-03-2024 22:15:55
Last modified on : 11-03-2024 22:15:55

Description :
Cross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the Subject and Description fields when submitting a support ticket.

CVE ID : CVE-2024-25854
Source : [email protected]
CVSS Score : /

References :
https://github.com/hakkitoklu/hunt/blob/main/Insurance%20Management%20System%20PHP%20and%20MySQL%201.0/xss.md | source : [email protected]

Vulnerability ID : CVE-2023-28826

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.1, macOS Ventura 13.6.5. An app may be able to access sensitive user data.

CVE ID : CVE-2023-28826
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT213984 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/kb/HT213984 | source : [email protected]

Vulnerability ID : CVE-2024-0258

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

CVE ID : CVE-2024-0258
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23201

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.4, watchOS 10.3, tvOS 17.3, macOS Ventura 13.6.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3. An app may be able to cause a denial-of-service.

CVE ID : CVE-2024-23201
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214055 | source : [email protected]
https://support.apple.com/en-us/HT214059 | source : [email protected]
https://support.apple.com/en-us/HT214060 | source : [email protected]
https://support.apple.com/en-us/HT214061 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/kb/HT214055 | source : [email protected]
https://support.apple.com/kb/HT214059 | source : [email protected]
https://support.apple.com/kb/HT214060 | source : [email protected]
https://support.apple.com/kb/HT214061 | source : [email protected]

Vulnerability ID : CVE-2024-23205

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access sensitive user data.

CVE ID : CVE-2024-23205
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23216

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to overwrite arbitrary files.

CVE ID : CVE-2024-23216
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23220

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved handling of caches. This issue is fixed in visionOS 1.1, iOS 17.4 and iPadOS 17.4. An app may be able to fingerprint the user.

CVE ID : CVE-2024-23220
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]

Vulnerability ID : CVE-2024-23226

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. Processing web content may lead to arbitrary code execution.

CVE ID : CVE-2024-23226
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23227

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to read sensitive location information.

CVE ID : CVE-2024-23227
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23230

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved file handling. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to access sensitive user data.

CVE ID : CVE-2024-23230
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23231

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 19:15:07

Description :
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.6.5, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23231
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]
https://support.apple.com/kb/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23232

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An app may be able to capture a user's screen.

CVE ID : CVE-2024-23232
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23233

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to this app may be used by a malicious app.

CVE ID : CVE-2024-23233
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23234

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to execute arbitrary code with kernel privileges.

CVE ID : CVE-2024-23234
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23235

First published on : 08-03-2024 02:15:47
Last modified on : 08-03-2024 14:02:57

Description :
A race condition was addressed with additional validation. This issue is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23235
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23238

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to edit NVRAM variables.

CVE ID : CVE-2024-23238
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23239

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
A race condition was addressed with improved state handling. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to leak sensitive user information.

CVE ID : CVE-2024-23239
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23240

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.

CVE ID : CVE-2024-23240
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]

Vulnerability ID : CVE-2024-23241

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed through improved state management. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to leak sensitive user information.

CVE ID : CVE-2024-23241
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]

Vulnerability ID : CVE-2024-23242

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed by not logging contents of text fields. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to view Mail data.

CVE ID : CVE-2024-23242
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23244

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4. An app from a standard user account may be able to escalate privilege after admin user login.

CVE ID : CVE-2024-23244
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23245

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent.

CVE ID : CVE-2024-23245
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23246

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to break out of its sandbox.

CVE ID : CVE-2024-23246
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23247

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Processing a file may lead to unexpected app termination or arbitrary code execution.

CVE ID : CVE-2024-23247
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23248

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4. Processing a file may lead to a denial-of-service or potentially disclose memory contents.

CVE ID : CVE-2024-23248
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23249

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4. Processing a file may lead to a denial-of-service or potentially disclose memory contents.

CVE ID : CVE-2024-23249
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23250

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access Bluetooth-connected microphones without user permission.

CVE ID : CVE-2024-23250
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23252

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service.

CVE ID : CVE-2024-23252
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214089 | source : [email protected]

Vulnerability ID : CVE-2024-23253

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to access a user's Photos Library.

CVE ID : CVE-2024-23253
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23254

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved UI handling. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, Safari 17.4. A malicious website may exfiltrate audio data cross-origin.

CVE ID : CVE-2024-23254
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]
https://support.apple.com/en-us/HT214089 | source : [email protected]

Vulnerability ID : CVE-2024-23255

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. Photos in the Hidden Photos Album may be viewed without authentication.

CVE ID : CVE-2024-23255
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23257

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 16.7.6 and iPadOS 16.7.6. Processing an image may result in disclosure of process memory.

CVE ID : CVE-2024-23257
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]

Vulnerability ID : CVE-2024-23258

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
An out-of-bounds read was addressed with improved input validation. This issue is fixed in visionOS 1.1, macOS Sonoma 14.4. Processing an image may lead to arbitrary code execution.

CVE ID : CVE-2024-23258
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]

Vulnerability ID : CVE-2024-23259

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service.

CVE ID : CVE-2024-23259
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23260

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed by removing additional entitlements. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23260
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23262

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 1.1, iOS 17.4 and iPadOS 17.4, iOS 16.7.6 and iPadOS 16.7.6. An app may be able to spoof system notifications and UI.

CVE ID : CVE-2024-23262
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]

Vulnerability ID : CVE-2024-23263

First published on : 08-03-2024 02:15:48
Last modified on : 08-03-2024 14:02:57

Description :
A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVE ID : CVE-2024-23263
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]
https://support.apple.com/en-us/HT214089 | source : [email protected]

Vulnerability ID : CVE-2024-23264

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An application may be able to read restricted memory.

