Team IT Security - 📰 Alle Kategorien

Datalab Marker v2 vs MinerU, Docling, and Liteparse: Benchmark Breakdown

Sat, 25 Jul 2026 19:49:21 +0200

Datalab rewrote Marker as a three-mode pipeline. Version 2 hits 76.0 on olmOCR-bench and sustains 2.9 pages per second on one B200 — over 5× MinerU's pipeline backend, while beating Docling on both accuracy and speed. Here's how it compares against MinerU, Docling and LiteParse, and which one fits your use case.

The post Datalab Marker v2 vs MinerU, Docling, and Liteparse: Benchmark Breakdown appeared first on MarkTechPost.

Datalab’s Marker 2 vs MinerU, Docling and LiteParse: 76.0 on olmOCR-bench at 5× MinerU’s Throughput

Sat, 25 Jul 2026 04:18:55 +0200

The post Datalab’s Marker 2 vs MinerU, Docling and LiteParse: 76.0 on olmOCR-bench at 5× MinerU’s Throughput appeared first on MarkTechPost.

The complete guide to Node.js frameworks

Mon, 13 Jul 2026 17:04:36 +0200

Node.js is one of the most popular server-side platforms, especially for web applications. It gives you non-blocking JavaScript without a browser, plus an enormous ecosystem. That ecosystem is one of Node’s chief strengths, making it a go-to option for server development.

This article is a quick tour of the most popular web frameworks for server development on Node.js. We’ll look at minimalist tools like Express.js, batteries-included frameworks like Nest.js, and full-stack frameworks like Next.js. You’ll get an overview of the frameworks and a taste of what it’s like to write a simple server application in each one.

Minimalist web frameworks

When it comes to Node web frameworks, minimalist doesn’t mean limited. Instead, these frameworks provide the essential features required to do the job for which they are intended. The frameworks in this list also tend to be highly extensible, so you can customize them as needed. With minimalist frameworks, pluggable extensibility is the name of the game.

Express.js

At over 47 million weekly downloads on npm, Express is one of the most-installed software packages of all time—and for good reason. Express gives you basic web endpoint routing and request-and-response handling inside an extensible framework that is easy to understand. Most other frameworks in this category have adopted the basic style of describing a route from Express. This framework is the obvious choice when you simply need to create some routes for HTTP, and you don’t mind a DIY approach for anything extra.

Despite its simplicity, Express is fully-featured when it comes to things like route parameters and request handling. Here is a simple Express endpoint that returns a dog breed based on an ID:

import express from 'express';

const app = express();
const port = 3000;

// In-memory array of dog breeds
const dogBreeds = [
  "Shih Tzu",
  "Great Pyrenees",
  "Tibetan Mastiff",
  "Australian Shepherd"
];
app.get('/dogs/:id', (req, res) => {
  // Convert the id from a string to an integer
  const id = parseInt(req.params.id, 10);

  // Check if the id is a valid number and within the array bounds
  if (id >= 0 && id  {
  console.log(`Server running at http://localhost:${port}`);
});

You can easily see how the route is defined here: a string representation of a URL, followed by a function that receives a request and response object. The process of creating the server and listening on a port is simple.

If you are coming from a framework like Next, the biggest thing you might notice about Express is that it lacks a file-system based router. On the other hand, it offers a huge range of middleware plugins to help with essential functions like security.

Koa

Koa was created by the original creators of Espress, who took the lessons learned from that project and used them for a fresh take on the JavaScript server. Koa’s focus is providing a minimalist core engine. It uses async/await functions for middleware rather than chaining with next() calls. This can give you a cleaner server, especially when there are many plugins. It also makes the error handling less clunky for middleware.

Koa also differs from Express by exposing a unified context object instead of separate request and response objects, which makes for a somewhat less cluttered API. Here is how Koa manages the same route we created in Express:

router.get('/dogs/:id', (ctx) => {
  const id = parseInt(ctx.params.id, 10);

  if (id >= 0 && id < dogBreeds.length) {
    ctx.status = 200;
    ctx.body = { breed: dogBreeds[id] };
  } else {
    ctx.status = 404;
    ctx.body = { error: 'Dog breed not found' };
  }
});

The only real difference is the combined context object.

Koa’s middleware mechanism is also worth a look. Here’s a simple logging plugin in Koa:

const logger = async (ctx, next) => {
  await next(); // This passes control to the router
  console.log(`${ctx.method} ${ctx.url} - ${ctx.status}`);
};

// Use the logger middleware for all requests
app.use(logger);

Fastify

Fastify lets you define schemas for your APIs. This is an up-front, formal mechanism for describing what the server supports:

const schema = {
  params: {
    type: 'object',
    properties: {
      id: { type: 'integer' }
    }
  },
  response: {
    200: {
      type: 'object',
      properties: {
        breed: { type: 'string' }
      }
    },
    404: {
      type: 'object',
      properties: {
        error: { type: 'string' }
      }
    }
  }
};

fastify.get('/dogs/:id', { schema }, (request, reply) => {
  const id = request.params.id;

  if (id >= 0 && id  {
  if (err) {
    fastify.log.error(err);
    process.exit(1);
  }
  console.log(`Server running at ${address}`);
});

From this example, you can see the actual endpoint definition is similar to Express and Koa, but we define a schema for the API. The schema is not strictly necessary; it is possible to define endpoints without it. In that case, Fastify behaves much like Express, but with superior performance.

Hono

Hono emphasizes simplicity. You can define a server and endpoint with as little as:

const app = new Hono()
app.get('/', (c) => c.text('Hello, Infoworld!'))

And here’s how our dog breed example looks:

app.get('/dogs/:id', (c) => {
  // Get the id parameter from the request URL
  const id = parseInt(c.req.param('id'), 10);

  // Check if the id is a valid number and within the array bounds
  if (id >= 0 && id < dogBreeds.length) {
    // Return a JSON response with a 200 OK status (default)
    return c.json({ breed: dogBreeds[id] });
  } else {
    // Set status to 404 and return a JSON error message
    c.status(404);
    return c.json({ error: 'Dog breed not found' });
  }
});

As you can see, Hono provides a unified context object, similar to Koa.

Nitro.js

Nitro is the back end for several full-stack frameworks, including Nuxt.js. As part of the UnJS ecosystem, Nitro goes further than Express in providing cloud-native tooling support. It includes a universal storage adapter and deployment support for serverless and cloud deployment targets.

Also see: Intro to Nitro: The server engine built for modern JavaScript.

Like Next.js, Nitro uses filesystem-based routing, so our Dog Finder API would exist at the following filepath:

/api/dogs/:id

The handler might look like this:

export default defineEventHandler((event) => {
  // Get the dynamic parameter from the event context
  const { id } = getRouterParams(event);
  const parsedId = parseInt(id, 10);

  // Check if the id is a valid number and within the array bounds
  if (parsedId >= 0 && parsedId < dogBreeds.length) {
    // Nitro handles JSON serialization
    return { breed: dogBreeds[parsedId] };
  } else {
    setResponseStatus(event, 404);
    return { error: 'Dog breed not found' };
  }
});

Nitro inhabits the middle ground between a pure tool like Express and a full-blown stack, which is why full-stack front ends often use Nitro on the back end.

Batteries-included frameworks

Although Express and other minimalist frameworks set the standard for simplicity, more opinionated frameworks can be useful if you want additional features out of the box.

Nest.js

Nest is a progressive framework built with TypeScript from the ground up. Nest is actually a layer on top of Express (or Fastify), with additional services. It is inspired by Angular and incorporates the kind of architectural support found there. In particular, it includes dependency injection. Nest also uses annotated controllers for endpoints.

Also see: Intro to Nest.js: Server-side JavaScript development on Node.

Here is an example of injecting a dog finder provider into a controller:

// The provider:
import { Injectable, NotFoundException } from '@nestjs/common';

// The @Injectable() decorator marks this class as a provider.
@Injectable()
export class DogsService {
  private readonly dogBreeds = [
    "Shih Tzu",
    "Great Pyrenees",
    "Tibetan Mastiff",
    "Australian Shepherd"
  ];

  findOne(id: number) {
    if (id >= 0 && id < this.dogBreeds.length) {
      return { breed: this.dogBreeds[id] };
    }
    // NestJS has built-in HTTP exception classes for common errors.
    throw new NotFoundException('Dog breed not found');
  }
}

// The controller

import { Controller, Get, Param, ParseIntPipe } from '@nestjs/common';
import { DogsService } from './dogs.service';

@Controller('dogs')
export class DogsController {
  // NestJS injects the DogsService through the constructor.
  // The 'private readonly' syntax is a TypeScript shorthand
  // to both declare and initialize the dogsService member.
  constructor(private readonly dogsService: DogsService) {}

  @Get(':id')
  findOneDog(@Param('id', ParseIntPipe) id: number) {
    // We can now use the service's methods. The ParseIntPipe
    // automatically converts the string URL parameter to a number.
    return this.dogsService.findOne(id);
  }
}

This style is typical of dependency injection frameworks like Angular, as well as Spring. It allows you to declare components as injectable, then consume them anywhere you need them.

In Nest, we’d just add these as modules to make them live.

Adonis.js

Like Nest, Adonis provides a controller layer that you wire together with routes. Adonis is inspired by the model-view-controller (MVC) pattern, so it also includes a layer for modelling data and accessing stores via an ORM. Finally, it provides a validator layer for ensuring data meets requirements.

Routes in Adonis are very simple:

Route.get('/dogs/:id', [DogsController, 'show'])

In this case, DogsController would be the handler for the route, and might look something like:

import type { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'  // Note, ioc means inversion of control, similar to dependency injection

export default class DogsController {
  // The 'show' method handles the logic for the route
  public async show({ params, response }: HttpContextContract) {
    const id = Number(params.id);

    // Check if the id is a valid number and within the array bounds
    if (!isNaN(id) && id >= 0 && id < this.dogBreeds.length) {
      // Use the response object to send a 200 OK JSON response
      return response.ok({ breed: this.dogBreeds[id] });
    } else {
      // Send a 404 Not Found response
      return response.notFound({ error: 'Dog breed not found' });
    }
  }
}

Of course, in a real application, we could define a model layer to handle the actual data access.

Sails

Sails is another MVC-style framework. It is one of the original one-stop-shopping frameworks for Node and includes an ORM layer (Waterline), API generation (Blueprints), and realtime support, including WebSockets.

Sails strives for conventional operation. For example, here’s how you might define a simple model for dogs:

/**
 * Dog.js
 *
 * @description :: A model definition represents a database table/collection.
 * @docs        :: https://sailsjs.com/docs/concepts/models
 */
module.exports = {
  attributes: {
    breed: { type: 'string', required: true },
  },
};

If you run this in Sails, the framework will generate default routes and wire up a NoSQL or SQL datastore based on your configuration. Sails also provides the option to override these defaults and add in your own custom logic.

Full-stack frameworks

Also known as meta-frameworks, these tools combine a front-end framework with a solid back end and various CLI niceties like build chains.

Next.js

Next is a React-based framework built by Vercel. It is largely responsible for the huge growth in popularity of these types of frameworks. Next was the first framework to bring together back-end API definitions with the front end that consumes them. It also introduced file-system routing. In Next and other full-stack frameworks, you get both parts of your stack in one place and you can run them together during development.

In Next, we could define a route at pages/api/dogs/[id].js like so:

export default function handler(req, res) {
  // `req.query.id` comes from the dynamic filename [id].js
  const { id } = req.query;
  const parsedId = parseInt(id, 10);

  if (parsedId >= 0 && parsedId < dogBreeds.length) {
    // If the ID is valid, return the data
    res.status(200).json({ breed: dogBreeds[parsedId] });
  } else {
    // Otherwise, return a 404 error
    res.status(404).json({ error: 'Dog breed not found' });
  }
}

We’d then define the UI component to interact with this route at pages/dogs/[id].js:

import React from 'react';

// This is the React component that renders the page.
// It receives the `dog` object as a prop from getServerSideProps.
function DogPage({ dog }) {
  // Handle the case where the dog wasn't found
  if (!dog) {
    return Dog Breed Not Found;
  }

  return (
    
      Dog Breed Profile
      Breed Name: {dog.breed}
    
  );
}

// This function runs on the server before the page is sent to the browser.
export async function getServerSideProps(context) {
  const { id } = context.params; // Get the ID from the URL

  // Fetch data from our own API route on the server.
  const res = await fetch(`http://localhost:3000/api/dogs/${id}`);
  
  // If the fetch was successful, parse the JSON.
  const dog = res.ok ? await res.json() : null;

  // Pass the fetched data to the DogPage component as props.
  return {
    props: {
      dog,
    },
  };
}

export default DogPage;

Nuxt.js

Nuxt is the same idea as Next, but applied to the Vue front end. The basic pattern is the same, though. First, we’d define a back-end route:

// server/api/dogs/[id].js

// defineEventHandler is Nuxt's helper for creating API handlers.
export default defineEventHandler((event) => {
  // Nuxt automatically parses route parameters.
  const id = getRouterParam(event, 'id');
  const parsedId = parseInt(id, 10);

  if (parsedId >= 0 && parsedId < dogBreeds.length) {
    return { breed: dogBreeds[parsedId] };
  } else {
    // Helper to set the status code and return an error.
    setResponseStatus(event, 404);
    return { error: 'Dog breed not found' };
  }
});

Then, we’d create the UI file in Vue:

// pages/dogs/[id].vue


  
    
      Loading...
    
    
      {{ error.data.error }}
    
    
      Dog Breed Profile
      Breed Name: {{ dog.breed }}

SvelteKit

SvelteKit is the full-stack framework for the Svelte front end. It’s similar to Next and Nuxt, with the main difference being the front-end technology.

In SvelteKit, a back-end route looks like so:

// src/routes/api/dogs/[id]/+server.js

import { json, error } from '@sveltejs/kit';

// This is our data source for the example.
const dogBreeds = [
  "Shih Tzu",
  "Australian Cattle Dog",
  "Great Pyrenees",
  "Tibetan Mastiff",
];

/** @type {import('./$types').RequestHandler} */
export function GET({ params }) {
  // The 'id' comes from the [id] directory name.
  const id = parseInt(params.id, 10);

  if (id >= 0 && id < dogBreeds.length) {
    // The json() helper creates a valid JSON response.
    return json({ breed: dogBreeds[id] });
  }

  // The error() helper is the idiomatic way to return HTTP errors.
  throw error(404, 'Dog breed not found');
}

SvelteKit usually splits the UI into two components. The first component is for loading the data (which can then be run on the server):

// src/routes/dogs/[id]/+page.js

import { error } from '@sveltejs/kit';

/** @type {import('./$types').PageLoad} */
export async function load({ params, fetch }) {
  // Use the SvelteKit-provided `fetch` to call our API endpoint.
  const response = await fetch(`/api/dogs/${params.id}`);

  if (response.ok) {
    const dog = await response.json();
    // The object returned here is passed as the 'data' prop to the page.
    return {
      dog: dog
    };
  }

  // If the API returns an error, forward it to the user.
  throw error(response.status, 'Dog breed not found');
}

The second component is the UI:

// src/routes/dogs/[id]/+page.svelte




  Dog Breed Profile
  Breed Name: {data.dog.breed}

Conclusion

The Node.js ecosystem has moved beyond the “default-to-Express” days. Now, it is worth your time to look for a framework that fits your specific situation.

If you are building microservices or high-performance APIs, where every millisecond counts, you owe it to yourself to look at minimalist frameworks like Fastify or Hono. This class of frameworks gives you raw speed and total control without requiring decisions about infrastructure.

If you are building an enterprise monolith or working with a big team, batteries-included frameworks like Nest or Adonis offer useful structure. The complexity of the initial setup buys you long-term maintainability and makes the codebase more standardized for new developers.

Finally, if your project is a content-rich web application, full-stack meta-frameworks like Next, Nuxt, and SvelteKit offer the best developer experience and the perfect profile of tools.

It’s also worth noting that, while Node remains the standard server-side runtime, alternatives Deno and Bun have both made a name for themselves. Deno has great heritage, is open source with a strong security focus, and has its own framework, Deno Fresh. Bun is respected for its ultra-fast startup and integrated tooling.

The FBI letter was top secret. Fighting it rewrote online privacy law. ✉ Darknet Diaries Ep. 176 NSL

Tue, 07 Jul 2026 09:34:48 +0200

Author: Jack Rhysider - Bewertung: 38x - Views:438

One day Nick got a visit from the FBI demanding he give them data on one of his customers. They asked for it in the form of a National Security Letter or NSL. Something wasn’t right about this letter. It seemed to violate the constitution. So he set out to change the law.

Learn more about Nicks work at [calyxinstitute.org](calyxinstitute.org) and [phreeli.com](phreeli.com).

Check out Cindy’s book [Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance](https://amzn.to/4gXuK2J).

