CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-39282	net: wwan: t7xx: Fix FSM command timeout issue Description: In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix FSM command timeout issue When driver processes the internal state change command, it use an asynchronous thread to process the command operation. If the main thread detects that the task has timed out, the asynchronous thread will panic when executing the completion notification because the main thread completion object has been released. BUG: unable to handle page fault for address: fffffffffffffff8 PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:complete_all+0x3e/0xa0 [...] Call Trace: ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? complete_all+0x3e/0xa0 fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xd8/0x110 ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)] ? __pfx_kthread+0x10/0x10 ret_from_fork+0x38/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 [...] CR2: fffffffffffffff8 ---[ end trace 0000000000000000 ]--- Use the reference counter to ensure safe release as Sergey suggests: https://lore.kernel.org/all/[email protected]/ EPSS Score: 0.05% Source: CVE January 16th, 2025 (6 months ago)
CVE-2024-36751	An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. Description: An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. EPSS Score: 0.04% Source: CVE January 16th, 2025 (6 months ago)
CVE-2024-36476	RDMA/rtrs: Ensure 'ib_sge list' is accessible Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 This change ensures the variable is available for subsequent operations that require it. [1] https://lore.kernel.org/linux-rdma/[email protected]/ EPSS Score: 0.04% Source: CVE January 16th, 2025 (6 months ago)
CVE-2024-12084	Rsync: heap buffer overflow in rsync due to improper checksum length handling Description: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. EPSS Score: 0.06% Source: CVE January 16th, 2025 (6 months ago)
CVE-2024-11029	Freeipa: administrative user data leaked through systemd journal Description: A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials. EPSS Score: 0.05% Source: CVE January 16th, 2025 (6 months ago)
	Daily Dose of Dark Web Informer - January 15th, 2025 Description: This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts. Source: DarkWebInformer January 16th, 2025 (6 months ago)
	GoDaddy slapped with wet lettuce for years of lax security and 'several major breaches' Source: TheRegister January 16th, 2025 (6 months ago)
	[islandora/crayfish] Crayfish allows Remote Code Execution via Homarus Authorization header Description: Impact What kind of vulnerability is it? Who is impacted? Remote code execution may be possible in web-accessible installations of Homarus in certain configurations. Patches Has the problem been patched? What versions should users upgrade to? The issue has been patched in islandora/crayfish:4.1.0 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? The exploit requires making a request against the Homarus's /convert endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Configure auth in Crayfish to be more strongly required, such that requests with Authorization headers that do not validate are rejected before the problematic CLI interpolation occurs. References Are there any links users can visit to find out more? XBOW-024-071 References https://github.com/Islandora/Crayfish/security/advisories/GHSA-mm6v-68qp-f9fw https://github.com/Islandora/Crayfish/commit/64cb4cec688928798cc40e6f0a0e863d7f69fd89 https://github.com/advisories/GHSA-mm6v-68qp-f9fw Source: Github Advisory Database (Composer) January 15th, 2025 (6 months ago)
	Prestige Maintenance USA has Fallen Victim to MEDUSA Ransomware Description: Prestige Maintenance USA has Fallen Victim to MEDUSA Ransomware Source: DarkWebInformer January 15th, 2025 (6 months ago)
	DJI loosens flight restrictions, decides to trust operators to follow FAA rules Source: TheRegister January 15th, 2025 (6 months ago)