CVE ID : CVE-2024-23264
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]

Vulnerability ID : CVE-2024-23265

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to cause unexpected system termination or write kernel memory.

CVE ID : CVE-2024-23265
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23266

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to modify protected parts of the file system.

CVE ID : CVE-2024-23266
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23267

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences.

CVE ID : CVE-2024-23267
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23268

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
An injection issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.

CVE ID : CVE-2024-23268
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23269

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to modify protected parts of the file system.

CVE ID : CVE-2024-23269
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23270

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, tvOS 17.4. An app may be able to execute arbitrary code with kernel privileges.

CVE ID : CVE-2024-23270
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]

Vulnerability ID : CVE-2024-23272

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. A user may gain access to protected parts of the file system.

CVE ID : CVE-2024-23272
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23273

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed through improved state management. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Private Browsing tabs may be accessed without authentication.

CVE ID : CVE-2024-23273
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214089 | source : [email protected]

Vulnerability ID : CVE-2024-23274

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
An injection issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.

CVE ID : CVE-2024-23274
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23275

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A race condition was addressed with additional validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to access protected user data.

CVE ID : CVE-2024-23275
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23276

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.

CVE ID : CVE-2024-23276
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23277

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard.

CVE ID : CVE-2024-23277
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23278

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 19:15:07

Description :
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.5, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to break out of its sandbox.

CVE ID : CVE-2024-23278
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]
https://support.apple.com/kb/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23279

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23279
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23280

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.

CVE ID : CVE-2024-23280
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]
https://support.apple.com/en-us/HT214089 | source : [email protected]

Vulnerability ID : CVE-2024-23281

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4. An app may be able to access sensitive user data.

CVE ID : CVE-2024-23281
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23283

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23283
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]

Vulnerability ID : CVE-2024-23284

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVE ID : CVE-2024-23284
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]
https://support.apple.com/en-us/HT214089 | source : [email protected]

Vulnerability ID : CVE-2024-23285

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinks to protected regions of the disk.

CVE ID : CVE-2024-23285
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23286

First published on : 08-03-2024 02:15:49
Last modified on : 08-03-2024 14:02:57

Description :
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. Processing an image may lead to arbitrary code execution.

CVE ID : CVE-2024-23286
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214083 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214085 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214087 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23287

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23287
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23288

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to elevate privileges.

CVE ID : CVE-2024-23288
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23289

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A lock screen issue was addressed with improved state management. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A person with physical access to a device may be able to use Siri to access private calendar information.

CVE ID : CVE-2024-23289
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214082 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23290

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data.

CVE ID : CVE-2024-23290
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23291

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A malicious app may be able to observe user data in log entries related to accessibility notifications.

CVE ID : CVE-2024-23291
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23292

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access information about a user's contacts.

CVE ID : CVE-2024-23292
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23293

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed through improved state management. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An attacker with physical access may be able to use Siri to access sensitive user data.

CVE ID : CVE-2024-23293
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214084 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2024-23294

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4. Processing malicious input may lead to code execution.

CVE ID : CVE-2024-23294
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214084 | source : [email protected]

Vulnerability ID : CVE-2024-23295

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
A permissions issue was addressed to help ensure Personas are always protected This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona.

CVE ID : CVE-2024-23295
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214087 | source : [email protected]

Vulnerability ID : CVE-2024-23297

First published on : 08-03-2024 02:15:50
Last modified on : 08-03-2024 14:02:57

Description :
The issue was addressed with improved checks. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. A malicious application may be able to access private information.

CVE ID : CVE-2024-23297
Source : [email protected]
CVSS Score : /

References :
https://support.apple.com/en-us/HT214081 | source : [email protected]
https://support.apple.com/en-us/HT214086 | source : [email protected]
https://support.apple.com/en-us/HT214088 | source : [email protected]

Vulnerability ID : CVE-2023-52496

First published on : 08-03-2024 11:15:06
Last modified on : 08-03-2024 11:15:06

Description :
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE ID : CVE-2023-52496
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :

Vulnerability ID : CVE-2023-52486

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit.

CVE ID : CVE-2023-52486
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/376e21a9e4c2c63ee5d8d3aa74be5082c3882229 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/62f2e79cf9f4f47cc9dea9cebdf58d9f7b5695e0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9dd334a8245011ace45e53298175c7b659edb3e7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b4af63da9d94986c529d74499fdfe44289acd551 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bfd0feb1b109cb63b87fdcd00122603787c75a1a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d7afdf360f4ac142832b098b4de974e867cc063c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f55261469be87c55df13db76dc945f6bcd825105 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52487

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix peer flow lists handling The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls mlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peer_index that was never initialized or a warning if the list debug config is enabled[0]. Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it. [0]: [ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] list_del corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg ss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? __warn+0x7d/0x130 [ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.005094] ? report_bug+0xf1/0x1c0 [ 3103.005439] ? console_unlock+0x4a/0xd0 [ 3103.005806] ? handle_bug+0x3f/0x70 [ 3103.006149] ? exc_invalid_op+0x13/0x60 [ 3103.006531] ? asm_exc_invalid_op+0x16/0x20 [ 3103.007430] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] [ 3103.008463] mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] [ 3103.008944] mlx5e_flow_put+0x26/0x50 [mlx5_core] [ 3103.009401] mlx5e_delete_flower+0x25f/0x380 [mlx5_core] [ 3103.009901] tc_setup_cb_destroy+0xab/0x180 [ 3103.010292] fl_hw_destroy_filter+0x99/0xc0 [cls_flower] [ 3103.010779] __fl_delete+0x2d4/0x2f0 [cls_flower] [ 3103.0 ---truncated---

CVE ID : CVE-2023-52487
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52488

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent ($00), followed by all the FIFO data without having to resend the register address each time. In this mode, the IC doesn't increment the register address for each R/W byte. The regmap_raw_read() and regmap_raw_write() are functions which can perform IO over multiple registers. They are currently used to read/write from/to the FIFO, and although they operate correctly in this burst mode on the SPI bus, they would corrupt the regmap cache if it was not disabled manually. The reason is that when the R/W size is more than 1 byte, these functions assume that the register address is incremented and handle the cache accordingly. Convert FIFO R/W functions to use the regmap _noinc_ versions in order to remove the manual cache control which was a workaround when using the _raw_ versions. FIFO registers are properly declared as volatile so cache will not be used/updated for FIFO accesses.