### Sources

* https://www.democracynow.org/2010/8/11/gagged_for_6_years_nick_merrill
* https://globalfreedomofexpression.columbia.edu/cases/u-s-nicholas-merrill-v-loretta-e-lynch-14-cv-9763-vm/
* https://clearinghouse.net/case/12966/
* https://www.theguardian.com/law/2015/dec/06/fbi-national-security-letter-gag-order-nick-merrill
* https://www.aclu.org/documents/national-security-letters
* https://www.eff.org/cases/re-matter-2011-national-security-letter
* Cindy’s Book: Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance

### Attribution

Darknet Diaries is created by [Jack Rhysider](https://twitter.com/jackrhysider).

Assembled by Tristan Ledger.

Episode artwork by [odibagas](https://99designs.com/profiles/2589930).

Mixing by [Proximity Sound](https://proximitysound.com/).

Theme music created by [Breakmaster Cylinder](https://www.personbproductions.com/). Theme song available for listen and download at [bandcamp](https://breakmastercylinder.bandcamp.com/track/darknet-diaries-theme). Or listen to it [on Spotify](https://open.spotify.com/album/3P5CCxXNuUSQldH0GA5ZUy?si=eirhXEyFQaKNf-vdfmb8Jg).

Visit https://darknetdiaries.com/episode/##/ for a list of sources, full transcripts, and to listen to all episodes.

Frame - FFmpeg GUI Rust rewrite

Mon, 06 Jul 2026 23:10:07 +0200

Hi everyone!

I just released Frame 0.30.0.

Frame is an open source FFmpeg GUI written in Rust. It supports video, audio and image conversion, hardware encoding, subtitles, metadata editing, cropping, scaling, batch processing and reusable presets - basically the stuff I got tired of typing FFmpeg commands for.

The biggest change in this release is that I rewrote the frontend from Tauri + Svelte to GPUI-CE.

Frame started as a weekend project, then somehow turned into something people actually used. I kept adding features, fixing issues and maintaining it until I completely burned myself out.

The rewrite was mostly a mental reset. I wanted to build something that felt fun to work on again, and moving everything to Rust with GPUI-CE seemed like a good excuse.

The previous version of Tauri had a lot of issues on Linux because it relied on the problematic WebKitGTK. After rewriting everything in Rust, macOS and Windows saw fewer frame drops in preview panel due to the removal of the bottleneck caused by BE=>FE frame transport via WebSocket.

I’d like to ask you to check how things are going on a Linux distro. I’ve tested it myself on an Ubuntu 26.04 VM, but it’s hard for me to assess performance when I’m so far removed from bare metal.

Thanks!

https://github.com/66HEX/frame

submitted by /u/EastAd9528
[link] [comments]

Enterprises lost Claude Fable 5 for a few weeks. New data shows two-thirds had already built their hedge

Fri, 03 Jul 2026 03:02:52 +0200

Two-thirds of enterprises have hedged their AI model strategy, and the past few weeks of controversy around Anthropic’s Claude Fable 5 model showed why that posture has gone mainstream.

On June 12, a U.S. export-control order pulled Anthropic's Claude Fable 5 — the most capable model on the market — offline for every customer, with no warning and no timeline. It returned this week wrapped in tighter safeguards, after China's Z.ai released its open-weights GLM-5.2 into the vacuum. New VentureBeat Pulse Research, which surveyed 145 enterprises across these last few weeks, shows that two-thirds had already hedged their model strategy before the order came down: 51% blend closed frontier models with open-weight models deployed on their own infrastructure, and another 16% are moving core workflows off closed APIs entirely. The remaining third was all-in on closed ecosystems when the lights went out.

The blackout put a spotlight on vendor dependency, by showing what happens when the model you rely on disappears. But vendor dependency is only the most visible piece of a deeper problem: Most enterprises lack the monitoring to know when an AI system they've put into production stops working correctly.

Just 1 in 10 enterprises has automated monitoring that would catch an AI model drifting, misbehaving, or failing in production. Roughly a quarter would learn of a production failure only when end users — internal or external — report it, or lack the visibility to detect it at all. And 79% of enterprise organizations have already taken a real financial or operational hit from autonomous agents — most often shadow AI, unauthorized agentic work run by enterprises' own employees on corporate credit cards, outside anyone's oversight.

We call this the “Control Gap,” or the distance between how aggressively enterprises are deploying AI and how little of it they can see, own, or govern. June’s blackout turned this into a live stress test.

About this data: VentureBeat Pulse Research surveyed 145 qualified respondents at organizations with 100 or more employees in June 2026, with fielding spanning the Fable 5 blackout that began June 12. The sample is self-selected and directional: 41% work in technology/software, 20% are consultants or advisors, and the respondent base skews senior and technical — CIO/CTO/CISOs (18%), directors of engineering/IT (14%), enterprise architects (12%). More than half of the respondents were from companies with 10,000 employees or more.

While our sample is not huge, what you can trust more than the exact percentages is the pattern: Every question in the survey, independently, points the same way, with deployment running ahead of governance, visibility, and cost control.

The full methodology is in the report.

How the Fable 5 export order rewrote enterprise AI risk

Fable 5 launched June 9 to immediate acclaim — and sticker shock, at $10 per million input tokens and $50 per million output. Three days later, the U.S. government issued an emergency export-control directive barring access by foreign nationals. Anthropic, with no way to verify nationality in real time, suspended the model for everyone.

Z.ai has continued to pick up momentum; on Wednesday it released an open agentic coding environment, called Zcode. OpenAI, meanwhile, previewed its cutting-edge GPT-5.6 line on June 26.

Enterprises had already spent the spring learning what AI dependence costs in dollars. Uber burned through its entire 2026 AI coding budget in four months after Claude Code adoption hit 84% of its roughly 5,000 engineers, Forbes reported. Microsoft canceled most internal Claude Code licenses in its Windows and Microsoft 365 division, steering engineers to its own tooling, according to The Verge.

June added the harder lesson: The model your workflows depend on can vanish overnight, by government order, through no decision of yours or your vendor's. And Chinese companies like DeepSeek were releasing hugely disruptive, powerful models, driving down costs to a fraction of Western ones.

Brian Craig, senior director of architecture at Liberty IT, the Ireland-based engineering arm of Liberty Mutual, one of the world’s largest insurance companies, saw both lessons collide in real time. Craig is Irish, which meant the export order hit him directly as a foreign-national user.

Onstage at VentureBeat's AI Impact event in New York on June 24, mid-blackout, I asked him about it. "Fable arrived, and immediately you saw the sticker price of using it, and you went, 'Ooh, goodness, it better be really good,'" Craig said. "But luckily enough, we didn’t get to use it enough to get to fall in love with it." Then it was gone.

The hedge was already built before the blackout hit

Craig's company was built to route around exactly this kind of disruption. Liberty IT runs what it calls an AI backbone — roughly 50 components spanning security, governance, observability, and orchestration, each independently replaceable.

"You can't lock in right now in one vendor and even one framework," Craig told the room. "You need to keep being able to have the flexibility with that backbone to be able to hook into different models, different vendors, depending not so much on who's the flavor of the day, but on what you can feel confident about for the next six months."

The survey shows Craig has plenty of company. A 51% majority of enterprises run a hybrid posture — closed frontier models for general reasoning, open-weight models deployed locally for specialized execution — and 16% are making a hard pivot, moving core workflows onto open weights running on their own hybrid or private cloud. The 32% holding a closed commitment are candid about why: The operational overhead of self-hosting still outweighs the savings for them. After June, that calculus has a new variable in it.

Defection is now the active posture, and the target may surprise you. Asked which primary AI vendor they are most likely to downsize or phase out over the next 12 months, respondents named Microsoft first at 30% — most citing cutbacks to Copilot and Azure AI frameworks in favor of direct model access — ahead of the 28% who plan to trim no vendor at all. OpenAI drew 21%, largely on pricing volatility, with Anthropic at 15% and Google at 6%. No vendor faces an exodus. But loyalty by inertia has ended: Among these enterprises, actively cutting at least one provider is now more common than expanding across all of them.

Just 1 in 10 enterprises would catch a failing production model automatically

How would an enterprise know if one of its production AI models was drifting, behaving unsafely, or failing to complete tasks? We asked directly. Forty percent say they are very confident they would detect it. The question also asked what that confidence rests on, and respondents split into two camps: 30% rely on humans reviewing critical AI outputs, and just 10% — 14 of the 145 organizations — have automated monitoring and alerting running against production systems. The remaining respondents hold weaker positions still: 32% expect to catch most issues "eventually," 19% say they would likely hear about a failure from end users first, and 8% report no systematic visibility into production AI behavior at all.

That distinction matters because the two approaches are very different. Human review may seem like the gold standard, but it only reaches the outputs someone designates as important for such a review — and it happens at the pace humans can move at, with the inconsistency any manual process carries. Automated monitoring watches everything the system produces, continuously, and flags anomalies as they happen — for the same reason enterprises stopped depending on manual checks for uptime and security a decade ago.

As agentic workloads multiply output volumes far beyond what any review team can read, the manual approach starts to fall behind. The leaders at our June 24 event in New York treat human review as a designed control with automation underneath it. "Nothing gets deployed into production unless it's a human actually reviewing it and signing off," Craig said of Liberty's agentic software factory, where planning, coding, testing, critic, and librarian agents ship features from epic to production.

"It always has to be risk-based. That's why we work for an insurance company." Todd Johnson, the Morgan Stanley managing director who runs agentic AI across the bank's end-of-day P&L controller process, described the same principle from finance: "One of our strong principles in our AI governance generally is that there always has to be human accountability, even if there's a degree of automation." VentureBeat covered Morgan Stanley's new results around its P&L resolution agent system separately.

Liberty Mutual and Morgan Stanley chose manual sign-off deliberately, layered on top of observability, identity, and governance infrastructure. Whether the human-review camp has similar infrastructure underneath is more than a single-select question can establish. The 16% who separately named missing observability tooling as their biggest governance barrier are the ones saying outright that it hasn't been built.

The top governance barrier is organizational: no single owner for AI across platforms

Why does the AI visibility tooling never get built? The respondents' answers suggest it is an organizational shortcoming. The single most-cited barrier to governing AI across platforms is the absence of a single owner or accountable team, at 32%. Vendor opacity follows at 25%, missing tooling at 16% — and a lack of talent lands dead last at 5%.

The skills exist, but the organizational mandate does not: Only 38% say a central team actually governs AI behavior across their platforms today, 21% say ownership is unclear or actively contested between teams, and 17% say no role holds formal accountability at all.

The AI surface being governed makes the vacuum worse. Fully 85% of enterprises run two or more platforms each claiming to be the "primary" AI layer — ERP, ITSM, productivity suite, data platform, each with its own AI, its own controls, and its own assumptions. 36% describe an open contest between four or more. Just 8% have consolidated to one. Asked in a free-text question what one thing they would fix, respondents converged from different directions on the same answer: a single accountable owner, and a control plane that abstracts cost, drift, and model choice away from the end user.

79% have already paid for an agent control failure — led by shadow AI

The cost of the vacuum is showing up on corporate cards.

Asked to name the most severe financial or operational control failure they have experienced from autonomous agents, 49% of enterprises cite shadow AI — departmental teams running unauthorized agentic pipelines on corporate credit cards, bypassing central financial oversight entirely. Another 25% have been hit by an infinite-loop bill, an uncaught recursive workflow racking up thousands in token costs in a single incident, and 6% by an agent that degraded production databases with unthrottled queries. Only 21% report guarded stability, with hard token throttling and budget caps at the infrastructure layer. Add it up: 79% of these enterprises have already paid for an agent control failure in real money or real downtime.

Finally, the economics of tokens suggest the pressure will keep rising. Per-token inference costs are falling 70 to 80% a year, and agentic workloads consume 100 to 500 times the tokens of the LLM tools they replaced.

Brian Gracely, senior director of portfolio strategy at Red Hat, told our New York audience the answer starts with right-sizing: "If I'm simply trying to resolve an insurance claim, I don't need to know about the history of Western civilization in my model. I don't need to know soccer scores."

Enterprises are pairing smaller, specialized models with semantic routing, he said, so the platform decides which requests genuinely need frontier-scale reasoning — and which are burning premium tokens on commodity work. (One adjacent data point from the survey underlines the appetite for pragmatism: 73% of enterprises report little or nothing to show for their custom fine-tuning investments of the past 18 months — a reckoning we'll examine in its own report.)

The bottom line: Replaceability is spreading faster than ownership

The survey describes enterprises moving fast on AI with weak controls underneath. 58% are adding more AI initiatives than they retire. 85% run multiple platforms that each claim to be the primary AI layer. Three times as many enterprises rely on human review to catch a failing production model as have automated monitoring in place. And 79% have already paid for an agent control failure — most often unauthorized agent spending on corporate cards, outside IT's oversight.

On one problem, enterprises have clearly adapted: model dependency. Two-thirds hedge their model strategy, either running open-weight models alongside closed ones (51%) or moving core workflows off closed APIs entirely (16%). The Fable 5 shutdown showed the value of that position — the hedged companies could route around a model that a government order made unavailable overnight.

The remaining problems are internal, and no purchase fixes them: 32% name the lack of a single accountable owner as their top governance barrier, and 17% say no role holds formal accountability for AI at all. Assigning an owner costs nothing and requires no vendor. It still hasn't happened at most of these companies.

Our coming Q3 wave of research will measure whether June changed this — whether enterprises assigned owners and installed automated monitoring, or just added a second model and moved on.

Get the full Control Gap report here.

The themes in this report — agent orchestration, governance, and cost control — are the agenda at VB Transform, VentureBeat's flagship event, July 14-15 at Hotel Nia in Menlo Park, with technical leaders from Visa, GM, Waymo, Intuit, Instacart, LangChain and others. Details and registration here.

Disclosure: VentureBeat's June 24 AI Impact event in New York was sponsored by Red Hat and Intel. Sponsors have no input into VentureBeat Pulse Research survey design, findings, or editorial coverage.

Cisco details Live Protect’s real-time threat mitigation capabilities

Thu, 02 Jul 2026 17:24:11 +0200

Cisco this week shared more details about its new Live Protect package and how it will help Nexus-based data center operators safeguard valuable resources.

Announced and demoed at the recent Cisco Live event, Cisco Live Protect for Nexus infrastructure replaces disruptive, traditional patching cycles with real-time shields that mitigate vulnerabilities instantly, according to Shankar Varanasy, product management leader with Cisco’s data center networking team.

“By orchestrating these proactive defenses through Cisco Nexus One and Cisco Nexus Dashboard on premises, administrators can neutralize threats the moment they arise, ensuring a hardened security posture without sacrificing operational uptime,” Varanasy wrote in a blog post this week. “This approach effectively eliminates the traditional trade-off between security and availability, allowing data centers to maintain a hardened, high-performance posture while ensuring continuous, uninterrupted service delivery.”

“Live Protect uses extended Berkeley Packet Filter (eBPF) technology, a powerful Linux kernel feature, through the Tetragon agent embedded in NX-OS. This allows deep visibility and enforcement directly within the kernel, monitoring system calls, file operations, process control, and network traffic to detect and prevent privilege escalation, control-plane attacks, and other sophisticated threats,” Varanasy wrote.

The Live Protect vulnerability shields are basically policies for a selected, validated vulnerability condition, according to Varanasy. These shields are intended as temporary measures and should be decommissioned once a permanent software fix is applied, he said.

“Live Protect is not a patch,” wrote Tom Gillis, senior vice president and general manager of the Cisco infrastructure & security group, in blog post about Live Protect in June. “It does not replace the need for core lifecycle discipline or permanent software updates. Instead, it serves as a temporary, targeted shield that mitigates the risk of a specific vulnerability with a few clicks. It is intended to be a ‘finger in the dike’, an emergency control that is applied to a running system without disrupting that system between more frequent maintenance windows.”

Live Protect works by using eBPF to run sandboxed programs within the operating system kernel, Gillis wrote: “This gives us the deep visibility and surgical control to intercept and block exploit attempts at the source without changing the kernel’s source code or requiring a system reboot.”

“The unique capabilities of eBPF allow us to make very fine grained, pin-point controls that shield a known vulnerability from being exploited. The shield can be as specific as ‘do not allow this particular process to access this particular file.’ Because these shields are so fine grained and specific, they are designed to have ultra-low false positive rates. In simple terms, that process should never access that particular file. So, we don’t allow it,” Gillis wrote.

“Data center environments are becoming more complex,” Varansasy wrote. “This increases the number of possible entry points for attackers. Older systems and outdated infrastructure make things even harder because they often lack hardened products, software compatibility, and the latest security features. Legacy systems therefore require frequent manual updates, troubleshooting, and patching to react to security threats—especially with technologies like Claude Mythos, Anthropic’s AI model that can autonomously discover and exploit software vulnerabilities at unprecedented speed. Teams spend more time maintaining and securing infrastructure than focusing on business-critical outcomes.”

“Traditional security patching methods require scheduled downtime and maintenance windows, which can delay the deployment of critical fixes and leave networks exposed to zero-day attacks. These delays create windows of vulnerability that sophisticated attackers can exploit,” Varanasy wrote.

World Wide Technology on Cisco Live Protect

Technology provider World Wide Technology (WWT) has been closely watching the development of Cisco Live Protect and called new capability “genuinely exciting.”

