Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-12975	Silicon Labs CPC can leak information in full duplex SPI Description: A buffer overread can occur in the CPC application when operating in full duplex SPI upon receiving an invalid packet over the SPI interface. CVSS: LOW (1.0) EPSS Score: 0.02% Source: CVE March 7th, 2025 (about 1 month ago)
CVE-2024-45310	Amazon Linux 2023 : ecs-init (ALAS2023-2025-886) Description: Nessus Plugin ID 232286 with Low Severity Synopsis The remote Amazon Linux 2023 host is missing a security update. Description It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-886 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the rem... CVSS: LOW (3.6) EPSS Score: 0.03% Source: Tenable Plugins March 7th, 2025 (about 1 month ago)
CVE-2024-54502	Linux Distros Unpatched Vulnerability : CVE-2024-54502 Description: Nessus Plugin ID 230407 with Medium Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2024-54502)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230407 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-53589	Linux Distros Unpatched Vulnerability : CVE-2024-53589 Description: Nessus Plugin ID 230440 with High Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files. (CVE-2024-53589)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230440 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-50247	Linux Distros Unpatched Vulnerability : CVE-2024-50247 Description: Nessus Plugin ID 230441 with High Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check if more than chunk- size bytes are written A incorrectly formatted chunk may decompress into more than LZNT_CHUNK_SIZE bytes and a index out of bounds will occur in s_max_off. (CVE-2024-50247)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230441 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-53136	Linux Distros Unpatched Vulnerability : CVE-2024-53136 Description: Nessus Plugin ID 230465 with Medium Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm: revert mm: shmem: fix data-race in shmem_getattr() Revert d949d1d14fa2 (mm: shmem: fix data-race in shmem_getattr()) as suggested by Chuck [1]. It is causing deadlocks when accessing tmpfs over NFS. As Hugh commented, added just to silence a syzbot sanitizer splat: added where there has never been any practical problem. (CVE-2024-53136)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230465 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-50086	Linux Distros Unpatched Vulnerability : CVE-2024-50086 Description: Nessus Plugin ID 230493 with High Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add session_lock when setting SMB2_SESSION_EXPIRED and referece count to session struct not to free session while it is being used. (CVE-2024-50086)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230493 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-49899	Linux Distros Unpatched Vulnerability : CVE-2024-49899 Description: Nessus Plugin ID 230495 with Medium Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize denominators' default to 1 [WHAT & HOW] Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. (CVE-2024-49899)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230495 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-50262	Linux Distros Unpatched Vulnerability : CVE-2024-50262 Description: Nessus Plugin ID 230496 with High Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. (CVE-2024-50262)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230496 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)
CVE-2024-49915	Linux Distros Unpatched Vulnerability : CVE-2024-49915 Description: Nessus Plugin ID 230515 with Medium Severity Synopsis The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched. Description The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782) (CVE-2024-49915)Note that Nessus relies on the presence of the package as reported by the vendor. Solution There is no known solution at this time. Read more at https://www.tenable.com/plugins/nessus/230515 CVSS: LOW (0.0) Source: Tenable Plugins March 6th, 2025 (about 1 month ago)