CVE ID : CVE-2023-52488
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/084c24e788d9cf29c55564de368bf5284f2bb5db | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/416b10d2817c94db86829fb92ad43ce7d002c573 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aa7cb4787698add9367b19f7afc667662c9bdb23 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dbf4ab821804df071c8b566d9813083125e6d97b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52489

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1]. compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid(): valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL] NOTE: From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and the section deactivate with SPASEMEM_VMEMAP enabled. The commit b943f045a9af("mm/sparse: fix kernel crash with pfn_section_valid check") tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns false thus ms->usage is not accessed. Fix this issue by the below steps: a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. b) RCU protected read side critical section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. Thanks to David/Pavan for their inputs on this patch. [1] https://lore.kernel.org/linux-mm/[email protected]/ On Snapdragon SoC, with the mentioned memory configuration of PFN's as [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of issues daily while testing on a device farm. For this particular issue below is the log. Though the below log is not directly pointing to the pfn_section_valid(){ ms->usage;}, when we loaded this dump on T32 lauterbach tool, it is pointing. [ 540.578056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 540.578068] Mem abort info: [ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC = 0x25: DABT (current EL), IL = 32 bits [ 540.578077] SET = 0, FnV = 0 [ 540.578080] EA = 0, S1PTW = 0 [ 540.578082] FSC = 0x05: level 1 translation fault [ 540.578085] Data abort info: [ 540.578086] ISV = 0, ISS = 0x00000005 [ 540.578088] CM = 0, WnR = 0 [ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--) [ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr : compact_zone+0x994/0x1058 [ 540.579460] sp : ffffffc03579b510 [ 540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c [ 540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640 [ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 [ 540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 [ 540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff [ 540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001 [ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440 [ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 [ 540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000 ---truncated---

CVE ID : CVE-2023-52489
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/3a01daace71b521563c38bbbf874e14c3e58adb7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5ec8e8ea8b7783fab150cf86404fc38cb4db8800 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/68ed9e33324021e9d6b798e9db00ca3093d2012a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/70064241f2229f7ba7b9599a98f68d9142e81a97 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/90ad17575d26874287271127d43ef3c2af876cea | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b448de2459b6d62a53892487ab18b7d823ff0529 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52490

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: mm: migrate: fix getting incorrect page mapping during page migration When running stress-ng testing, we found below kernel crash after a few hours: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : dentry_name+0xd8/0x224 lr : pointer+0x22c/0x370 sp : ffff800025f134c0 ...... Call trace: dentry_name+0xd8/0x224 pointer+0x22c/0x370 vsnprintf+0x1ec/0x730 vscnprintf+0x2c/0x60 vprintk_store+0x70/0x234 vprintk_emit+0xe0/0x24c vprintk_default+0x3c/0x44 vprintk_func+0x84/0x2d0 printk+0x64/0x88 __dump_page+0x52c/0x530 dump_page+0x14/0x20 set_migratetype_isolate+0x110/0x224 start_isolate_page_range+0xc4/0x20c offline_pages+0x124/0x474 memory_block_offline+0x44/0xf4 memory_subsys_offline+0x3c/0x70 device_offline+0xf0/0x120 ...... After analyzing the vmcore, I found this issue is caused by page migration. The scenario is that, one thread is doing page migration, and we will use the target page's ->mapping field to save 'anon_vma' pointer between page unmap and page move, and now the target page is locked and refcount is 1. Currently, there is another stress-ng thread performing memory hotplug, attempting to offline the target page that is being migrated. It discovers that the refcount of this target page is 1, preventing the offline operation, thus proceeding to dump the page. However, page_mapping() of the target page may return an incorrect file mapping to crash the system in dump_mapping(), since the target page->mapping only saves 'anon_vma' pointer without setting PAGE_MAPPING_ANON flag. There are seveval ways to fix this issue: (1) Setting the PAGE_MAPPING_ANON flag for target page's ->mapping when saving 'anon_vma', but this can confuse PageAnon() for PFN walkers, since the target page has not built mappings yet. (2) Getting the page lock to call page_mapping() in __dump_page() to avoid crashing the system, however, there are still some PFN walkers that call page_mapping() without holding the page lock, such as compaction. (3) Using target page->private field to save the 'anon_vma' pointer and 2 bits page state, just as page->mapping records an anonymous page, which can remove the page_mapping() impact for PFN walkers and also seems a simple way. So I choose option 3 to fix this issue, and this can also fix other potential issues for PFN walkers, such as compaction.

CVE ID : CVE-2023-52490
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/3889a418b6eb9a1113fb989aaadecf2f64964767 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9128bfbc5c80d8f4874dd0a0424d1f5fb010df1b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d1adb25df7111de83b64655a80b5a135adbded61 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52491

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_dec_device_run, if error happens in mtk_jpeg_set_dec_dst, it will finally start the worker while mark the job as finished by invoking v4l2_m2m_job_finish. There are two methods to trigger the bug. If we remove the module, it which will call mtk_jpeg_remove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug. CPU0 CPU1 mtk_jpeg_dec_... | start worker | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use If we close the file descriptor, which will call mtk_jpeg_release, it will have a similar sequence. Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2_m2m_job_finish will only be called in either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run.