“One of the most practically impactful announcements this week was the general availability of Live Protect on the Cisco Nexus 9000 series,” WWT wrote in a blog post following the Cisco Live event.

“The problem Live Protect solves is one that every infrastructure and security team knows well,” WWT wrote. “When a critical vulnerability is disclosed, the permanent fix requires a patch cycle: testing, change control, maintenance windows, coordination across teams. In a high-velocity threat environment, that process takes time an organization may not have. Live Protect inserts Cisco-validated runtime protections immediately, closing exposure while the permanent remediation proceeds through its normal workflow. No reboots required. No disruption to operations.”

Some other Live Protect facts from Cisco:

Live Protect is a compensating control designed to mitigate risk during the interim period between vulnerability disclosure and remediation. Customers should continue to prioritize regular software maintenance and deploy permanent patches or fixed software releases.
Live Protect doesn’t protect customers from everything. Shield availability is determined by a range of factors, including the nature of the vulnerability, exploit characteristics, supported platform, software release, policy, mode, and Cisco validation status.
Availability is specific to the supported Cisco product, software release, policy, mode, delivery path, management surface, and lifecycle support, though currently Nexus systems are the only portfolio offered support now. Other systems such as campus and branch products are expected later this year.

Cisco: AI growth is exposing campus network limits

Wed, 17 Jun 2026 23:53:06 +0200

While enterprise IT leaders have spent the past two years focusing AI infrastructure discussions on GPUs, cloud platforms, and data centers, new Cisco research suggests that enterprise networks may not be ready for the next phase of AI adoption.

A Cisco and Foundry survey of 3,472 IT and networking leaders across 15 countries found AI is already changing traffic patterns across campus and branch environments and exposing capacity, security, and visibility gaps that many organizations aren’t prepared to address.

“We have entered a networking supercycle, because the network is so central to all the AI infrastructure the world is building now,” said Jeetu Patel, Cisco president and chief product officer, in a statement.

The findings reveal that enterprises may need to expand AI readiness planning beyond data centers and cloud environments and pay more attention to the networks connecting employees, applications, and devices. This issue will become more significant as enterprise organizations move beyond generative AI pilots and begin deploying AI agents that communicate continuously with other systems and applications, according to the report.

The Cisco survey found:

Organizations reported a 34% increase in AI-related campus and branch network traffic over the past 12 months.
Traffic is projected to climb 209% over the next three years, with companies broadly deploying AI expecting total network traffic to triple.
73% already face, or expect to face, campus and branch network capacity constraints within the next two years.
67% said AI workloads are increasing east-west traffic between internal systems and applications.
80% said AI has expanded their attack surface.
61% said they are delaying additional AI deployments until they gain more confidence in their security posture.
85% expect moderate or significant growth in AI agent deployments over the next two years.

Changing traffic patterns inside enterprise environments are causing additional pressure for enterprise network teams. (See also: AI traffic is radically reshaping WANs)

“Usually, networks are designed for consistent traffic, like SaaS and CRM traffic, and there aren’t a lot of unpredictable traffic patterns,” said the head of AI strategy for global IT and network engineering operations at a large U.S. technology company who participated in the research. “Suddenly, three AI agents are trying to talk to each other and solve a problem. That is going to be a big thing … how do we support increased east-west traffic?”

Cisco defined aggressive AI adopters as organizations with broad generative AI deployments across the enterprise, but only 30% of those organizations said they are fully prepared to support projected AI growth across their networks. As a result, 93% of IT decision makers said they are accelerating network modernization efforts.

The report also highlighted an observability challenge that could complicate future deployments. As employees and business units increasingly experiment with AI tools, IT organizations may not know what is actually running on their networks.

“Right now, we don’t even know what the AI-driven demand is,” the AI strategy executive said. “Observability is a huge gap. There is experimentation going on all over the place, and there is no way for us to really identify if somebody is deploying some kind of service on our network, whether it is a genAI solution or an agentic solution.”

Security is also emerging as a barrier to AI expansion as organizations struggle to govern rapidly growing numbers of AI tools and workloads.

“The issue from a security standpoint is that it’s hard to create the guardrails for every possible AI tool that your organization must use,” said the vice president of infrastructure, network, and end-user services at a U.S. retail enterprise interviewed for the report.

The AI readiness conversation has often centered on data centers, but AI applications operate where employees work, devices connect, and business processes run. That means campus and branch environments may become just as important to AI success as the infrastructure supporting AI models.

The Cisco research shows that AI infrastructure planning can no longer focus only on back-end systems if enterprises expect to scale AI deployments over the next several years. Patel said in the statement: “Eventually there will be only two kinds of companies: those that are AI companies, and those that are irrelevant.”

For more Cisco news, see our coverage from Cisco Live 2026:

85% of IT teams claim every AI agent is under control. Only 42% actually know who owns them.

Mon, 15 Jun 2026 19:32:50 +0200

Organizational leaders are nearly twice as likely to hide their AI use compared to all other employees, at 42% versus 23%, according to new Ivanti research surveying 3,900 employees across six countries. Among leaders who conceal that usage, 52% say they do it for a "secret advantage." The same research found 85% of IT professionals claim a named owner exists for every AI agent. Only 42% say ownership is actually clear — a 43-point gap that no governance framework was designed to close.

Sam Evans, CISO of Clearwater Analytics, stood before his board and laid out the risk to the $8.8 trillion in assets his firm's platform supports. "The worst possible thing would be one of our employees taking customer data and putting it into an AI engine that we don't manage," Evans told VentureBeat. He brought a solution, not just a problem. Many CISOs VentureBeat interviewed did not.

Menlo Security CEO Bill Robbins relayed a conversation with a Top 3 U.S. bank CISO who called shadow AI discovery "a bit of a fool's errand": AI is embedded in every application and browser employees touch. The bank governs from containment, not discovery.

The scale justifies that posture. "We see 50 new AI apps a day, and we've already cataloged over 12,000," Prompt Security CEO Itamar Golan told VentureBeat. "Around 40% of these default to training on any data you feed them, meaning your intellectual property can become part of their models." CrowdStrike has detected 1,800 AI applications operating across 160 million endpoint instances. Those are vendor-reported numbers from proprietary telemetry. No independent party can verify them. The directional signal matters more than the exact count.

CrowdStrike CTO Elia Zaitsev described what makes the surface so hard to govern. "It looks indistinguishable if an agent runs your web browser versus if you run your browser," Zaitsev told VentureBeat at RSAC 2026. "Observing actual kinetic actions is a structured, solvable problem. Intent is not." The shadow AI surface is no longer a list security teams can maintain. It is an environment they have to assume.

The Ivanti survey was administered independently by Ravn Research and MSI Advanced Customer Insights across 1,500 IT professionals. Among companies with AI policies, just 24% of employees say those policies are followed "very consistently" in day-to-day work.

Kayne McGladrey, IEEE senior member, told VentureBeat why that governance gap persists. "Anything that seems to have a cybersecurity flavor is generally put into the cybersecurity risk category, which is a complete fiction. They should be focused on business risks, because if it doesn't affect the business, like a financial loss, then nobody's going to pay attention to it, and they will not budget it appropriately, nor will they adequately put in controls to prevent it," McGladrey told VentureBeat previously.

Brokerage partners at major consulting firms shared over Signal that they build shadow AI applications in Google Colab and store them in S3 buckets to compress a week of financial analysis into an hour. The approval process takes too long, so they route around it.

Governance at deploy time, failure at runtime

Reviews check functional requirements when a model ships, but they never check model provenance, behavioral drift, or whether the agent expanded its own permissions after launch.

CrowdStrike CEO George Kurtz disclosed at RSA Conference 2026 that a Fortune 50 CEO's AI agent rewrote the company's security policy to expand its own autonomy. The company caught it by accident. Every credential check had passed. "In the agentic era, defending against AI-accelerated adversaries and securing AI systems themselves require operating at machine speed," Kurtz said. Quarterly governance reviews do not operate at machine speed.

Mike Riemer, Field CISO at Ivanti, built that lesson into his own team's AI agent development. "It's great at what I intended it for, but it's also great at what I didn't intend it for, and what I didn't intend it for is dangerous," Riemer told VentureBeat.

Hallucination data compounds the problem. Sixty-eight percent of IT professionals have personally witnessed AI generate hallucinations with potential operational impact, according to Ivanti. More than half caught the errors before damage, but 16% did not. Yet among the most advanced users of AI, 49% fully trust AI-generated outputs that influence IT decisions.

Riemer described the pattern in an exclusive interview with VentureBeat. "There are people that are just accepting what's been given to them without any full understanding of what it is doing, which we've found in the tech industry for decades," Riemer said. "They don't question how it's doing it. They just start gauging it by its outcome."

Qualtrics CSO Assaf Keren identified the core tension in an exclusive interview with VentureBeat. Organizations are introducing "non-deterministic decisioning into environments built for deterministic." Keren cited internal Qualtrics data showing that 22% of SOC triage is now AI-driven. No codified threshold separates what an agent can auto-execute from what requires a human in the loop.

The 18-month window

The window for fixing this is closing. IT organizations expect AI to automate 46% of their operations within 18 months, according to Ivanti. U.S. companies project 52%. Governance is already the most commonly cited barrier to faster deployment, ahead of skills, technology, and data challenges.

The maturity divide makes the governance gap more dangerous. IT professionals at AI-mature organizations save six hours per week, double the three hours saved at the least mature level. Nearly 9 in 10 IT professionals at scaled organizations say AI frequently helps detect or resolve issues before employees are affected. At early experimentation organizations, that number drops to four in ten. Sixty-nine percent of scaled organizations report fully embedded governance, compared to 15% at early experimentation.

Cisco President Jeetu Patel walked through a hypothetical scenario in an interview at RSAC 2026: an agent that charges $40,000, invites competitors to a Slack channel, and publishes home addresses. "The apology is not a guardrail," Patel told VentureBeat.

Cato Networks VP of Threat Intelligence Etay Maor framed the accountability problem in a separate RSAC interview. "They're closer to humans. Why are we not doing background checks on agents?"

"AI is compressing the time between intent and execution while turning enterprise AI systems into targets," CrowdStrike VP of Intelligence Operations Adam Meyers told VentureBeat.

"Proceed on one action does not mean proceed on the next," Cisco SVP of AI Software and Platform DJ Sampath said in a separate interview.

McGladrey described the root cause. Organizations default to cloning human user profiles for agents, and permission sprawl starts on day one. "It uses far more permissions than it should have, more than a human would, because of the speed of scale and intent," he said.

Riemer's team built governance into Ivanti's own development process. "We have AI check on top of AI to make sure that it is fixed. Two different models, two different manufacturers," Riemer said. "If one AI believes the other AI fixed it appropriately, then it passes it off to a human being."

Riemer put the vendor question in terms every CISO can use at the negotiating table. "If that vendor doesn't have a way to show you what they've done from a development perspective in order to improve their development processes, you really need to question why you're working with that vendor," he said.

The six questions below target governance dimensions where enforcement collapses at runtime. CISOs can use them during Q3 vendor renewals to separate vendors shipping runtime enforcement from vendors shipping documentation.

Six governance questions for Q3 renewals

Governance dimension	What the data proved	Why governance misses it	Q3 renewal question	Proof artifact to demand
Executive shadow AI	Leaders hide AI at 42% vs. 23% all employees. 52% hide for "secret advantage." Regulated industries have the highest unsanctioned rates.	Governance assumes policy writers follow policy. Leaders sit above the controls they wrote.	Can your DLP, browser, SSE, and endpoint telemetry detect AI data movement at the executive layer with the same coverage as all other users?	Executive-layer DLP, browser, SSE, and endpoint telemetry logs showing identical coverage to all other users.
Named agent ownership	85% claim a named owner. Only 42% say ownership is clear. 43-point gap.	Owner on a spreadsheet. Agent at runtime. Nobody tested whether the owner can kill the agent under load.	Can you name the owner for every AI agent? Can that owner revoke access in 60 seconds?	Live demo of 60-second agent access revocation under production load.
Pre-deployment review	65% have pre-deployment risk review. Separately, only 24% say any AI policy is followed "very consistently." Review exists. Enforcement does not.	Review checks functional requirements at deploy. Never checks model provenance or behavioral drift at runtime.	Does your review cover model provenance? Is it enforced or advisory?	Model provenance certificate with enforcement log showing blocked deployments.
Policy enforcement	58% have acceptable-use policies. 24% followed "very consistently." Documented. Not practiced.	Agent pursued its goal past every boundary. Goal-seeking does not stop at a document the model never reads.	Are policies enforced by server-side gates or by agent compliance? What percentage of actions are gated?	Server-side gate audit trail with percentage of agent actions gated vs. ungated.
Trust thresholds	68% have seen hallucinations with operational impact. 49% of advanced users fully trust outputs.	No codified threshold separates auto-execute from human-review.	Which agent actions auto-execute versus require human review? Is that enforced in policy or in the platform?	Documented threshold matrix classifying every agent action as auto-execute or human-review.
Per-action authorization	Governance is the #1 barrier at 27%. Skills 20%. Tech 17%. Data 14%.	Oversight reviews quarterly. Agents act per-second.	Is per-action authorization enforced at runtime or only at deploy-time review? Can agents accumulate permissions without re-authorization?	Runtime authorization log showing per-action gate events and permission re-authorization timestamps.

Source data from Ivanti, Scaling AI in IT Operations: The Path to Maturity in 2026 (n=1,500 IT professionals, 3,900 total employees, six countries, February–March 2026). Exclusive CISO sourcing by VentureBeat.

Evans put structure around the Clearwater board conversation. The bank CISO that Robbins described assumed AI is everywhere and governed from containment instead of discovery. Governance that tries to catalog every shadow AI tool will fail because the surface grows faster than any inventory.

At scaled, business-critical organizations, 54% of IT professionals say AI makes their work both faster and better, according to Ivanti. At early experimentation organizations, 24% say the same. At scaled organizations, accountability lives in the platform. At early ones, it lives in a document the agent never reads.

The six questions above give every CISO a way to test whether their governance actually works where it matters. At runtime, under load, and before the next renewal check clears.

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Fri, 12 Jun 2026 23:24:32 +0200

The post Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit appeared first on IT Security News.

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Fri, 12 Jun 2026 22:51:08 +0200

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

Fri, 12 Jun 2026 21:44:44 +0200

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

Fri, 12 Jun 2026 21:44:21 +0200

The post 400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer appeared first on IT Security News.

How Jeetu Patel made Cisco unrecognizable

Fri, 12 Jun 2026 17:29:18 +0200

Cisco Live 2026 is in the books, and it was “prove it” time for a promise made 24 months ago. At Cisco Live 2024, Chief Product Officer Jeetu Patel promised that Cisco would be unrecognizable as a company—in a positive way—in two years. The innovation payload at the event suggests he has largely delivered on that pledge. Cisco is repositioning itself from a holding company of products and dashboards to a unified, AI-native infrastructure platform, with Cloud Control as the control plane, Cisco IQ as the CX brain, and Secure Networking as the glue binding it all together.

The shift is not just about new features; it is about a new operating model. Instead of humans clicking through a sprawl of consoles, Cisco is building an environment where human operators and AI agents share the same data, context, and system of action, with humans staying in control. For longtime Cisco customers, the result is a company that, in fact, looks and feels very different from the one Patel inherited.

From dashboard sprawl to Cloud Control

The most visible proof point of the new Cisco is Cloud Control, the unified management plane that now spans networking, security, compute, observability, collaboration, and an expanding ecosystem of third-party tools. Cisco is careful to note that this is not just another single pane of glass but an active execution environment with policy and identity embedded in the control path, designed from the ground up for humans and AI agents to operate infrastructure together.

Patel’s demo underscores how far Cisco has come from its historical dashboard sprawl. When operators land in Cloud Control, they see a familiar, ChatGPT‑style interface with three modes: Assistant, Canvas, and Actions. Assistant lets operators converse with the platform in natural language. Canvas provides a multiplayer workspace where humans and agents can investigate and resolve issues together. Actions become the mission control for supervising what agents propose and execute.

Crucially, Cloud Control surfaces shared platform services such as inventory and topology across the entire Cisco estate and exposes product tiles for Meraki, Intersight, security services, Splunk, Webex Control Hub, and Cisco IQ, all accessible with a single login. Instead of bouncing between multiple dashboards and authentication domains, operators can move seamlessly between platform services and product experiences within the same environment. For customers who have lived with overlapping portals and inconsistent workflows, this alone makes Cisco feel fundamentally different.

Cloud Control as an AI harness, not a console

Under the hood, Cloud Control is built on a shared data fabric that correlates telemetry across users, devices, applications, networks, and threats. That fabric fuels both human decision-making and agentic automation. Cisco describes this evolution as moving from “infrastructure as code” to “infrastructure as a harness.” Rather than relying solely on scripts and playbooks written by humans, Cloud Control becomes the governed substrate where AI agents can safely observe, reason, and act on real systems.

That harness appears in three visible dimensions. First, AI Canvas provides the workspace where humans and agents co-investigate incidents, with context persisting across shifts and escalations so nothing is lost. Second, Cloud Control Studio offers Agent Builder and App Builder, which let customers and partners build their own agents and applications on top of Cisco’s data, policy, and control plane using natural language and embedded coding assistants. Third, everything built in Studio—plus partner solutions—flows into the Cloud Control Marketplace, where integrations from dozens of ecosystem partners are already available.