CVE ID : CVE-2023-52491
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52492

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local is nullified. When dma_async_device_unregister() is called (because of managed API or intentionally by DMA controller driver), channels are unconditionally unregistered, leading to this NULL pointer: [ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [...] [ 1.484499] Call trace: [ 1.486930] device_del+0x40/0x394 [ 1.490314] device_unregister+0x20/0x7c [ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0 Look at dma_async_device_register() function error path, channel device unregistration is done only if chan->local is not NULL. Then add the same condition at the beginning of __dma_async_device_channel_unregister() function, to avoid NULL pointer issue whatever the API used to reach this function.

CVE ID : CVE-2023-52492
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/047fce470412ab64cb7345f9ff5d06919078ad79 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2ab32986a0b9e329eb7f8f04dd57cc127f797c08 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7f0ccfad2031eddcc510caf4e57f2d4aa2d8a50b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9263fd2a63487c6d04cbb7b74a48fb12e1e352d0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9de69732dde4e443c1c7f89acbbed2c45a6a8e17 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f5c24d94512f1b288262beda4d3dcb9629222fc7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52493

First published on : 11-03-2024 18:15:16
Last modified on : 11-03-2024 18:15:16

Description :
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Drop chan lock before queuing buffers Ensure read and write locks for the channel are not taken in succession by dropping the read lock from parse_xfer_event() such that a callback given to client can potentially queue buffers and acquire the write lock in that process. Any queueing of buffers should be done without channel read lock acquired as it can result in multiple locks and a soft lockup. [mani: added fixes tag and cc'ed stable]

CVE ID : CVE-2023-52493
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/01bd694ac2f682fb8017e16148b928482bc8fa4b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/20a6dea2d1c68d4e03c6bb50bc12e72e226b5c0e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3c5ec66b4b3f6816f3a6161538672e389e537690 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6e4c84316e2b70709f0d00c33ba3358d9fc8eece | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b8eff20d87092e14cac976d057cb0aea2f1d0830 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/eaefb9464031215d63c0a8a7e2bfaa00736aa17e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52494

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer.

CVE ID : CVE-2023-52494
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/2df39ac8f813860f79782807c3f7acff40b3c551 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/94991728c84f8df54fd9eec9b85855ef9057ea08 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a9ebfc405fe1be145f414eafadcbf09506082010 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ecf8320111822a1ae5d5fc512953eab46d543d0b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/eff9704f5332a13b08fbdbe0f84059c9e7051d5f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52495

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix port sanity check The PMIC GLINK altmode driver currently supports at most two ports. Fix the incomplete port sanity check on notifications to avoid accessing and corrupting memory beyond the port array if we ever get a notification for an unsupported port.

CVE ID : CVE-2023-52495
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/532a5557da6892a6b2d5793052e1bce1f4c9e177 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c4fb7d2eac9ff9bfc35a2e4d40c7169a332416e0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d26edf4ee3672cc9828f2a3ffae34086a712574d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52498

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example). Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false.

CVE ID : CVE-2023-52498
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/7839d0078e0d5e6cc2fa0b0dfbee71de74f1e557 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9bd3dce27b01c51295b60e1433e1dadfb16649f7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a1d62c775b07213c73f81ae842424c74dd14b5f0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e1c9d32c98309ae764893a481552d3f99d46cb34 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e681e29d1f59a04ef773296e4bebb17b1b79f8fe | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f46eb832389f162ad13cb780d0b8cde93641990d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26608

First published on : 11-03-2024 18:15:18
Last modified on : 11-03-2024 18:15:18

Description :
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbd_nl_policy Similar to a reported issue (check the commit b33fb5b801c6 ("net: qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds another global out-of-bounds read for policy ksmbd_nl_policy. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff8f24b100 by task syz-executor.1/62810 CPU: 0 PID: 62810 Comm: syz-executor.1 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 __nlmsg_parse include/net/netlink.h:748 [inline] genl_family_rcv_msg_attrs_parse.constprop.0+0x1b0/0x290 net/netlink/genetlink.c:565 genl_family_rcv_msg_doit+0xda/0x330 net/netlink/genetlink.c:734 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x441/0x780 net/netlink/genetlink.c:850 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdd66a8f359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdd65e00168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdd66bbcf80 RCX: 00007fdd66a8f359 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000003 RBP: 00007fdd66ada493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc84b81aff R14: 00007fdd65e00300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: ksmbd_nl_policy+0x100/0xa80 The buggy address belongs to the physical page: page:0000000034f47940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ccc4b flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00073312c8 ffffea00073312c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff8f24b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff8f24b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff8f24b100: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 07 f9 ^ ffffffff8f24b180: f9 f9 f9 f9 00 05 f9 f9 f9 f9 f9 f9 00 00 00 05 ffffffff8f24b200: f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9 00 00 04 f9 ================================================================== To fix it, add a placeholder named __KSMBD_EVENT_MAX and let KSMBD_EVENT_MAX to be its original value - 1 according to what other netlink families do. Also change two sites that refer the KSMBD_EVENT_MAX to correct value.

CVE ID : CVE-2024-26608
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/2c939c74ef0b74e99b92e32edc2a59f9b9ca3d5a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6993328a4cd62a24df254b587c0796a4a1eecc95 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9863a53100f47652755545c2bd43e14a1855104d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aaa1f1a2ee80888c12ae2783f3a0be10e14067c5 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ebeae8adf89d9a82359f6659b1663d09beec2faa | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26609

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject QUEUE/DROP verdict parameters This reverts commit e0abdadcc6e1. core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP verdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar, or 0. Due to the reverted commit, its possible to provide a positive value, e.g. NF_ACCEPT (1), which results in use-after-free. Its not clear to me why this commit was made. NF_QUEUE is not used by nftables; "queue" rules in nftables will result in use of "nft_queue" expression. If we later need to allow specifiying errno values from userspace (do not know why), this has to call NF_DROP_GETERR and check that "err <= 0" holds true.

CVE ID : CVE-2024-26609
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/4e66422f1b56149761dc76030e6345d1cca6f869 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/55a60251fa50d4e68175e36666b536a602ce4f6c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6653118b176a00915125521c6572ae8e507621db | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8365e9d92b85fda975a5ece7a3a139cb964018c8 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8e34430e33b8a80bc014f3efe29cac76bc30a4b4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/960cf4f812530f01f6acc6878ceaa5404c06af7b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f05a497e7bc8851eeeb3a58da180ba469efebb05 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f342de4e2f33e0e39165d8639387aa6c19dff660 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26610

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix a memory corruption iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in bytes, we'll write past the buffer.

CVE ID : CVE-2024-26610
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26611

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF helpers for ZC XDP Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory type is set to MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens: [1136314.192256] BUG: kernel NULL pointer dereference, address: 0000000000000034 [1136314.203943] #PF: supervisor read access in kernel mode [1136314.213768] #PF: error_code(0x0000) - not-present page [1136314.223550] PGD 0 P4D 0 [1136314.230684] Oops: 0000 [#1] PREEMPT SMP NOPTI [1136314.239621] CPU: 8 PID: 54203 Comm: xdpsock Not tainted 6.6.0+ #257 [1136314.250469] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [1136314.265615] RIP: 0010:__xdp_return+0x6c/0x210 [1136314.274653] Code: ad 00 48 8b 47 08 49 89 f8 a8 01 0f 85 9b 01 00 00 0f 1f 44 00 00 f0 41 ff 48 34 75 32 4c 89 c7 e9 79 cd 80 ff 83 fe 03 75 17 <f6> 41 34 01 0f 85 02 01 00 00 48 89 cf e9 22 cc 1e 00 e9 3d d2 86 [1136314.302907] RSP: 0018:ffffc900089f8db0 EFLAGS: 00010246 [1136314.312967] RAX: ffffc9003168aed0 RBX: ffff8881c3300000 RCX: 0000000000000000 [1136314.324953] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffc9003168c000 [1136314.336929] RBP: 0000000000000ae0 R08: 0000000000000002 R09: 0000000000010000 [1136314.348844] R10: ffffc9000e495000 R11: 0000000000000040 R12: 0000000000000001 [1136314.360706] R13: 0000000000000524 R14: ffffc9003168aec0 R15: 0000000000000001 [1136314.373298] FS: 00007f8df8bbcb80(0000) GS:ffff8897e0e00000(0000) knlGS:0000000000000000 [1136314.386105] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1136314.396532] CR2: 0000000000000034 CR3: 00000001aa912002 CR4: 00000000007706f0 [1136314.408377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1136314.420173] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1136314.431890] PKRU: 55555554 [1136314.439143] Call Trace: [1136314.446058] <IRQ> [1136314.452465] ? __die+0x20/0x70 [1136314.459881] ? page_fault_oops+0x15b/0x440 [1136314.468305] ? exc_page_fault+0x6a/0x150 [1136314.476491] ? asm_exc_page_fault+0x22/0x30 [1136314.484927] ? __xdp_return+0x6c/0x210 [1136314.492863] bpf_xdp_adjust_tail+0x155/0x1d0 [1136314.501269] bpf_prog_ccc47ae29d3b6570_xdp_sock_prog+0x15/0x60 [1136314.511263] ice_clean_rx_irq_zc+0x206/0xc60 [ice] [1136314.520222] ? ice_xmit_zc+0x6e/0x150 [ice] [1136314.528506] ice_napi_poll+0x467/0x670 [ice] [1136314.536858] ? ttwu_do_activate.constprop.0+0x8f/0x1a0 [1136314.546010] __napi_poll+0x29/0x1b0 [1136314.553462] net_rx_action+0x133/0x270 [1136314.561619] __do_softirq+0xbe/0x28e [1136314.569303] do_softirq+0x3f/0x60 This comes from __xdp_return() call with xdp_buff argument passed as NULL which is supposed to be consumed by xsk_buff_free() call. To address this properly, in ZC case, a node that represents the frag being removed has to be pulled out of xskb_list. Introduce appropriate xsk helpers to do such node operation and use them accordingly within bpf_xdp_adjust_tail().

CVE ID : CVE-2024-26611
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/5cd781f7216f980207af09c5e0e1bb1eda284540 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/82ee4781b8200e44669a354140d5c6bd966b8768 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c5114710c8ce86b8317e9b448f4fd15c711c2a82 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26612

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: netfs, fscache: Prevent Oops in fscache_put_cache() This function dereferences "cache" and then checks if it's IS_ERR_OR_NULL(). Check first, then dereference.