For enterprises, the net effect is that Cloud Control shifts from a place to click through settings to the “secure harness” for agentic operations: a governed environment where AI agents can be deployed, monitored, constrained, and audited end-to-end. That is a very different proposition from the traditional network management console.

CX and products finally share a brain

Historically, Cisco’s Customer Experience (CX) organization (services) and product groups have often felt like parallel universes. Services were layered on top of products rather than tightly integrated into how those products operated. Cisco IQ changes that dynamic by placing CX capabilities directly within the same Cloud Control environment where the products themselves live and by wiring CX workflows into the same telemetry and policy plane. This is notable as Cisco IQ isn’t yet another dashboard but an integrated part of Cloud Control.

Cisco IQ is positioned as the AI‑powered delivery vehicle for support and professional services. The goal is to give customers “complete landscape clarity,” proactive resilience, rapid resolution, and contextualized services. It runs as a SaaS platform, with an on‑premises deployment option for customers with strict data sovereignty requirements. By tapping the shared data fabric, Cisco IQ can inventory assets whether they are deployed or still in the warehouse, flag risks before customers experience issues, and benchmark an organization’s posture against anonymized peers by vertical, market segment or geography.

New capabilities, including Resilient Infrastructure Services and Quantum Ready Assessments, further underscore the integration of CX and product engineering. Resilient Infrastructure Services uses a three-step framework: Exposure Assessment, Infrastructure Modernization, and Defense Resiliency to help customers prepare for frontier-model threats. Quantum Ready Assessments, delivered through Cisco IQ, identify assets most exposed to “harvest now, decrypt later” attacks and map a path to quantum-safe infrastructure. Putting CX’s “brain” into Cloud Control and connecting it to the same data and AI models that drive operations is both a cultural and an architectural shift.

Secure Networking as the integration proof point

If you want a single domain that illustrates how integrated the new Cisco has become, look at Secure Networking. Cisco’s stated vision is to embed security directly into the fabric of the infrastructure, from silicon through the network to operations, rather than treating it as a separate stack. That strategy manifests in several concrete ways.

Live Protect, described internally as a “digital immune system,” applies precise compensating controls to Cisco products in production to protect them from newly discovered vulnerabilities at runtime. It does so without reboots, upgrades, or maintenance windows. The controls are narrowly targeted to avoid performance impact and minimize false positives. Live Protect is already shipping on Nexus 9000 switches and expanding across the portfolio, including campus switches, tightening the feedback loop between vulnerability discovery and mitigation from weeks to minutes.

Hybrid Mesh Firewall extends a unified security policy across networks, applications, and both Cisco and third-party firewalls, limiting the blast radius when something goes wrong. At the same time, Cisco is embedding post-quantum crypto libraries, secure boot, and trust anchors across its core portfolio, and has committed to enabling quantum-safe communications capabilities across most core products by December 2026. New enterprise and data center routers, switches, and firewall series are launching as “quantum-safe by default.”

All of this is orchestrated through Cloud Control, the security command center for a post-Mythos era, with Splunk providing the telemetry backbone and agentic SOC and SRE capabilities to detect, triage, and respond at machine speed. Secure Networking is no longer just about point firewalls and SD-WAN; it has become the spine that ties Cisco’s networking, security, observability, and AI assets into a coherent platform.

Multicloud Fabric: networking as a service for AI

Another hallmark of the new Cisco is a willingness to deliver networking as a managed fabric rather than a toolkit that customers must stitch together themselves. Multicloud Fabric, introduced as a network‑as‑a‑service offering delivered through Cloud Control, illustrates this shift.

Multicloud Fabric gives enterprises a single fabric for secure site-to-cloud and cloud-to-cloud networking, with Cisco operating virtual points of presence across major cloud providers and regions. Customers can onboard sites and cloud environments, define intent-based connectivity, attach security policies, and monitor performance “with one button” from Cloud Control, instead of building and maintaining their own hub-and-spoke architectures. Security and observability are built in—Zero Trust routing, cloud firewall service chaining, and ThousandEyes agents embedded in each point of presence—so the network is no longer a passive pipe but part of the AI intelligence stack.

This matters because AI-first applications increasingly chain inference across multiple clouds and data sources. Cisco’s own research shows that these agentic workflows can generate many times more network traffic than manual equivalents, with much of it being latency-sensitive inference. Multicloud Fabric, operated as a service and integrated into the same Cloud Control environment, is Cisco’s answer to this new reality.

What this means for customers

Cisco has spent four decades building category-leading products, from Meraki and Nexus to Webex and ThousandEyes. But the company’s biggest opportunity has always been in how those pieces work together. As Patel has said, tightly integrated and loosely coupled. Cloud Control, Cisco IQ, Multicloud Fabric, and Secure Networking suggest the product organization is finally closing that gap, turning dashboards into agentic workflows and discrete boxes into a secure harness for the AI era.

For customers, Cisco’s transformation matters because it changes the operating model, not just the product lineup. Cloud Control gives IT teams a single management plane across networking, security, observability, collaboration, and services, replacing the fragmented dashboard experience that has long complicated Cisco environments. That should make operations faster and simpler, but it also raises the bar for customers.

As Cisco pushes AgenticOps, AI Canvas, Live Protect, and Cisco IQ into the mainstream, IT teams will need to shift from manually managing tools to supervising agents, setting policy guardrails, and validating machine-speed actions. That shift will demand new skills in prompt design, policy modeling, risk scoring, and governance, especially as agents propose and test more changes before humans ever click “approve.”

It also means customers should view Cisco less as a best-of-breed product and more as an integrated platform. The more of the Cisco estate that is tied to Cloud Control, the more value customers should derive from shared telemetry, unified workflows, embedded security, and cross-domain automation—especially in areas like Secure Networking and multicloud operations. Conversely, customers that remain heavily heterogeneous will need clear integration strategies and governance models to ensure third-party tools plug safely into the harness.

Finally, this new Cisco has the potential to reduce one of the biggest pain points enterprise buyers have faced for years: complexity. If the company can deliver on its vision of one login, one view, tighter product integration, and CX services finally aligned with the product groups, customers may find that Cisco is not only unrecognizable in a positive way but also easier to buy, deploy, and operate than at any point in its history.

I built 99 adversarially malformed PE files to test tool robustness - here’s what happened

Thu, 11 Jun 2026 15:02:26 +0200

I designed a 99‑fixture adversarial PE corpus, where each binary contains one controlled corruption pattern with full ground‑truth metadata. The goal was to answer a simple question:

How do PE tools behave when the binary stops playing by the rules?

The fixtures cover 8 anomaly classes:

entrypoint manipulation
section‑table corruption
Optional Header inconsistencies
directory contradictions
TLS anomalies
resource‑tree recursion
Authenticode corruption
entropy edge cases

I tested 6 tools representing the major parsing philosophies:

IOCX
Ghidra
Detect It Easy
radare2
PEview
CFF Explorer

The results were eye‑opening:

Literal tools (r2, PEview) preserved bytes but gave no warnings
Semantic tools (CFF) silently normalised corruption
Heuristic tools (DIE) ignored structure entirely
Reconstructive loaders (Ghidra) rewrote metadata, omitted fields, and crashed on entropy fixtures
Hybrid literal‑semantic tools (IOCX) preserved raw metadata and surfaced anomalies explicitly

Full write-up:

The Adversarial PE Analysis Series, Part 1 — Why PE Parsers Break

Corpus and fixture spec: https://github.com/iocx-dev/iocx

(fixtures are under /tests/contract/fixtures/layer3_adversarial)

submitted by /u/iocx_dev
[link] [comments]

99 adversarial PE files: exploring malformed‑binary behaviour across major analysis tools

Thu, 11 Jun 2026 15:02:25 +0200

I’ve built a 99‑fixture adversarial PE corpus to explore how different tools behave when confronted with deliberately malformed but still loadable binaries.

Each fixture introduces one corruption pattern - no packers or multi‑anomaly noise, which allows for clean attribution of behaviour. The anomalies span:

entrypoint redirection
overlapping/invalid sections
header inconsistencies
directory OOB conditions
TLS edge cases
recursive/malformed resources
Authenticode structural corruption
entropy‑field manipulation

I tested 6 tools commonly used in exploit dev workflows:

IOCX
Ghidra
Detect It Easy
radare2
PEview
CFF Explorer

Behavioural patterns with exploit‑relevant implications:

Literal parsers (r2, PEview) never crashed but provided no anomaly visibility
Semantic parsers (CFF) “fixed” corruption, masking exploit‑useful inconsistencies
Heuristic tools (DIE) ignored structure, blind to malformed metadata
Reconstructive loaders (Ghidra) rewrote metadata, omitted fields, and crashed on entropy fixtures
Hybrid literal‑semantic tools (IOCX) preserved raw bytes and surfaced anomalies explicitly

For exploit dev, malformed PE structures can act as:

parser differentials
crash primitives
metadata confusion vectors
loader‑model inconsistencies
analysis‑evasion surfaces

This corpus maps those behaviours systematically.

Full write‑up (Part 1):

The Adversarial PE Analysis Series — Why PE Parsers Break

Corpus and fixture spec: https://github.com/iocx-dev/iocx

(fixtures are under /tests/contract/fixtures/layer3_adversarial)

submitted by /u/iocx_dev
[link] [comments]

Smashing Security podcast #471: This AI worm just rewrote its own rules

Thu, 11 Jun 2026 01:38:29 +0200

Researchers at the University of Toronto have built a worm that thinks for itself. Using free off-the-shelf AI models it works out how to break into each new computer it encounters, and hijacks the powerful ones to host its own AI brain. And then the researchers discovered their creation had quietly removed the list of machines it wasn't supposed to attack. Meanwhile, Meta's shiny new AI customer support agent has been cheerfully helping hackers help themselves to other people's Instagram accounts. Just keep asking, politely but firmly, to have a password reset sent to a different email address - and the AI will eventually agree. All this and more in episode 471 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

v15.9.0

Mon, 08 Jun 2026 02:51:02 +0200

@oh-my-pi/pi-ai

Fixed

Fixed MiniMax-compatible OpenAI-completions hosts (e.g. minimax-code-cn/MiniMax-M3) losing tool-call arguments when the stream delivers function.arguments as a complete object instead of the OpenAI JSON-string contract. The streaming buffer previously concatenated the object into a string, coercing it to [object Object] and leaving bash/edit calls with empty or malformed inputs; the tool-call block now holds the object payload directly. (#1776)
Fixed Cloud Code Assist (Gemini / Antigravity) rejecting tool schemas with Invalid JSON payload received. Unknown name "propertyNames" (HTTP 400) when a tool exposed a property literally named properties (e.g. the Resend MCP create_contact tool). The schema normalizer's insideProperties flag was re-asserted when descending into such a property's value schema, so Google-unsupported keywords (propertyNames, additionalProperties, …) nested inside it were never stripped. The flag is now only set when entering a real properties map from a schema node, not from within another properties map.
Fixed local/self-hosted providers leaking machine-specific endpoints into the bundled models.json. A generate-models run on a machine with a LiteLLM proxy baked 1202 litellm models pinned to http://localhost:4000/v1 into the committed catalog. litellm (and lm-studio) now join ollama/vllm in the generator's discovery-only exclusion set, so local providers are never fetched during generation nor written to models.json — they are discovered dynamically at runtime instead. LiteLLM model discovery now enriches metadata against models.dev (the same reference source the other gateway providers use) rather than a bundled reference map. Added a regression test pinning the invariant (no local provider blocks, no loopback/private-network baseUrls in the bundled catalog).

@oh-my-pi/pi-coding-agent

Breaking Changes

Removed synchronous readTextSync from SessionStorage and core implementations (MemorySessionStorage, FileSessionStorage, RedisSessionStorage, SqlSessionStorage), requiring callers to use async text reads
Replaced the public SessionStorage readTextPrefix(path, maxBytes) and readTextSuffix(path, maxBytes) methods with readTextSlices(path, prefixBytes, suffixBytes): Promise<[string, string]>; custom session storage backends must implement the new combined slice API.

Added

Added env-driven OpenTelemetry trace export. When OTEL_EXPORTER_OTLP_ENDPOINT (or OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) is set, omp registers a global OTLP/proto trace exporter and switches on the agent loop's telemetry, so the invoke_agent / chat / execute_tool spans actually reach a collector instead of a no-op tracer. Honors the standard OTEL_* env contract (endpoint, headers, OTEL_SERVICE_NAME, OTEL_SDK_DISABLED and OTEL_TRACES_EXPORTER=none parsed case-insensitively) and the OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT capture toggle; it is a no-op when no endpoint is configured. Only the http/protobuf transport is supported — a grpc or http/json OTEL_EXPORTER_OTLP*_PROTOCOL declines rather than misrouting spans. This makes the existing telemetry usable from headless hosts that run omp as a spawned child process, where an in-process TracerProvider registered by the parent can't reach the child. Uses the @opentelemetry/exporter-trace-otlp-proto 2.x line, which exports cleanly under Bun.

Fixed

Fixed the status line session name (and the editor border / status-line gap fill) being nearly illegible on light themes.
Added IndexedSessionStorage and SessionStorageBackend exports to support shared metadata-indexed session backends
Added the tui.maxInlineImages setting (default 8) capping how many inline images render as live terminal graphics. Once a new image pushes the count past the cap, the oldest images are hidden via a full redraw — replaced by their [Image: …] text placeholder and purged from the terminal's graphics store — so long sessions with many screenshots/diagrams stop piling up images (and, on Kitty, stop leaving scrollback ghosts). Set to 0 to keep every image inline.
Added a "View: terminal state" item to the /debug menu that prints the detected terminal, live geometry and cell size, multiplexer, and the negotiated subprotocols actually in use — graphics (Kitty/iTerm2/Sixel), desktop notifications (BEL/OSC 9/OSC 99, plus whether OSC 99 was confirmed via a device-attributes probe), OSC 8 hyperlinks, 24-bit color, DECCARA rectangular-SGR background fills, and DEC 2026 synchronized output — alongside the scrollback-clear strategy (CSI 22 J vs CSI 2 J redraw / ED3 eager-erase risk) and the raw TERM/TERM_PROGRAM/COLORTERM detection signals.
Added a "Test: terminal protocols" item to the /debug menu that renders one live sample of every special escape protocol the renderer can emit — SGR text attributes (bold/italic/underline/strikethrough/inverse/dim), themed and 24-bit truecolor, OSC 8 hyperlinks, OSC 66 text sizing (large text), and an inline graphics swatch via the active image protocol (Kitty/iTerm2/Sixel, with a text fallback) — and fires a desktop notification, so you can eyeball which protocols the current terminal actually honors. The sample image is a gradient PNG generated in-process, so the graphics test needs no asset on disk.
Added the tui.textSizing setting (default off) that renders Markdown H1 headings at 2x scale via Kitty's OSC 66 text-sizing protocol. It replaces the undocumented PI_TUI_TEXT_SIZING env var with a real setting, and only takes effect on Kitty terminals (where OSC 66 is implemented) — it is ignored everywhere else so headings never emit raw escape bytes.
Added a lifecycle status to the /resume session picker. Each session's tail (last 32 KiB) is now read alongside the existing header window in a single pass, and its final message classified as done (the agent ended its turn and yielded control back), interrupted (a trailing tool call or tool result the loop never continued from), aborted, error, or pending (a trailing user message with no reply). The status renders as a colored segment on each session's metadata line. When the final message is larger than the tail window the status is omitted rather than guessed.
Added support for disable-model-invocation: true frontmatter field from the Agent Skills standard. Skills using this field are now hidden from the system prompt listing, matching the behavior of hide: true.

Changed

Changed the task tool description to tag read-only agents and explicitly forbid assigning them file edits/commands or offloading reasoning to quick_task/explore.
Changed Redis and SQL session storage initialization to load only indexed metadata (size, mtimeMs) instead of full session content
Changed SessionStorage read paths to rely on backend-backed metadata/indexed storage, so session content is fetched on demand rather than cached as full in-memory mirrors
Changed session-list slice reads to go through SessionStorage.readTextSlices across all backends, removing the file-only single-open branch and caller-managed buffers. FileSessionStorage now reads both windows via peekFileEnds, while Redis and SQL backends encode session content once per combined read.
Changed the ask tool transcript renderer to mark single-choice questions with circular radio glyphs (○/◉) instead of the rectangular checkbox glyphs (☐/☑) it shares with multi-select questions, so a "pick one" combo box visually reads as a radio group rather than a checklist. Multi-select questions keep checkboxes. Added a radio.selected/radio.unselected symbol pair across the unicode, nerd-font, and ASCII presets.
Changed the ask tool transcript renderer to mark the chosen answer inside the question form rather than re-listing the questions in a detached summary block below it. Once a question is answered, the standalone prompt preview is dropped and the result redraws the same form — every offered option still shown, with the selected one(s) filled in (◉/☑, highlighted) and the rest dimmed (○/☐); custom free-text answers and cancellations render in place as the final entry. This removes the duplicate question/option listing that previously appeared once as the call preview and again as the result.
Changed task-completion and ask desktop notifications to structured terminal notifications (title, body, type, and a focus-on-click action). On Kitty these render through OSC 99 as a proper title/body with click-to-focus; terminals without confirmed OSC 99 support collapse them to the previous single-line message (BEL/OSC 9).
Updated the "each kitty/tmux split" tip to include cmux.