CVE ID : CVE-2024-26612
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1c45256e599061021e2c848952e50f406457e448 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3be0b3ed1d76c6703b9ee482b55f7e01c369cc68 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4200ad3e46ce50f410fdda302745489441bc70f0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/82a9bc343ba019665d3ddc1d9a180bf0e0390cf3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26613

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv Syzcaller UBSAN crash occurs in rds_cmsg_recv(), which reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1), but with array size of 4 (RDS_RX_MAX_TRACES). Here 'j' is assigned from rs->rs_rx_trace[i] and in-turn from trace.rx_trace_pos[i] in rds_recv_track_latency(), with both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the off-by-one bounds check in rds_recv_track_latency() to prevent a potential crash in rds_cmsg_recv(). Found by syzcaller: ================================================================= UBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39 index 4 is out of range for type 'u64 [4]' CPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348 rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585 rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0xe2/0x160 net/socket.c:1066 __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246 __do_sys_recvfrom net/socket.c:2264 [inline] __se_sys_recvfrom net/socket.c:2260 [inline] __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b ==================================================================

CVE ID : CVE-2024-26613
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/00d1ee8e1d02194f7b7b433e904e04bbcd2cc0dc | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0b787c2dea15e7a2828fa3a74a5447df4ed57711 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/13e788deb7348cc88df34bed736c3b3b9927ea52 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/344350bfa3b4b37d7c3d5a00536e6fbf0e953fbf | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5ae8d50044633306ff160fcf7faa24994175efe1 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/71024928b3f71ce4529426f8692943205c58d30b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7a73190ea557e7f26914b0fe04c1f57a96cb771f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a37ae111db5e0f7e3d6b692056c30e3e0f6f79cd | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26614

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) Code: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7 30 20 ce 8f e8 ad 56 42 ff <0f> 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900 RBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000 R13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000 FS: 00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0 Call Trace: <IRQ> _raw_spin_unlock (kernel/locking/spinlock.c:186) inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321) inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358) tcp_check_req (net/ipv4/tcp_minisocks.c:868) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) process_backlog (./include/linux/rcupdate.h:779) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6604) __do_softirq (./arch/x86/include/asm/jump_label.h:27) do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:381) __dev_queue_xmit (net/core/dev.c:4374) ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235) __ip_queue_xmit (net/ipv4/ip_output.c:535) __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469) tcp_rcv_state_process (net/ipv4/tcp_input.c:6657) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929) __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968) release_sock (net/core/sock.c:3536) inet_wait_for_connect (net/ipv4/af_inet.c:609) __inet_stream_connect (net/ipv4/af_inet.c:702) inet_stream_connect (net/ipv4/af_inet.c:748) __sys_connect (./include/linux/file.h:45 net/socket.c:2064) __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070) do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) RIP: 0033:0x7fa10ff05a3d Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48 RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640 R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20 </TASK> The issue triggering process is analyzed as follows: Thread A Thread B tcp_v4_rcv //receive ack TCP packet inet_shutdown tcp_check_req tcp_disconnect //disconnect sock ... tcp_set_state(sk, TCP_CLOSE) inet_csk_complete_hashdance ... inet_csk_reqsk_queue_add ---truncated---

CVE ID : CVE-2024-26614
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/168e7e599860654876c2a1102a82610285c02f02 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/198bc90e0e734e5f98c3d2833e8390cac3df61b2 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3982fe726a63fb3de6005e534e2ac8ca7e0aca2a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b1e0a68a0cd2a83259c444f638b417a8fffc6855 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bc99dcedd2f422d602516762b96c8ef1ae6b2882 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d86cc6ab33b085eaef27ea88b78fc8e2375c0ef3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26615

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump.

CVE ID : CVE-2024-26615
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1fea9969b81c67d0cb1611d1b8b7d19049d937be | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/27aea64838914c6122db5b8bd4bed865c9736f22 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/68b888d51ac82f2b96bf5e077a31d76afcdef25a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6994dba06321e3c48fdad0ba796a063d9d82183a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a164c2922675d7051805cdaf2b07daffe44f20d9 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dbc153fd3c142909e564bb256da087e13fbf239c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26616

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned [BUG] There is a bug report that, on a ext4-converted btrfs, scrub leads to various problems, including: - "unable to find chunk map" errors BTRFS info (device vdb): scrub: started on devid 1 BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 4096 BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 45056 This would lead to unrepariable errors. - Use-after-free KASAN reports: ================================================================== BUG: KASAN: slab-use-after-free in __blk_rq_map_sg+0x18f/0x7c0 Read of size 8 at addr ffff8881013c9040 by task btrfs/909 CPU: 0 PID: 909 Comm: btrfs Not tainted 6.7.0-x64v3-dbg #11 c50636e9419a8354555555245df535e380563b2b Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2023.11-2 12/24/2023 Call Trace: <TASK> dump_stack_lvl+0x43/0x60 print_report+0xcf/0x640 kasan_report+0xa6/0xd0 __blk_rq_map_sg+0x18f/0x7c0 virtblk_prep_rq.isra.0+0x215/0x6a0 [virtio_blk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] virtio_queue_rqs+0xc4/0x310 [virtio_blk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] blk_mq_flush_plug_list.part.0+0x780/0x860 __blk_flush_plug+0x1ba/0x220 blk_finish_plug+0x3b/0x60 submit_initial_group_read+0x10a/0x290 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] flush_scrub_stripes+0x38e/0x430 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrub_stripe+0x82a/0xae0 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrub_chunk+0x178/0x200 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrub_enumerate_chunks+0x4bc/0xa30 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] btrfs_scrub_dev+0x398/0x810 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] btrfs_ioctl+0x4b9/0x3020 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] __x64_sys_ioctl+0xbd/0x100 do_syscall_64+0x5d/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f47e5e0952b - Crash, mostly due to above use-after-free [CAUSE] The converted fs has the following data chunk layout: item 2 key (FIRST_CHUNK_TREE CHUNK_ITEM 2214658048) itemoff 16025 itemsize 80 length 86016 owner 2 stripe_len 65536 type DATA|single For above logical bytenr 2214744064, it's at the chunk end (2214658048 + 86016 = 2214744064). This means btrfs_submit_bio() would split the bio, and trigger endio function for both of the two halves. However scrub_submit_initial_read() would only expect the endio function to be called once, not any more. This means the first endio function would already free the bbio::bio, leaving the bvec freed, thus the 2nd endio call would lead to use-after-free. [FIX] - Make sure scrub_read_endio() only updates bits in its range Since we may read less than 64K at the end of the chunk, we should not touch the bits beyond chunk boundary. - Make sure scrub_submit_initial_read() only to read the chunk range This is done by calculating the real number of sectors we need to read, and add sector-by-sector to the bio. Thankfully the scrub read repair path won't need extra fixes: - scrub_stripe_submit_repair_read() With above fixes, we won't update error bit for range beyond chunk, thus scrub_stripe_submit_repair_read() should never submit any read beyond the chunk.

CVE ID : CVE-2024-26616
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/34de0f04684ec00c093a0455648be055f0e8e24f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/642b9c520ef2f104277ad1f902f8526edbe087fb | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f546c4282673497a06ecb6190b50ae7f6c85b02f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26617

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: move mmu notification mechanism inside mm lock Move mmu notification mechanism inside mm lock to prevent race condition in other components which depend on it. The notifier will invalidate memory range. Depending upon the number of iterations, different memory ranges would be invalidated. The following warning would be removed by this patch: WARNING: CPU: 0 PID: 5067 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 kvm_mmu_notifier_change_pte+0x860/0x960 arch/x86/kvm/../../../virt/kvm/kvm_main.c:734 There is no behavioural and performance change with this patch when there is no component registered with the mmu notifier. [[email protected]: narrow the scope of `range', per Sean]

CVE ID : CVE-2024-26617
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/05509adf297924f51e1493aa86f9fcde1433ed80 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4cccb6221cae6d020270606b9e52b1678fc8b71a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26618

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Always exit sme_alloc() early with existing storage When sme_alloc() is called with existing storage and we are not flushing we will always allocate new storage, both leaking the existing storage and corrupting the state. Fix this by separating the checks for flushing and for existing storage as we do for SVE. Callers that reallocate (eg, due to changing the vector length) should call sme_free() themselves.

CVE ID : CVE-2024-26618
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/569156e4fa347237f8fa2a7e935d860109c55ac4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/814af6b4e6000e574e74d92197190edf07cc3680 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc7eb8755797ed41a0d1b5c0c39df3c8f401b3d9 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26619

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix module loading free order Reverse order of kfree calls to resolve use-after-free error.

CVE ID : CVE-2024-26619
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/2fa79badf4bfeffda6b5032cf62b828486ec9a99 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/78996eee79ebdfe8b6f0e54cb6dcc792d5129291 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26620

First published on : 11-03-2024 18:15:19
Last modified on : 11-03-2024 18:15:19

Description :
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix.

CVE ID : CVE-2024-26620
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-1373

First published on : 11-03-2024 10:15:49
Last modified on : 11-03-2024 10:15:49

Description :
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-46209. Reason: This candidate is a duplicate of CVE-2023-46209. Notes: All CVE users should reference CVE-2023-46209 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE ID : CVE-2024-1373
Source : [email protected]
CVSS Score : /

References :

Vulnerability ID : CVE-2024-0039

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0039
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/015c618a0461def93138173a53daaf27ca0630c9 | source : [email protected]
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8 | source : [email protected]
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f0f35273101518d1f3a660b151804e90d0249af3 | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0044

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0044
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/base/+/65bd134b0a82c51a143b89821d5cdd00ddc31792 | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0045

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0045
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7d0f696f450241d8ba7a168ba14fa7b75032f0c9 | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0046

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0046
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0047

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0047
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/base/+/3cd8a2c783fc736627b38f639fe4e239abcf6af1 | source : [email protected]
https://android.googlesource.com/platform/frameworks/base/+/bd5cc7f03256b328438b9bc3791c6b811a2f1f17 | source : [email protected]
https://android.googlesource.com/platform/frameworks/base/+/f516739398746fef7e0cf1437d9a40e2ad3c10bb | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0048

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0048
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0049

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0049
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/av/+/462689f06fd5e72ac63cd87b43ee52554ddf953e | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0050

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead to a local non-security issue with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0050
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/av/+/8f3bc8be16480367bac36effa25706133a0dc22d | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0051

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0051
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/av/+/a52c14a5b49f26efafa581dea653b4179d66909e | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0052

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0052
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/packages/modules/HealthFitness/+/178f4824574fdf33ed4ac584d092240d1c771b04 | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-0053

First published on : 11-03-2024 17:15:45
Last modified on : 11-03-2024 17:15:45

Description :
In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-0053
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/frameworks/base/+/74b03835a7fac15e854d08159922418c99e27e77 | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-23717

First published on : 11-03-2024 17:15:46
Last modified on : 11-03-2024 17:15:46

Description :
In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-23717
Source : [email protected]
CVSS Score : /

References :
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c5c528beb6e1cfed3ec93a3a264084df32ce83c2 | source : [email protected]
https://source.android.com/security/bulletin/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2023-6444

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.

CVE ID : CVE-2023-6444
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/061c59d6-f4a0-4cd1-b945-5e92b9c2b4aa/ | source : [email protected]

Vulnerability ID : CVE-2023-7247

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.

CVE ID : CVE-2023-7247
Source : [email protected]
CVSS Score : /

References :
https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing | source : [email protected]
https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/ | source : [email protected]

Vulnerability ID : CVE-2024-0559

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE ID : CVE-2024-0559
Source : [email protected]
CVSS Score : /

References :
https://research.cleantalk.org/cve-2024-0559/ | source : [email protected]
https://wpscan.com/vulnerability/b257daf2-9540-4a0f-a560-54b47d2b913f/ | source : [email protected]

Vulnerability ID : CVE-2024-0561

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE ID : CVE-2024-0561
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/99b6aa8b-deb9-48f8-8896-f3c8118a4f70/ | source : [email protected]

Vulnerability ID : CVE-2024-1068

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins.