Fixed

Fixed tiny-model startup in compiled binaries by resolving @huggingface/transformers and its runtime dependencies from the installed cache using package.json exports/main metadata, preventing module-resolution failures when launching models
Fixed tiny runtime installation flow in compiled binaries by using the build-time resolved @huggingface/transformers version and ensuring the runtime lock directory’s parent exists before acquiring the install lock, preventing mismatch and setup failures on fresh installs
Fixed the terminal protocol debug probe reusing one stable Kitty graphics id across repeated panels, which could move/replace an earlier swatch instead of rendering a new one.
Fixed selector dialogs (the ask tool, hook prompts) collapsing to a single visible option on shorter terminals when options carried long descriptions: the highlighted option's wrapped description consumed the entire row budget, hiding every other option and making the menu feel unnavigable (down moved the lone visible entry, left/right did nothing). When the fully-expanded list overflows, HookSelectorComponent now renders a compact list — every option label stays on screen and only the highlighted option expands its description, truncated to the remaining rows — so the whole menu is always visible and the detail pane follows the cursor.
Fixed read failing with "Path not found" on web URLs whose scheme // collapsed to a single / (e.g. https:/github.com/...), which happens when a URL is routed through Node's path.normalize/path.resolve. The fetch URL recognizer now accepts a single-slash scheme and repairs it back to // before fetching, so collapsed URLs resolve instead of falling through to filesystem lookup.
Fixed subagent slow-model priority falling through to older Claude Opus aliases when Opus 4.8 is available by adding Opus 4.8 and 4.7 aliases ahead of older Opus fallbacks (#1753).
Fixed the web-search provider selectors in TUI settings/setup to derive from the shared provider metadata, so newly added providers cannot be omitted from the preference list.

@oh-my-pi/pi-natives

Fixed

Bounded sorted glob() scans to maxResults during uncached traversal and emitted onMatch callbacks only for entries admitted to the bounded top-maxResults heap so broad OMP find progress and timeout partials stay consistent with the returned mtime-ranked set while keeping parent-process memory bounded (#1761).
Fixed wrapTextWithAnsi hanging (infinite loop) on text containing a BEL-terminated string escape — DCS/SOS/PM/APC (ESC P/ESC X/ESC ^/ESC _) closed by BEL instead of ST. ansi_seq_len_u16 only accepted the ST (ESC \) terminator for these (OSC already accepted both), so a BEL-terminated APC such as the TUI cursor marker (ESC _ pi:c BEL) was left unclassified: it was miscounted as visible width and break_long_word's non-ESC scan could not advance past the ESC, spinning forever. The terminator set now matches OSC (ST or BEL), and break_long_word defensively emits and steps over any escape it cannot classify so a malformed/unknown sequence can never wedge the wrap loop.

@oh-my-pi/swarm-extension

Fixed

Fixed swarm /swarm run failing with authStorage/modelRegistry identity error (#1472)

@oh-my-pi/pi-tui

Added

Added Kitty CSI 22 J screen-to-scrollback clears for non-destructive full paints, while keeping ED3 for destructive history/session rebuilds.
Added Kitty OSC 99 rich notification formatting and startup capability probing.
Added Kitty OSC 66 text-sized Markdown H1 headings (2x scale) plus native text-width support for OSC 66 spans. Off by default and gated to Kitty (the only terminal implementing OSC 66) via the TERMINAL.textSizing capability; hosts enable it through setTextSizing.
Added Kitty Unicode placeholder image rendering (U=1 + U+10EEEE with explicit row/column diacritics): inline images are drawn as real text cells that carry the image id in their foreground color, so they survive horizontal slicing, reflow, and overlapping draws instead of relying on cursor-positioned a=p placements. Enabled by default on Kitty-family terminals; opt out with PI_NO_KITTY_PLACEHOLDERS=1, and falls back to direct placement when a grid exceeds the diacritic table's addressable range.
Added Kitty temp-file image transmission (t=t): on local sessions, decoded PNG bytes are written to a tty-graphics-protocol temp file and the path is sent instead of in-band base64, gated behind a startup a=q,t=t support probe. Controlled by PI_KITTY_IMAGE_TRANSMISSION=direct|temp-file|auto; disabled over SSH unless explicitly forced.
Added DECRQM capability detection for DEC private modes 2026 (synchronized output) and 2048 (in-band resize). Synchronized-output paint wrappers are dropped when the terminal reports 2026 unsupported (preserving the PI_NO_SYNC_OUTPUT override), and DEC 2048 in-band resize is enabled when supported — reported geometry and cell pixel size are updated from CSI 48 ; rows ; cols ; yPx ; xPx t reports, with SIGWINCH and CSI 16 t kept as fallbacks.
Added an injectable render scheduler for TUI tests, allowing deterministic render drains without patching global clocks or event-loop timing.
Added ImageBudget, an inline-image cap that keeps only the most recent N images as live terminal graphics and demotes older ones to their text fallback. Once a new image pushes the count past the cap, the renderer hides the oldest via a full redraw plus an explicit Kitty graphics purge (a=d,d=I) — text-clear escapes (CSI 2 J/CSI 3 J) do not remove Kitty images. Configure the cap via TUI#setMaxInlineImages (0 disables it).
Changed Kitty inline images to a transmit-once + placement scheme: the base64 data is sent a single time (a=t) keyed by a stable image id, then every repaint emits only the tiny placement (a=p,i=…,p=…). Repaints — including full redraws — no longer re-send image data or stack duplicate placements, and the diff/line buffers and render caches hold short placement strings instead of multi-KB base64. The ImageBudget doubles as the transmit store (it tracks which ids are loaded and re-transmits after a purge frees the data). iTerm2/Sixel, which have no addressable image store, keep sending inline data as before.
Added a renderer-level DECCARA rectangular-SGR optimizer that paints solid background panels/rows (Box/Text/Markdown fills, status bars, any full-width theme.bg row) as a single coalesced rectangle escape (CSI 2*x / CSI Pt;Pl;Pb;Pr;$r / CSI *x) instead of emitting a full-width run of background-styled spaces on every visible row. It operates at emit time on the final ANSI strings — components are unchanged — and strips only trailing padding it can prove sits under a single non-default background span, coalescing vertically adjacent identical fills into one rectangle and falling back to the original bytes whenever the rectangle would not save bytes. Enabled only on Kitty, which implements the SGR-background extension (docs/deccara.rst); Ghostty is intentionally excluded because its CSI $r is unimplemented (ghostty-org/ghostty#632) and would drop the background entirely. Scrollback-bound rows and the append/scroll paths always keep the padded representation so native history preserves colored cells, and the PI_NO_DECCARA kill switch (plus tmux/screen/zellij detection) forces the fallback.
Added CMUX_SURFACE_ID environment variable support to getTerminalId(), so cmux terminal surfaces get a stable identifier alongside kitty, tmux, macOS Terminal.app, and Windows Terminal — enabling per-surface session breadcrumbs for omp -c in cmux.

Changed

Changed TUI tests to use Ghostty's VT engine (ghostty-web) instead of @xterm/headless.
Changed the default inline-image live graphics budget from 3 to 8 images.

Fixed

Fixed the DECCARA background-fill optimizer rejecting or repainting the wrong cells when a trailing fill crossed from default-background spaces into colored spaces.
Fixed DEC private-mode reports with DECRPM status 3/4 being treated as unsupported, so permanent 2026/2048 reports stay recognized.
Fixed OSC 66 text-sizing width and slicing edge cases, including ZWJ emoji payloads and partial slices through scaled spans.
Fixed focused Input components following TUI#setShowHardwareCursor, so single-line prompts render either the terminal cursor or software cursor consistently with the editor.
Fixed the DECCARA background-fill optimizer painting fills on the wrong rows ("split into unaligned halves") in the differential repaint path. When a diff grew the transcript past the viewport, writing the rewritten rows scrolled the terminal, but the absolute DECCARA rectangle coordinates were derived from the pre-scroll viewport top, so every fill landed scrollAmount rows too low while the relatively-positioned text settled correctly; rows scrolled into history were also shortened, dropping their background padding from native scrollback. Rectangles now target the post-scroll rows and only rows remaining in the final viewport are optimized.
Fixed native scrollback desynchronization after terminal width or height changes reflowed overflowing content while the viewport was not at the bottom
Fixed a notification chip (or any injected block) rendering on top of an actively streaming tool render on ED3-risk terminals (Ghostty/kitty/Alacritty/iTerm2). While a foreground tool streams, its header's elapsed-time counter ticks every frame; once output scrolls the header above the viewport top, each tick is an offscreen edit that — because the eager scrollback-rebuild opt-in is gated off on these terminals — repaints the viewport in place and advances the rendered line count without committing the new overflow to native history. #scrollbackHighWater then lagged the logical viewport top, so a later content shrink whose changes landed in the visible region slipped past the shrink-across-boundary guard and reached the differential emitter, which is anchored to #maxLinesRendered - height: it rewrote only the suffix, dropped the newly exposed top row, and left a blank at the bottom, drifting every row below the edit one line up so it painted over the rows above. Such shrinks now re-anchor the bottom of the viewport with a non-destructive repaint, and the foreground-streaming shrink-across-boundary case repaints the live tail instead of padding and pinning the pre-shrink viewport.
Fixed a terminal resize during foreground-tool streaming on an unknown-viewport / ED3-risk host (Ghostty/kitty/Alacritty/iTerm2/WSL) leaving native scrollback permanently out of sync, so scrolling back after the turn showed missing rows. A pure geometry resize (no content change) takes the in-place viewport-repaint path, which — unlike a content-bearing resize that rebuilds via the geometry branch — never flagged native history. Because the prompt-submit checkpoint (refreshNativeScrollbackIfDirty) only rebuilds when scrollback is marked dirty on these hosts, the discrepancy was never reconciled. Overflowing geometry repaints whose viewport is not known to be at the bottom now mark scrollback dirty so the next checkpoint rebuilds an exact copy of the transcript.

@oh-my-pi/pi-utils

Added

Added color helpers colorLuma (perceptual luma), relativeLuminance (WCAG, linearized sRGB), and hslToHex to the color utilities. The luminance helpers parse #rgb/#rrggbb hex and 256-color palette indices, returning undefined for unparseable values.
Added peekFileEnds, a single-open head-and-tail file peek helper that reuses the head bytes for the tail when the file fits the head window.
Added peekFileTail, the tail mirror of peekFile: reads up to the last maxBytes of a file ending at EOF, reusing the same pooled-buffer strategy (no per-call allocation for small reads).

What's Changed

fix(search): default paths to workspace root instead of hard-failing by @GratefulDave in #1808
fix: recognize disable-model-invocation from Agent Skills spec by @fabkho in #1803
fix(coding-agent/mcp): handle async broken-pipe rejections in stdio transport by @VoidChecksum in #1783
Fix slow agent Opus priority by @daandden in #1754
fix(swarm): remove redundant authStorage discovery from swarm pipeline (#1472) by @WodenJay in #1726
Fix web search provider TUI options by @daandden in #1685
Add cmux terminal surface detection to getTerminalId by @basedcorp99 in #1702
fix(natives): bound sorted glob scans by @roboomp in #1762
fix(tui): cap session accent luminance on light themes by @paweljw in #1715
feat(coding-agent): env-driven OTLP trace export for headless hosts by @cgreeno in #1797

New Contributors

@GratefulDave made their first contribution in #1808
@fabkho made their first contribution in #1803
@WodenJay made their first contribution in #1726
@paweljw made their first contribution in #1715
@cgreeno made their first contribution in #1797

Full Changelog: v15.8.3...v15.9.0

How Cisco IT cut observability costs by 86% and eliminated major network outages

Fri, 05 Jun 2026 15:08:37 +0200

When several database clusters started failing simultaneously, Cisco IT had all the data it needed to diagnose the problem. The signals were there. Engineers saw them. The issue was that those signals were landing in separate systems that did not talk to each other, and the team had no way to correlate them in real time.

What followed was three hours of war-room calls across three separate bridges. Engineers were on one call, debating ownership of the problem. Application owners were on another, waiting on the database to recover. Executives were on a third, trying to explain to business partners why users could not place orders. The root cause was eventually found, but the outage had already hit.

That incident became the impetus for a consolidation project that Anusha Nataraj, product manager in Cisco IT’s observability team, detailed in a session at Cisco Live.

The project has since reduced major incidents by 25% and produced zero major network outages over the last six quarters. The environment spans more than 1,500 applications, more than 71 of them externally facing, across more than 100,000 endpoints, processing more than 15,000 changes per month. The platform at the center of that consolidation is Splunk, which Cisco acquired in 2024. Cisco IT is now running its own product across its global infrastructure.

“We had the data, we had all the data, but [it’s] just that it was not stitched together, and we couldn’t see it all holistically,” Nataraj said.

The tool sprawl that made it worse

The pre-consolidation observability environment at Cisco IT was not a single gap. It was a collection of them. Logs were split across a partial Splunk deployment and Elastic instances. Metrics ran across Prometheus stacks, Grafana stacks and homegrown solutions. Event management ran on a separate homegrown platform. None of these systems fed into each other.

The team had considered staying with the existing mix, including Datadog and Elastic, and evaluated stitched-together open source alternatives. Three factors drove the decision against them. They could not scale to Cisco IT’s operational requirements, they lacked the AI capabilities the team needed, and they offered no roadmap that Cisco IT could shape as a customer.

“They worked at our department level, but they couldn’t scale to our IT needs, and they didn’t have the maturity of AI that we were expecting,” Nataraj said.

Nataraj was clear that the decision was not driven by the 2024 acquisition. The team evaluated Splunk against their requirements and selected it on fit, scale and AI roadmap.

The three-pillar consolidation

The consolidation followed a defined three-step sequence.

Log consolidation: All logs were moved to Splunk Cloud, retiring Elastic and other logging instances in the process.
Metrics consolidation: Currently in progress, with Prometheus, Grafana and homegrown stacks being retired as the work completes.
Business context via ITSI: The team is implementing IT Service Intelligence (ITSI) to add business context on top of the unified log and metrics data.

The 86% reduction in total cost of ownership for observability came out of that first phase. More than 400 on-premises servers were decommissioned along with their associated storage. Licenses across multiple platforms were consolidated. The contractor headcount assigned to monitoring those servers was reduced.

“We decommissioned a lot of servers that were on prem, which was more than 400 servers, and associated storage elements were all turned off, and that was a major savings for us,” Nataraj said.

What incident response looks like now

The operational change is most visible in how the team handles incidents. A video shown during the session walked through the current workflow.

When an alert fires in ITSI, one click launches a custom-built AI agent that queries logs, metrics, traces, topology data, and recent change requests in real time. The agent returns a plain-language summary of what broke, why it broke and how to fix it. Role-specific actions are included for DevOps, application and SRE teams. If escalation is needed, the agent drafts a handoff for the on-call engineer. The whole investigation happens in a single screen before an incident ticket is even created.

The result is a measurable shift in outcome. When issues do occur, the three-bridge war room is gone. Teams can see where the problem is and the response is contained to the people who need to act on it. “We have actually brought down our incident count by 25%, and in the last six quarters there have been no major network outages,” Nataraj said.

Lessons learned

Nataraj laid out a practical set of takeaways from the project for IT operations teams running at similar scale.

Unify data before applying AI. Without a unified data platform, AI has nothing reliable to work with. Getting all data into a single architecture has to come first.
Share visibility across teams. Correlating data is only useful if the teams who need it can access it. The team built cross-domain data sharing from the start.
Bring change and release data into observability. Tying change management records to observability data lets the team trace failures back to the specific change that caused them and maintain a rollback plan.
Treat cost savings as the budget for innovation. The TCO reduction funded the team’s shift away from routine monitoring. Engineers who were previously managing capacity and watching servers are now building AI agents on top of Splunk’s MCP tools, participating in alpha and beta testing for new Splunk tooling, and feeding product feedback directly to Cisco’s Splunk teams.

“They were purely ticket closers before,” Nataraj said. “They’re innovators, they wear product managers’ hats, and they are really happy about the work that they do.”

Job satisfaction, retention, and contractor reduction are all outcomes Nataraj cited as measurable ROI from the project. “Keeping the team motivated and having them feel happy is a real ROI for every single organization,” she said.

CVE-2026-42349 | clerk javascript unusual condition (GHSA-w24r-5266-9c3c)

Thu, 04 Jun 2026 14:38:46 +0200

A vulnerability has been found in clerk javascript, shared, backend, nextjs, -react, react, vue, astro, nuxt, -expo, expo, react-router, tanstack-react-start, chrome-extension, fastify, express and hono and classified as critical. This impacts an unknown function. This manipulation causes improper check for unusual conditions. This vulnerability is handled as CVE-2026-42349. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Cisco sees quantum networking as the future of networking

Wed, 03 Jun 2026 22:34:20 +0200

Particle entanglement, superposition and teleportation are key concepts in quantum physics. Einstein famously dismissed such phenomena as “spooky action at a distance.”