CVE ID : CVE-2024-1068
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/25e3c1a1-3c45-41df-ae50-0e20d86c5484/ | source : [email protected]

Vulnerability ID : CVE-2024-1273

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

CVE ID : CVE-2024-1273
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/9784d7c8-e3aa-42af-ace8-5b2b37ebc9cb/ | source : [email protected]

Vulnerability ID : CVE-2024-1279

First published on : 11-03-2024 18:15:17
Last modified on : 11-03-2024 18:15:17

Description :
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.

CVE ID : CVE-2024-1279
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/4c537264-0c23-428e-9a11-7a9e74fb6b69/ | source : [email protected]

Vulnerability ID : CVE-2024-1290

First published on : 11-03-2024 18:15:18
Last modified on : 11-03-2024 18:15:18

Description :
The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.

CVE ID : CVE-2024-1290
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/a60187d4-9491-435a-bc36-8dd348a1ffa3/ | source : [email protected]

Vulnerability ID : CVE-2024-1487

First published on : 11-03-2024 18:15:18
Last modified on : 11-03-2024 18:15:18

Description :
The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks.

CVE ID : CVE-2024-1487
Source : [email protected]
CVSS Score : /

References :
https://wpscan.com/vulnerability/c028cd73-f30a-4c8b-870f-3071055f0496/ | source : [email protected]

Vulnerability ID : CVE-2024-22005

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In TBD of TBD, there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-22005
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-22006

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 20:15:07

Description :
Android kernel allows Information disclosure.

CVE ID : CVE-2024-22006
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-22007

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In constraint_check of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-22007
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-22008

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-22008
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-22009

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In init_data of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-22009
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-22010

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-22010
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-22011

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-22011
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25984

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In dumpBatteryDefend of dump_power.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25984
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25985

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In bigo_unlocked_ioctl of bigo.c, there is a possible UAF due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25985
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25986

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In ppmp_unprotect_buf of drm_fw.c, there is a possible compromise of protected memory due to a logic error in the code. This could lead to local escalation of privilege to TEE with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25986
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25987

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In pt_sysctl_command of pt.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25987
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25988

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In SAEMM_DiscloseGuti of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25988
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25989

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In gpu_slc_liveness_update of pixel_gpu_slc.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25989
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25990

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In pktproc_perftest_gen_rx_packet_sktbuf_mode of link_rx_pktproc.c, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25990
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25991

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In acpm_tmu_ipc_handler of tmu_plugin.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25991
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25992

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In tmu_tz_control of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25992
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-25993

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In tmu_reset_tmu_trip_counter of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-25993
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27204

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In tmu_set_gov_active of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27204
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27205

First published on : 11-03-2024 19:15:47
Last modified on : 11-03-2024 19:15:47

Description :
In tbd of tbd, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27205
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27206

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In tbd of tbd, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27206
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27207

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 20:15:07

Description :
Android kernel allows Elevation of privilege.

CVE ID : CVE-2024-27207
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27208

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In TBD of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27208
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27209

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In TBD of TBD, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27209
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27210

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27210
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27211

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In AtiHandleAPOMsgType of ati_Main.c, there is a possible OOB write due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27211
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27212

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In init_data of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27212
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27213

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In BroadcastSystemMessage of servicemgr.cpp, there is a possible Remote Code Execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27213
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27218

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In update_freq_data of TBD, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27218
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27219

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In tmu_set_pi of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27219
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27220

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In lpm_req_handler of TBD, there is a possible out of bounds memory access due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27220
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27221

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In update_policy_data of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27221
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27222

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GRANT_URI_PERMISSIONS Attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27222
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27223

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure after authenticating the cell connection with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27223
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27224

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27224
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27225

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In sendHciCommand of bluetooth_hci.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27225
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27226

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In tmu_config_gov_params of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27226
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27227

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 20:15:07

Description :
Android kernel allows Remote code execution.

CVE ID : CVE-2024-27227
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27228

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In TBD of TBD, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27228
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27229

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In ss_SendCallBarringPwdRequiredIndMsg of ss_CallBarring.c, there is a possible null pointer deref due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27229
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27230

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In ProtocolPsKeepAliveStatusAdapter::getCode() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27230
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27233

First published on : 11-03-2024 19:15:48
Last modified on : 11-03-2024 19:15:48

Description :
In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27233
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27234

First published on : 11-03-2024 19:15:49
Last modified on : 11-03-2024 19:15:49

Description :
In fvp_set_target of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27234
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27235

First published on : 11-03-2024 19:15:49
Last modified on : 11-03-2024 19:15:49

Description :
In plugin_extern_func of TBD, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27235
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27236

First published on : 11-03-2024 19:15:49
Last modified on : 11-03-2024 19:15:49

Description :
In aoc_unlocked_ioctl of aoc.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27236
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-27237

First published on : 11-03-2024 19:15:49
Last modified on : 11-03-2024 19:15:49

Description :
In wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE ID : CVE-2024-27237
Source : [email protected]
CVSS Score : /

References :
https://source.android.com/security/bulletin/pixel/2024-03-01 | source : [email protected]

Vulnerability ID : CVE-2024-2357

First published on : 11-03-2024 20:15:07
Last modified on : 11-03-2024 20:15:07

Description :
The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.

CVE ID : CVE-2024-2357
Source : d42dc95b-23f1-4e06-9076-20753a0fb0df
CVSS Score : /

References :
https://libreswan.org/security/CVE-2024-2357 | source : d42dc95b-23f1-4e06-9076-20753a0fb0df