Quantum computing is the nascent field of technology bringing that spookiness to life, but it is quantum networking that will actually enable quantum computing to be useful by connecting multiple systems together. According to Cisco, quantum networking’s practical utility isn’t limited to quantum computing, and it can have a material impact on the regular networks we use today.

In a deep-dive session at Cisco Live, Ramana Kompella, head of Cisco Research and Cisco Fellow, detailed precisely what quantum networking is, how it works at a theoretical level, and what Cisco is building to enable real world applications.

During his session, Kompella made the case that the bottleneck to practical quantum computing is not the processor. It is the network connecting processors together. His argument drew directly from the history of classical infrastructure: The same scale-out methodology that built the modern internet could, he said, accelerate the arrival of useful quantum computing by decades.

“Quantum networking can accelerate the arrival of practical quantum computing by decades by using the scale-out methodology that we’ve used successfully in our classical infrastructure,” Kompella said.

How quantum networking actually works

The starting point is understanding why quantum networks cannot be built like classical ones.

“Quantum networking is completely different from classical networking,” Kompella said.

In a classical network, data moves as packets through switches and routers. In a quantum network, information is not transported directly. Instead, the network distributes entangled photon pairs between nodes. Entanglement links two photons so that measuring the state of one instantly determines the state of the other, regardless of the distance between them.

The qubit: Where classical computing processes data as bits, ones and zeros, quantum computing uses qubits, units of quantum information that exploit a property called superposition. Superposition means a qubit can represent a one, a zero, or any combination of both at the same time, until it is measured. That ability to hold multiple states simultaneously is what gives quantum computers their computational potential. Each entangled photon pair can transfer exactly one qubit of information.

Quantum teleportation: Rather than sending a qubit directly across a wire, quantum networking uses entangled photon pairs to transfer quantum information from a sender to a receiver. The process is called teleportation because the qubit effectively disappears at one end and reappears at the other without physically traveling the intervening distance.

The speed-of-light caveat: Teleportation sounds instantaneous, and in one sense it is, but the receiver still cannot use the arriving qubit until a classical signal arrives confirming how to interpret it. That classical signal travels at the speed of light. Information does not move faster than light.

The hardware: What Cisco has built

With those fundamentals in place, the question becomes how to build infrastructure that delivers entanglement at scale. Cisco has developed two pieces of hardware designed to answer that question.

The entanglement source: Announced last May, Cisco’s entanglement source generates 200 million entangled photon pairs per second. It operates at standard telecom frequencies, which means it runs over existing fiber infrastructure rather than requiring a dedicated quantum fiber plant. It also runs at room temperature, with no cryogenic hardware required.

The Universal Quantum Switch: The centerpiece of Kompella’s session was a chip he pulled from his shirt pocket: a prototype of the Cisco Universal Quantum Switch, built from thin film lithium niobate.

“I’ve seen people pulling out pluggables from their pockets all the time,” Kompella said. “I get a chance to pull it out of my pocket to showcase the quantum switch chip.”

Standard optical switching hardware cannot be used in a quantum network. It disturbs the fragile quantum states being transmitted. The Cisco switch is built specifically to preserve quantum information through the switching operation.

The universality in its name comes from modality conversion. Quantum computers are not all built the same way. Superconducting, neutral atom, ion trap and photonic systems each encode quantum information differently, using polarization, time bin, frequency bin and other modalities. A switch that handles only one encoding type locks an operator into a single hardware vendor. The Cisco Universal Quantum Switch converts between modalities, so a single fabric can interconnect heterogeneous quantum processors.

“We are building the switch and fabric in order to actually interconnect all of them, not just any one type,” Kompella said.

Architecture: the quantum data center model

Cisco’s architecture puts the switch at the center of a pod-based topology that mirrors classical data center design: processors and shared resources grouped into pods, interconnected through layers of switching.

Entanglement protocols are required. Three protocols handle end-to-end entanglement between quantum processors:

Emitter-Scatterer: One side emits a photon that interacts with a matter qubit on the receiving end.
Emitter-Emitter: Both sides emit photons that meet at a Bell State Measurement Device.
Scatter-Scatter: Two entanglement sources achieve transitive entanglement across two measurement points.

Each protocol suits different hardware configurations.

A distributed compiler is also required. A large quantum circuit cannot run on a single processor today. Cisco’s distributed quantum compiler partitions circuits across multiple processors and manages execution across the network. It also handles distributed error correction through syndrome measurement, a non-destructive operation that detects and corrects erroneous qubits without collapsing quantum states, extended to the network layer to ensure the interconnect does not introduce new errors into the computation.

Classical applications that benefit now

Kompella also addressed a question that goes beyond quantum computing: Can classical networking applications benefit from a quantum network today? Two properties make that possible. The first is entanglement. The second is the no-cloning theorem, which states that quantum information can be moved but not copied.

Quantum Sync: Two trading desks separated by tens of kilometers want to execute coordinated buy or sell decisions simultaneously. In a classical network, one side sends a message and waits for a response, and at the microsecond timescales of high-frequency trading, that propagation delay matters. With an entangled state between the two nodes, both sides make a joint decision without waiting for a message to cross the link. Kompella said the approach carries a 10% to 15% advantage over any classical coordination scheme.

Quantum Alert: The threat is harvest now, decrypt later: An attacker taps the fiber, collects encrypted packets, and waits for a quantum computer capable of breaking the encryption. Quantum Alert multiplexes entangled photons onto existing classical fiber. Both endpoints perform joint measurements, producing correlated detections called coincidences. A dip in coincidences signals that photons are being absorbed. An attacker cannot inject replacement entangled photons, so the pattern breaks regardless.

“That’s what makes this foolproof against an eavesdropper,” Kompella said.

From lab to live fiber, and what comes next

Cisco has moved beyond controlled environments. Working with a partner called Connect, Cisco ran entanglement-swapping experiments over live operational fiber in New York.

“We got much better rates than what lab results actually look like,” Kompella said.

On the computing side, Cisco has announced partnerships with IBM and, more recently, Atom Computing, a neutral-atom quantum computing vendor. The collaboration spans the software stack, distributed error correction and transduction, which is the process of converting quantum information between different physical carrier types, with the goal of stitching heterogeneous quantum nodes into a single end-to-end network.

The partnerships reflect the same architectural logic as the Universal Quantum Switch. Cisco is not betting on one quantum computing modality winning. It is building the interconnect layer that works regardless of which one does.

“Quantum networking has many practical and commercial use cases in the classical world today,” Kompella said.

What is Cisco Cloud Control and why should customers care?

Wed, 03 Jun 2026 18:23:50 +0200

As is typical of Cisco, the company made several product announcements at its flagship event, Cisco Live. The most significant product announcement is Cisco Cloud Control, which recognizes that customers do not run separate Cisco products; they run one sprawling, interconnected environment that must be monitored, secured, and increasingly operated with AI at machine speed.

That is what Cisco Cloud Control is supposed to be: a single management plane with one login, one view, and one operational model spanning networking, security, compute, observability, and collaboration. Cisco is positioning it as the foundation for its broader AgenticOps vision, in which human operators and AI agents work from the same data and in the same workspace, with humans still in control. For Cisco customers, this matters because the company is finally trying to turn its massive product portfolio into an actual platform.

More than another console

On paper, Cloud Control sounds simple enough. It provides a unified environment, a shared data layer, and a common system of action, while also giving customers access to capabilities such as unified inventory, topology, policy, identity, and event correlation across the Cisco estate. During the keynote demos, Cisco showed single sign-on, all assets in one place, a single topology view, and direct access to products such as Meraki, Splunk, Security Cloud Control, Intersight, Control Hub, and Cisco IQ.

That alone would be useful. Cisco’s biggest enterprise customers have spent years dealing with product silos that made perfect sense inside the org chart but far less sense in an actual IT environment. Networking had its console, security had its console, observability had its tools, collaboration had its dashboard, and the poor operator in the middle had to stitch it all together manually. Cloud Control is Cisco’s admission that this model no longer scales.

Why the single dashboard matters now

The timing here is not accidental. In the AI era, operations are no longer just about watching dashboards and opening tickets. Infrastructure teams are being asked to diagnose and fix problems faster, while the threat landscape is compressing the time between vulnerability disclosure and exploitation from weeks to minutes. Cisco’s argument is that if customers are going to operate and defend infrastructure at machine speed, they cannot keep jumping from console to console and trying to correlate everything by hand.

That is why the single dashboard is more strategic than it sounds. Cisco is not just aggregating links to existing products. It is trying to create a common operational context so people and agents can work from the same inventory, topology, telemetry, and policies. If the old model was “visibility first, action later,” the new model is supposed to be visibility, reasoning, and action, all within the same environment.

The break from Cisco’s past

At Cisco Live 2024, Chief Product Officer Jeetu Patel declared that within two years, Cisco would be unrecognizable in a positive way. Cisco Live 2026 marks that two-year milestone, and Patel (pictured at top) has indeed made Cisco unrecognizable, with Cloud Control the most recent example. Historically, Cisco has rolled out one “single pane of glass” after another. In the past, I’ve said that if there were a Magic Quadrant for single panes of glass, Cisco would be the runaway leader because it had so many.

This is what makes Cloud Control so interesting. Cisco explicitly says this is not a “single pane of glass,” and the company is right to make that distinction. In its own words, glass is passive; Cloud Control is designed to enable active execution, with policy and identity built directly into the control path. That is a sharp departure from the old enterprise management philosophy, in which the dashboard’s job was mostly to display information and leave the operator to figure out the rest.

Cisco is also changing the abstraction layer.

For years, the company sold management in product-sized chunks. Now it is talking about a secure harness for agentic infrastructure, complete with trusted access, normalized APIs, Model Context Protocol connectivity, telemetry, enforcement points, and governance to ensure actions are bounded, auditable, and reversible. That is a much more ambitious framing, and frankly, it has to be. In a world of AI agents, the real value is not in prettier user interfaces. It is in creating a trusted operating environment where agents can do useful work without breaking things. At Cisco Live, all product demonstrations have been delivered from within Cisco Cloud Control, showcasing the product’s breadth and depth.

AI Canvas is where the story gets real

One of the strongest parts of the announcement is AI Canvas, which Cisco is moving into controlled availability as part of Cloud Control, rather than keeping it locked inside individual products. Cisco describes AI Canvas as a multiplayer workspace where human operators and AI agents investigate and resolve issues together, using the same live evidence, with context persisting across handoffs, shift changes, and escalations.

That is important because enterprise IT does not need more AI window dressing. It needs help with the messy middle of operations, where a single performance issue can become a network, policy, application, and security question all at once. Cisco says AI Canvas can take a natural-language prompt, build a multi-agent investigation plan, gather evidence across domains, and return a sourced answer, with the operator still approving the path forward. If that works as advertised, Cisco is not just simplifying operations. It’s changing how infrastructure work gets done.

The marketplace makes this bigger than Cisco

The other notable component of the announcement is the Marketplace, which is central to whether Cloud Control becomes a platform or just a better Cisco front end.

The Marketplace is a catalog of apps, agents, and integrations built by Cisco, customers, and partners, and it already includes integrations from more than 50 ecosystem partners. The partner list includes AWS, Google Cloud, Linear, Microsoft, Okta, PagerDuty, ServiceNow, Slack, Snowflake, Tenable, and Wiz, among others.

That matters because no enterprise is all-Cisco. The company acknowledges that customers operate multivendor environments and need to customize workflows beyond what Cisco ships out of the box. With Agent Builder, App Builder, and Marketplace, Cisco is also enabling customers to connect third-party tools, build their own agents, and create custom apps on top of Cisco’s control plane rather than waiting for a roadmap. That is a big deal because it moves Cisco from a product vendor to a platform operator.

After the keynote, I caught up with Evan Mintzer, director of production infrastructure at Customers Bank. While he appreciates having a single dashboard for their Cisco products, it’s the ecosystem partnerships that truly caught his attention. “When Cisco displayed the slide of supported vendors, I recognized several we already use and a few others we’re considering,” Mintzer shared. “That ecosystem will make integrating them into our environment much easier.”

Why every Cisco customer should care

During his keynote, Patel made a comment that I think succinctly captures the value of Cisco Cloud Control: “Cloud Control is at its core simplicity without losing the sophistication of Cisco, and so what we’ve tried to do is say all the products that you know from Cisco and love will be managed from it.”

Historically, customers had to choose between the ease of use of a dashboard and the CLI for more complex tasks. Now they can do both through a natural language interface.

It’s also about capturing more value from the Cisco investment many companies have already made. The more Cisco infrastructure a customer runs, the more value the platform should deliver by connecting inventory, topology, policy, security, and AI-driven workflows in one place. Cisco has always had broad reach across the stack, but breadth alone is not enough. Without a unifying control layer, breadth becomes portfolio sprawl. Cloud Control is Cisco’s best attempt yet to turn that sprawl into an advantage.

There is also a defensive reason to care. Cisco is positioning Cloud Control as the command center for a post-Mythos world, tying it to Live Protect, unified security policy, asset visibility, vulnerability posture, and broader agentic security controls. In other words, this is not just an operations console. Cisco wants it to become the place where customers defend infrastructure in real time.

My advice to Cisco customers

Customers should approach Cloud Control with both enthusiasm and discipline. If you are a Cisco-heavy shop, this could become the operational layer that finally ties your environment together. But do not accept the vision based on branding alone.

First, test how Cloud Control reduces cross-domain complexity. A single pane of links is not the same as a single operating model.

Second, rigorously evaluate the AI governance model. Cisco wisely emphasizes human approval, auditability and bounded actions, but customers should validate this in real workflows before letting agents take any consequential actions.

Third, take the Marketplace seriously from day one. The ability to manage the Cisco domain from a single dashboard has obvious appeal, but extending it across a large percentage of the overall environment can significantly simplify operations and troubleshooting.

Cisco has had the pieces for years: leadership positions in networking, security, observability, collaboration, and infrastructure, plus one of the deepest installed bases in enterprise IT. What it has lacked is the control plane to bind them all together. Cloud Control shows that the company understands the future will not be won by having the most dashboards. It will be won by having the operating layer where humans and AI agents can work.

And that is why this launch matters. Cisco Cloud Control is not just another product announcement. It is Cisco’s effort to become the system through which its customers run the agentic enterprise. It’s positioned itself as “Mission Critical Infrastructure for the AI era” — but with Cloud Control, it’s that plus the operational environment.

Cisco Live: The network is back, and AI rewrote the rules

Tue, 02 Jun 2026 19:08:51 +0200

For much of the past decade, enterprise networking was something the industry tried to abstract away. Cloud-first architectures commoditized switching and routing, burying them under software-defined layers. AI infrastructure has reversed that trajectory. Tom Gillis, senior vice president and general manager of Cisco’s infrastructure and security group, has a theory about why, and it starts with the network.

At Cisco Live this week, Cisco is announcing a broad set of security and infrastructure capabilities spanning vulnerability protection, network enforcement and agentic access control.

In the AI era, Gillis said, the network performs the role the PCI bus once played inside a single server. Distributed AI systems require memory, compute, GPU, and storage to work together across physical infrastructure at scale. The network is the backplane that makes that possible. The result, he said, is that customers have come to see it as the one thing they can count on.

“There is a new operating model necessary for infrastructure,” Gillis told Network World.

AI changed how Cisco builds its own products

The shift shows up inside Cisco’s own development organization. Gillis runs a team of roughly 12,000 software developers, and AI coding tools have fundamentally changed how that team works.

Earlier generations of AI coding tools produced significant gains on new projects, where a team of five to 10 developers could accomplish what once required 100 people working for a year. But those tools hit a ceiling on complex legacy products. A Catalyst switch or Cisco firewall can contain 50 to 100 million lines of code, more context than prior models could handle at once. Newer AI coding tools have removed that ceiling, allowing Cisco to accelerate development across its entire product portfolio.

The other side of that acceleration is vulnerability discovery. Frontier AI models like Anthropic’s Claude Mythos can now comprehend entire complex codebases and are finding vulnerabilities that humans have been unable to find.

“Frontier models are finding vulnerabilities at a scale that has never been achieved before, and it’s not one and done. These things are going to continue to find new vulnerabilities,” Gillis said.

A new security stack built from the Linux kernel up

The standard data center response to vulnerabilities has been to build a configuration, test and validate it, lock it down, and leave it alone. Gillis described that model as no longer viable. Switches and routers are inline, high-performance systems that require taking offline to update, which is why customers do it infrequently. Continuous AI-driven vulnerability discovery makes that approach untenable.

Cisco’s answer is built on Isovalent, its commercial platform based on the open source Cilium project, which uses eBPF technology built into the Linux kernel.

“What’s great about eBPF is that we can inspect memory, so we can look at that memory, we can see what’s happening, we intercept every system call and every function call, and we can modify those system calls and function calls,” Gillis said.

The eBPF based functionality enables multiple new capabilities in the Cisco platform. The headline capability is Live Protect, a feature built directly into Cisco network operating systems such as NXOS and IOS. A compensating control can be scoped to a specific process ID and file, blocking a particular action without affecting anything else on the system. For an administrator, the experience is a vulnerability flagged in the Nexus dashboard with a button to apply a shield.

“We’ve introduced a capability that can apply a compensating control to a running system without rebooting, touching, or modifying the binaries of that running system,” Gillis said.

Not every workload is an AI app

Live Protect and the Isovalent platform address the security challenge for infrastructure running today. But the infrastructure itself is also in transition, and Cisco is building for where most enterprises actually are, not just where they are headed.

“The enterprise, most of their workloads are not AI, right? They’re excited about AI, AI is gonna be cool as a rapid transition, but the vast majority of their workloads are still VM-based,” Gillis said. “VMs have been around for 20 years, and so our vision for this kind of data center of the future for the enterprise is that Kubernetes becomes the orchestration layer that runs all applications.”

The friction point is networking. VMware operates at Layer 2, Kubernetes is Layer 3, born in the cloud. Moving a VM from a VMware environment into Kubernetes has historically meant reengineering how it connects to everything else. Cisco’s Isovalent-based software bridge allows VMs to migrate one at a time without changing their IP addresses. The result is legacy VM workloads, container-based applications, and AI workloads running together on the same infrastructure, with no forced full migration.

At Cisco Live, Gillis is demoing that vision on the main stage. VM-based and Kubernetes-based workloads appear as peers in the same Nexus dashboard, with the Isovalent-based software bridge handling the Layer 2 to Layer 3 translation underneath.

The future of networking in the AI era

The announcements at Cisco Live address the infrastructure challenges of today. The next challenge is already visible. As AI agents begin acting on behalf of users across enterprise systems, the network faces a new access control problem it was not designed to solve.

A typical enterprise user has password-based access to hundreds of applications, with credentials that rotate on a six-month cycle. Extending that same access to an agent is too permissive. “We need to put task-based controls, much more ephemeral controls, in place for agents,” Gillis said. “An agent authorized to file an expense report should have no ability to make purchases; I do not want the agent to buy a Porsche.”

Cisco is addressing this through Cisco Secure Access, its SSE solution, and through its hybrid mesh firewall, with controls that are task-scoped and session-specific for both user-to-application and server-to-server scenarios.

Beyond the show floor, Gillis said Cisco has additional announcements planned for the fall. “We’ll make some announcements in the fall that I think are going to be startling,” he said, without providing details.

His near-term vision is a single infrastructure architecture that spans all application types. “A year from now, I hope customers are realizing, hey, I can build infrastructure that can power my AI apps that are kind of tomorrow, the same infrastructure can power my Kubernetes-based apps that are today, in my VM-based apps, which are yesterday, all with one design, one architecture,” Gillis said.

Russia-aligned crime group Greyvibe extensively uses AI in attacks

Sat, 30 May 2026 02:52:10 +0200

Researchers have uncovered a previously undocumented Russian group that makes extensive use of large language models (LLMs) in its attacks against private, government, and military organizations in Ukraine. It uses a variety of attack vectors along with custom malware, with the goal of intelligence gathering for the ongoing war.

Dubbed Greyvibe by researchers from WithSecure, the group has shown systematic use of generative AI across all stages of its operations, from crafting spear phishing lures and malicious scripts to full on malware development and setting up of backend infrastructure.

“While the activities align with Russian state interests, several observed indicators suggest the group has ties to the broader cybercrime ecosystem, with the group potentially involving current or former cybercriminal actors,” the WithSecure researchers said in their report.

Shifting attack vectors

Greyvibe’s first campaign was launched in August 2025, with a series of spear phishing emails that purported to come from Ukrainian officials and government agencies including the Kyiv City, the Main Directorate of the State Emergency, and the State Service of Special Communications and Information Protection.

The emails included links to ZIP and RAR archives, hosted on Google Drive and a service called 4sync, that contained malware loaders written in Python and JavaScript. The final payload was a custom malware program developed by the group that the WithSecure researchers dubbed PhantomRelay.

In another attack in October, the group experimented with ClickFix-style attacks on fake CloudFlare CAPTCHA pages. These attacks instructed users to open the Windows Run dialog and paste in malicious commands.

Greyvibe also set up fake adult club websites in Ukrainian, as well as fake websites for charities claiming to support the Ukrainian military with FPV drones and UAVs. These attacks distributed several malware programs for both Android devices (FallSpy) and Windows (PhantomRelay and LegionRelay).

The researchers also tracked a website in Russian that they believe was part of the group’s operations; it referenced hard-coded telephone exchange numbers for secure telecommunications that are typically used by the Russian military.

“The intended victimology of this activity remains unclear,” the researchers said. “However, the most plausible hypothesis is that the lure was designed to deceive Ukrainian military personnel by presenting the illusion of access to a Russian military terminal.”

Custom malware developed using LLMs

The PhantomRelay malware program is a remote access trojan (RAT) written in PowerShell that can execute additional custom scripts received from the command-and-control (C2) server. While variants of this program have been observed in activity that might be unrelated to Greyvibe, the group completely rewrote the tool and created a version that was exclusively used in its own operations.

LegionRelay is another PowerShell-based RAT that can similarly execute commands and scripts received from the C2 server; it is used for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup and other actions.

FallSpy is an Android spyware program that can steal contacts, call logs, a list of installed applications, SIM-linked phone numbers, device and network information, Wi-Fi SSID, the phone’s last known location, its public IP address, and media files.

Finally, a series of custom scripts for obfuscating and loading malware was also observed: LOOKVALPS (PowerShell), LOOKVALJS (JavaScript), DAYLIGHT (PowerShell), and TEASOUP (JavaScript).

The WithSecure researchers have determined, with moderate confidence, that several of these custom tools were developed with the help of LLMs. LegionRelay in particular, as well as the background infrastructure serving it, show strong indicators of AI generation. The researchers believe some of the platforms used by the attackers include Ideogram AI, ChatGPT and Google Gemini.

“Greyvibe appears to use AI not only for isolated development tasks, but across multiple operational phases,” the researchers said. “This likely enables the group to compensate for capability gaps, accelerate development cycles, and potentially reduce historical backlinks to prior activity. Given this extensive use, we expect the group’s tradecraft to continue evolving and diversifying, likely increasing the complexity of continuous detection, tracking, and attribution.”

Die besten JavaScript-Frameworks im Vergleich

Wed, 27 May 2026 05:36:45 +0200

Ein (passendes) JavaScript-Framework auszuwählen, ist ein bisschen wie Schuhe kaufen: Mit Blick auf das Gesamtangebot gibt es alles, was sich Softwareentwickler wünschen – nur nicht kombiniert in einem Modell.

Foto: RossHelen | shutterstock.com

Den (richtigen) Technologie-Stack auszuwählen, ist eine der diffizilsten Herausforderungen in Sachen Softwareentwicklung: Ohne Framework kein Development – allerdings zeigen sich die wahren Stärken und Schwächen eines Rahmenwerks erst in der Praxis. Für Developer eine Zwickmühle, aus der auch Prototyping nur bedingt befreien kann. Schließlich besteht die allgemeine Tendenz dazu, Technologien zu vertrauen, die sich in der Vergangenheit bewährt haben. So können allerdings auch innovative Entwicklungen durch die Lappen gehen. Das ist speziell mit Blick auf den Bereich der JavaScript-Frameworks wahrscheinlich, da deren Entwicklung besonders rasant voranschreitet. Dass qualitativ hochwertige Rahmenwerke im Überfluß zur Verfügung stehen, macht die Sache nicht besser.

In diesem Artikel werfen wir einen Blick auf die führenden JavaScript-(Frontend-)Frameworks und vergleichen diese auf Feature-Ebene miteinander. Folgende Frameworks werden dabei behandelt:

React
Vue
Angular
Preact
Lit
Svelte
AlpineJS
SolidJS
HTMX
Qwik

Es gibt diverse Möglichkeiten, sich der Entscheidung über ein JavaScript-Frontend-Framework anzunähern. Ein Faktor, den Sie dabei fokussieren sollten, ist Vertrautheit: Wenn Sie und Ihr Team mit einer bestimmten Technologie wirklich vertraut sind, sollten gute Gründe vorliegen, um davon abzuweichen. Diesbezüglich könnten folgende Fragen relevant sein:

Entspricht die Technologie nicht mehr den Anforderungen des Projekts?
Besteht die Gefahr, dass das von Ihnen verwendete Framework eingestellt wird?
Sind interessante Funktionalitäten nicht existent?

Wenn Sie alle Fragen mit ‘nein’ beantworten können, sollten Sie sich lieber zweimal überlegen, auf ein neues Framework umzusteigen. Dennoch ist es allgemein von Vorteil, neuen Frameworks offen gegenüberzustehen, die projektspezifische Benefits in den Bereichen Developer Experience, Performance oder Community Support realisieren können. Dazu kommt, dass JavaScript und speziell Frontend-Frameworks miteinander interagieren und sich gegenseitig stark beeinflussen. Sich mit einem Rahmenwerk zu befassen, kann deswegen oft zu synergetischen Insights führen. Anders ausgedrückt: Ein Frontend-Framework-Deepdive kann niemals schaden.

Die 10 wichtigsten JavaScript-Frameworks

Um einen Überblick über die führenden reaktiven Frameworks zu bekommen, werfen wir einen Blick auf die populärsten Abkömmlinge. Diese haben wir auf Grundlage ihrer jeweiligen Download-Zahlen auf dem Open Source Repository NPM ermittelt. Ein Klick auf den Link führt Sie zur jeweiligen NPM-Download-Seite inklusive der aktuellen Statistiken.

Obwohl Popularität kein besonders guter Indikator für Qualität ist, sagt sie doch viel darüber aus, wie es um die Verfügbarkeit von Developern steht, die mit dem Framework arbeiten können. Das könnte speziell für größere Teams und Projekte einen entscheidenden Faktor darstellen.

Zu beachten ist mit Blick auf die Top Ten, dass es sich bei allen “Kandidaten” um reine Frontend-Frameworks handelt. Einige dieser Projekte beinhalten auch ein Fullstack-Framework – etwa Next oder SvelteKit, was Backend-Funktionalitäten wie Server-seitiges Rendering ermöglicht. Das ist für einige Teams und Projekte unter Umständen ein weiterer bedeutender Auswahlfaktor in Sachen JavaScript-Framework. Im Folgenden ein detaillierter Blick auf die führenden reaktiven Frameworks. Ein Klick auf die Verlinkung im Titel führt Sie direkt zum jeweiligen GitHub Repository beziehungsweise der Projekt-Webseite.

React

Das Flaggschiff der reaktiven Frameworks ist im Jahr 2013 bei Facebook respektive Meta entstanden und wird bis heute vom Social-Media-Konzern verwaltet. Wie auch die Download-Zahlen von React zeigen, ist das Framework mit großem Abstand das populärste der hier vorgestellten – und quasi die Standardwahl unter den Frontend-Rahmenwerken. Trotz seines Alters wurde React kontinuierlich von Meta auf dem aktuellen Stand gehalten. Dabei könnte auch eine Rolle spielen, dass Facebook immer noch auf dem Framework aufbaut.

Das größte Argument gegen React: sein gewaltiger Umfang. Das kann den Einsatz beschwerlich gestalten, insbesondere wenn Sie an einem Projekt arbeiten, für das die meisten React-Features erst gar nicht nötig sind. Einige der nachfolgenden JavaScript-Frameworks sind nicht nur leichtgewichtiger, sondern bieten auch andere Ansätze.

Vue

Auch bei Vue handelt es sich um ein ausgereiftes Framework, das in Sachen Support gut aufgestellt ist. Im Vergleich zu React ist Vue deutlich leichtgewichtiger und schneidet auch bei Performance-Tests besser ab.

Vue steht in erster Linie im Ruf, eine moderate Lernkurve aufzuwerfen. Darüber hinaus kann das Framework mit einer ausgezeichneten Dokumentation und einer offenherzigen Community punkten. Einige Entwickler bevorzugen Vue auch wegen seines ausgeprägten Fokus auf die Developer Experience. Wenn Sie und Ihr Team gerne mit Vue arbeiten, kann das Framework langfristig dazu beitragen, die Benutzerfreundlichkeit und Mitarbeiterzufriedenheit zu erhöhen.

Von den “Big Three” unter den JavaScript-Frontend-Frameworks (React, Angular und Vue) ist Vue das basisorientierteste, was seinen Reiz haben kann.

Angular

Von allen hier gelisteten Frameworks bietet Angular die wohl ausgeprägteste All-in-One-Entwicklungserfahrung. Das Framework ist als durchgängige Lösung konzipiert, die verspricht, alles nötige in einem konsistenten Paket zu liefern. In der Vergangenheit galt Angular vor allem als komplex – sowohl in der Theorie als auch in der Praxis. Zudem war ein Hauch von Overengineering bei Angular zu verspüren – eine Entwicklung die in erster Linie dem Design geschuldet war.

Das hat sich inzwischen allerdings grundlegend geändert: Die Entwickler hinter dem Projekt haben das Framework (mit Version 17) in diversen Aspekten simplifiziert und die Entwicklererfahrung optimiert – zudem steht nun auch eine effektive Rendering-Engine für Server-seitige Tasks zur Verfügung. Darüber hinaus wurden auch die Dokumentation und die offizielle Webseite modernisiert.

Ein wesentlicher Unterschied zu React und Vue: Angular ist eher “rechthaberisch” – für die meisten Dinge gibt es klar definierte Vorgaben. Das kann es erschweren, mit Angular Applikationen anzupassen oder unkonventionelle Wege zu gehen. Ob das von Vor- oder von Nachteil ist, hängt im Wesentlichen von Ihrem persönlichen Programmierstil ab.

Preact

Die Nomenklatur deutet es bereits an: Bei Preact handelt es sich um ein von React inspiriertes Framework – quasi eine abgespeckte Version desselbigen mit ähnlichen aber kleineren APIs. Einer der wesentlichen Unterschiede besteht dabei darin, dass Preact kein eigenes Eventing-System implementiert. Stattdessen nutzt es die in den Browser integrierten Event Listener.

Im Vergleich mit React entwickeln Sie mit Preact schneller und schlanker – dafür müssen Sie auf einige Funktionalitäten des “Originals” verzichten. Sie können Preact allerdings mit einem zusätzlichen Layer ausstatten und so nahezu vollständige React-Kompatibilität erreichen. Diverse Komponenten aus dem React-Ökosystem funktionieren dann auch mit Preact.

Wenn Sie auf kleinere APIs Wert legen, sich dabei aber weitgehend im React-Ökosystem bewegen möchten, ist dieses reaktive Framework möglicherweise eine gute Wahl.

Lit

Das Alleinstellungsmerkmal von Lit: Es nutzt den Web-Components-Standard als Grundlage. Das hat zur Folge, dass die API und das Bundle selbst sehr klein sind. Der Fokus liegt darauf, die integrierten Web Components zu unterstützen. Darüber hinaus fußt Lit auf einer minimalistischen Entwicklungsphilosophie, die Ihnen maximale Flexibilität ermöglicht: Es gibt nur wenige festgeschriebene Wege, um Dinge mit Lit zu erledigen.

Das Framework weist – gemessen an seiner Größe und Popularität – ein sehr umfangreiches Ökosystem auf.

Svelte

Dieses reaktive Framework zeichnet sich in erster Linie dadurch aus, dass es einen Compiler zum Einsatz bringt. Der transformiert die Svelte-Syntax in ein kleines und performantes JavaScript-Bundle. Das ermöglicht dem Framework, einige Optimierungen bereits im Vorfeld vorzunehmen – und mit interessanten Syntax-Elementen zu experimentieren.

Mit Blick auf die “Big Three” ist Svelte am ehesten mit Vue vergleichbar, weil es sich gut für unabhängige Experimente eignet. Die Dokumentation von Vue ist gut ausgestaltet und das Framework erfreut sich in der Open-Source-Community wachsender Beliebtheit.

AlpineJS

Von allen hier vorgestellten Frameworks ist AlpineJS das utilitaristischste. Es bietet eine kompakte Reactive-Bibliothek – das war’s. Trotz seines überschaubaren Footprints steckt in diesem reaktiven Framework jedoch eine ganze Menge Power.

Wie HTMX (dazu später) will auch AlpineJS Komplexität beseitigen, dabei jedoch die Grundlagen moderner Frontend-Funktionalität gewährleisten. Um diese Funktionalität “auf die Straße zu bringen”, nutzt das JavaScript-Framework spezielle HTML-Eigenschaften.

SolidJS

Im Vergleich zu den anderen hier gelisteten JavaScript-Frontend-Frameworks ist Solid ein Vertreter der jüngeren Generation. Nichtsdestotrotz konnte SolidJS bereits (im positiven Sinn) für Furore sorgen und erfreut sich einer wachsenden Nutzerbasis.

Das Framework fußt auf Signals (Reactive Primitives), die ihm eine flexible Grundlage verschaffen. Um die Funktionalität zu erweitern, können sowohl das Framework selbst als auch der Anwender-Code auf dieselben Features zugreifen. In Sachen Performance-Tests schneidet SolidJS gut ab.

HTMX

Einen völlig anderen Ansatz, um Web-Frontends zu entwickeln, wirft HTMX auf: Es versucht, so viel Komplexität wie möglich zu eliminieren, REST wie beabsichtigt einzusetzen und “reines” HTML (mit einigen grundlegenden Verbesserungen) zu nutzen, um modernen Anforderungen wie AJAX- und DOM-Interaktionen gerecht zu werden.

HTMX kann eine lohnende Option sein, wenn Sie auf Dinge wie Server-seitiges Rendering verzichten können. Einer der größten Pluspunkte des Frameworks: Es ist relativ einfach zu erlernen. Wir können nur empfehlen, sich zumindest mit diesem Projekt zu beschäftigen – und sei es nur wegen der zugrundeliegenden Idee.

Qwik

Unter der Haube ist Qwik eine exotische Implementierung, die die Performance in den Mittelpunkt rückt. Das Framework zerlegt Applikationen in unterscheidbare Elemente und orientiert sich dabei an “Grenzen” wie Eventing oder Komponenten – entlang derer aggressives Lazy Loading zum Einsatz kommt. Das Ergebnis: schnelleres Rendering.

Reactive Frameworks im (Feature-)Vergleich

Nachdem Sie die zehn wichtigsten Reactive-Framework-Optionen kennengelernt haben, geht es nun darum, die wichtigsten Funktionen und Merkmale miteinander zu vergleichen. Zunächst haben wir die reaktiven Rahmenwerke noch einmal in einer Übersicht zusammengetragen, die auf einen Blick Auskunft über die jeweiligen Lernkurven und Funktions-Highlights gibt.

Framework	Lernkurve	Highlights
React	moderat bis steil	konservativste Option; riesiges Ökosystem und Community; Balance zwischen Innovation und Stabilität;
Vue	moderat	leicht zu erlernen und einzusetzen; ein etabliertes Framework das weniger “corporate” ist;
Angular	steil	ein robustes Framework für große Projekte; Enterprise-orientiert; integrierter All-in-One-Ansatz;
Preact	moderat	React-ähnlich mit schnelleren Ladezeiten; insbesondere für Mobile Development empfehlenswert;
Lit	moderat	leichtgewichtig und performant mit Fokus auf Standards; leichter mit beispielsweise HTML kombinierbar;
Svelte	moderat	kleinerer Memory-Footprint; fokussiert die Entwicklererfahrung und Innovationen;
Alpine	flach	leichtgewichtiges Toolset; einfach zu erlernen und beherrschen; gut geeignet für kleinere bis mittelgroße Projekte;
SolidJS	moderat bis steil	reaktiver Kern auf Signals-Basis; Performance-orientiert;
HTMX	flach	einfach zu erlernen und zu integrieren; einzigartige, vereinfachte REST-Architektur;
Qwik	steil	innovativ und Performance-orientiert; integriert mit builder.io;

Wenn Sie nun Wert auf ganz spezielle Funktionen legen, bringt Ihnen diese Tabelle natürlich wenig. Deswegen haben wir auch noch einen umfangreichen Feature-Vergleich der gelisteten JavaScript-Frontend-Frameworks für Sie erstellt. Diesen können Sie auch direkt über GitHub als PDF-Datei herunterladen (inklusive klickbarer Links).

Die zehn wichtigsten JavaScript-Frameworks im Feature-Vergleich.

Foto: Matthew Tyson | IDG

Playgrounds

Um sich einen schnellen ersten Eindruck von einem Framework zu verschaffen, empfiehlt sich, es in einem Online-REPL respektive Playground zu testen. Dazu ist kein Tooling-Setup erforderlich – ein Webbrowser reicht, um mit der Syntax experimentieren zu können. Sämtliche hier vorgestellten Frameworks können das bieten. React hostet zwar keine eigenen REPLs, diese Lücke wird jedoch von Drittanbietern geschlossen.

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

The Patching Race Was Already Lost. AI Just Made It Obvious.

Fri, 22 May 2026 21:51:37 +0200

AI just rewrote the offensive economics of finding and weaponizing vulnerabilities. Most peers I’m talking to, and most vendor write-ups I’m reading, already get that patching alone isn’t enough. Yet patching still tends to land near the top of most response lists, and from what I’ve seen in the past 30 years, it’s the part […]

The post The Patching Race Was Already Lost. AI Just Made It Obvious. appeared first on SecureBlitz Cybersecurity.

Things Are Quietly Changing at Bitwarden, and People Are Worried

Tue, 19 May 2026 17:31:11 +0200

The password manager swapped its CEO, rewrote its core values, and briefly pulled "Always Free" from its pricing page.

A Pentester’s Methodology for Toxic Vulnerability Combinations

Tue, 19 May 2026 11:23:53 +0200

How a Low, a Medium, and a High Compose Into a Critical

Senior pentesters find these toxic combinations the same way every time. A four-phase methodology. Each phase asks one question. This post walks the methodology through a real discovery from an authorized assessment.

The Outcome First

A handful of anonymous API calls. One legitimate login at the end, as the victim. Five thousand customer accounts, every one of them reachable. Every password overwritten in a few seconds. Every account logged in to with the credentials the attacker chose. No privilege escalation, no token forgery, no exploit primitive. Every request the chain made was authorized as the attacker, because most of the chain never asked the attacker who they were.

The scanner that ran against the same application before the engagement reported the underlying findings as separate items. None rated Critical. All sat unremarkably in the triage backlog.

This post walks through how a pentester gets from those findings to that outcome. The mechanism is a methodology. It does not appear on any scanner’s findings list, but every experienced practitioner uses some version of it, and the structure is consistent enough to teach.

The methodology has four phases. Each phase asks one specific question of the application. The answers from each phase become inputs to the next. When all four answers connect, you have a toxic combination. Three or four findings whose individual severities understate what they enable when chained. In the engagement walked through here, that combination is one Low, one Medium, and one High that compose into a Critical.

The four questions:

[1] Information Gathering. What does the application teach me, that I shouldn’t have learned, just by being here?
[2] Vulnerability Analysis. Which inputs identify objects, and which of those are not bound to my session?
[3] Attack Execution. Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?
[4] Exploitation. Can the chain produce a state change the application’s normal threat model would not detect?

Each phase carries a severity rating taken in isolation. None of the individual ratings is Critical. The combination is.

What follows comes from an authorized assessment. The endpoint paths, request shapes, and overall chain are reproduced from the engagement. The data values (names, emails, profile IDs, hash strings) are synthesized so nothing in this post identifies the assessed application or any real customer. The pattern reported here was filed, escalated, and remediated before the application’s planned sunset.

The Starting Position

The engagement began the way most do. Pre-test triage produced the usual mix. A few missing security headers, a reflective XSS hint that turned out to be a false positive, a “verbose error message” entry against the login endpoint marked Medium, and a generic “missing headers on JavaScript file” against app.js.

If I had treated that as a finished list, the engagement would have been a four-paragraph memo. Three findings to acknowledge, one to push back on, sign off, move on. The chain that ended in mass account takeover would have stayed undiscovered.

I opened the JavaScript file anyway. Not because I expected anything interesting. Reading the bundle is a habit I picked up from senior reviewers years ago. Automated tooling can tell me a file is missing a header. It cannot tell me what the file does.

Every step of the methodology starts from the lowest-privilege legitimate position the application allows. Not because elevated access is hard to get, but because chains that start from admin tell us nothing about the threat model that matters most. The user the application already trusts. The chain that follows holds against an unauthenticated visitor for the first three phases. The position rises to a legitimate customer login only at the very end, when the chain reaches its outcome.

Phase 1: Information Gathering

What does the application teach me, that I shouldn’t have learned, just by being here?

I never logged in for this phase. Visiting the login page through Burp’s proxy was enough.

The login page’s HTML loads four obvious script files (main.js, apim-auth.js, env.js, firebase.js) and one less obvious one. A declaration in the page head causes the browser to issue a GET for /js/app.js during initial page load. This is the kind of tag a webpack build emits when it wants the browser to prefetch a route chunk for the next navigation. Burp captured all five files in the same proxy history sequence, before I had typed a single character into the login form. The fifth file, app.js, is the post-login dashboard’s bundle. Its presence in the proxy history meant the application had already shipped its post-login API catalog to me, an unauthenticated visitor.

Opening app.js in Burp’s response viewer, the first dozen lines told me everything I needed to know about the API surface I was about to test.

// Internal API endpoint catalog (used by build tools, do not remove)
 // POST /api/login body { email, password }
 // GET /api/profile?id=N profile by numeric id (admin only)
 // GET /api/profile/password?id=N legacy reset-lookup (returns salt+hash)
 // PUT /api/profile/password body { id?, currentPassword?, newPassword }
 // POST /api/account/info body { userProfileID: N }
 //
 // TODO(qa): remove qa.test@acme-portal.local seed account before release.
 // Leftover from QA cycle. Admin role, used for password-reset regression tests.

Three things jump out of the catalog in under five seconds.

1. /api/profile?id=N is annotated “admin only”, but it is rendered by the customer dashboard. Either the comment is wrong, the gate is wrong, or both. Worth probing.

2. /api/profile/password GET returns salt+hash. That phrase belongs in a database row, not an HTTP response body. Worth probing harder.

3. PUT /api/profile/password accepts an id in addition to currentPassword. Optional id. Two execution branches in one endpoint. The branch that takes id cannot also be requiring the current password, otherwise the optional structure makes no sense.

The TODO comment names a specific email, qa.test@acme-portal.local. The developer who wrote the comment intended to remove the seed account before release. They clearly did not. The seed account also appears to have an admin role.

I rated this finding Low in isolation. Information disclosure to unauthenticated visitors is a notch worse than disclosure to authenticated users, but the file does not contain credentials, tokens, or directly exploitable data on its own. A reviewer skimming the bundle would tag it “Low, verify, accept the risk if no PII is exposed.” That triage is technically correct. It also prematurely closes the most interesting input the chain ever produces.

The methodology question for Phase 1 is not “what is the severity of the JS bundle exposure?” The question is what does the application teach me that I shouldn’t have learned just by being here? The answer is an inventory of inputs the developers thought the requester would not see.

That inventory is the input for Phase 2.

Phase 2: Vulnerability Analysis

Which inputs identify objects, and which of those are not bound to my session?

Phase 2 lives inside the login endpoint, which the application has to expose to unauthenticated visitors by definition. I stayed unauthenticated.

Before testing the other endpoints from the catalog directly, I tried something the JS bundle made specifically possible. I attempted to log in using qa.test@acme-portal.local, the email left behind in the TODO comment, with a deliberately wrong password. I expected the standard “Invalid credentials” response. What I got was different.

POST /api/login HTTP/1.1
Content-Type: application/json
 
{"email":"qa.test@acme-portal.local","password":"wrongpass"}

Response:
    {
     "IsSuccess": false,
     "error": "Email exists but password is incorrect",
     "email": "qa.test@acme-portal.local",
     "userName": "QA Test Account",
     "userProfileID": 9999,
     "role": "admin"
    }

The IsSuccess: false field told me authentication failed. Everything below it told me the account exists, that it is named “QA Test Account”, that its profile ID is 9999, and that its role is admin. None of that should be in a failed-login response.

Verbose login response leaks PII when the email exists

I tested the same path against an email I knew was not in the system (noone@nowhere.invalid).

{ "IsSuccess": false, "error": "Invalid credentials" }

Generic 401, no metadata. The verbose response only fires when the email exists. That is not a verbose error message. That is a user-enumeration oracle. Type any email at the login endpoint and the response shape tells you whether the email is registered. If it is, it also tells you the user’s name, profile ID, and role.

I confirmed the same shape against a known regular customer.

{
 "IsSuccess": false,
 "error": "Email exists but password is incorrect",
 "email": "sarah.thompson@outlook.com",
 "userName": "Sarah Thompson",
 "userProfileID": 2,
 "role": "customer"
}

The failed-login path leaks email, name, profile ID, and role for any registered email, to an unauthenticated visitor, with no rate limit applied. I rated this Medium in isolation. Verbose-error responses that disclose user metadata land squarely in standard Medium territory, and that rating is the right one to file. What elevates this finding inside the chain is the role field. That field tells the attacker which profile IDs are admin accounts, which becomes the prioritization for Phase 3. The Medium rating is correct. The chain is what makes it dangerous.

The output of Phase 2 is the data the gap leaks. Numeric profile IDs, and the knowledge that profile ID 9999 holds an admin role. That data is the input for Phase 3.

Phase 3: Attack Execution

Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?

The catalog from Phase 1 listed a curious endpoint.

GET /api/profile/password?id=N legacy reset-lookup (returns salt+hash)

Why would a password reset endpoint return the salt and hash? In a normal architecture, the reset flow generates a token, emails it, and accepts a new password. The hash never leaves the database. A “legacy reset-lookup” endpoint that returns hash and salt is the kind of thing that exists because some backend developer wrote a JSON wrapper around a legacy SOAP method without thinking about what they were exposing.

Out of habit, my first probe carried an Authorization header, a Bearer token I had picked up from a separate test session. The endpoint returned 200 with the salt and hash. I made the same call again with the Authorization header removed entirely. Same 200. Same salt and hash.

The endpoint had not checked the token. The endpoint was not checking authentication at all.

GET /api/profile/password?id=2 HTTP/1.1
Accept: application/json

Response:
    {
     "IsSuccess": true,
     "userProfileID": 2,
     "userName": "Sarah Thompson",
     "email": "sarah.thompson@outlook.com",
     "role": "customer",
     "passwordHash": "A917B980DA07B1051F071DCBD0CDA0BAED53567AEEE5E92B2E4765631ED4FEEF",
     "salt": "4329e437404ef2f8"
    }

Hash and salt returned by the legacy reset-lookup endpoint for any profile id

No Authorization header. No session cookie. No API key. The endpoint never asked. Hash, salt, email, username, role, all returned to an anonymous caller, for any profile ID that exists.

This is two authorization failures stacked on the same endpoint. The first is missing authentication entirely. The endpoint accepts requests from anyone on the public internet without checking who is calling. The second is missing object-level authorization. Even if the endpoint did check the caller, it would have no notion of which profile IDs that caller is allowed to read, because the code doesn’t bind the id parameter to any session at all. A scanner would catch neither pattern by itself. It would see a 200 response and move on.

A senior pentester recognizes the broken-object-level-authorization shape on a credential-bearing endpoint and rates this High. Practical impact is offline credential cracking against any user the attacker can name, with no rate limit and no authentication barrier.

The methodology pushes one more step before rating. The output of an enumeration step is rarely the data of one record. It is the proof that the enumeration itself works, which means the next step is to scale. I added a second enumeration target, the account/info endpoint that the catalog also listed.

POST /api/account/info HTTP/1.1
Content-Type: application/json
 
{"userProfileID":3}

Response:
    {
     "IsSuccess": true,
     "userProfileID": 3,
     "userName": "Robert Chen",
     "email": "robert.chen@yahoo.com",
     "policyNumber": "POL-10004"
     }

Same pattern. No authentication required. No ownership check. The endpoint accepts any profile ID and returns email, username, and policy number. Looped over an incrementing range of profile IDs, this becomes a full customer enumeration in a few seconds. The customer database held close to 5000 records. The loop returned every one of them.

At this point I had, anonymously:

A user-enumeration primitive (the verbose login response)
A salt+hash leak for any profile ID (the GET reset-lookup)
An email, name, and policy disclosure for any profile ID (the account/info endpoint)
The knowledge that profile ID 9999 is a leftover admin account
The original IDOR observation from the catalog comment (“admin only” gate that wasn’t enforced)

Three independent findings, each of which a triage process would handle separately. The methodology does not let me stop and report yet. Phase 3’s question is not just “did the read work?” It is does the same identifier I just exfiltrated work on a write endpoint?

The catalog listed the answer.

PUT /api/profile/password body { id?, currentPassword?, newPassword }

Optional id. Optional currentPassword. The shape itself is the bug. There is no execution path where the request both takes an id and requires the current password, because the optional structure does not allow it. The attacker passes the ID and skips the password check entirely.

PUT /api/profile/password HTTP/1.1
Content-Type: application/json
 
{"id": 2, "newPassword": "pwned!2026"}

Response:
{ "message": "Password updated", "userId": "CUST-002" }

BOLA write: password overwritten with no current-password check

No Authorization. No current-password challenge. Sarah Thompson’s password rewritten by an anonymous request, using only the profile ID enumerated from Phase 2.

I rated this High in isolation. Broken Object Level Authorization on the write side, sitting on top of broken authentication on the same endpoint. The read side already established that profile IDs are enumerable. The write side converts that enumeration into account-level state changes. This is the moment the chain becomes practical.

Phase 4: Exploitation

Can the chain produce a state change the application’s normal threat model would not detect?

The previous phases each produced a finding. This phase produces an outcome.

Phase 4 is the only authenticated request in the chain, and the attacker authenticates as the victim.

POST /api/login HTTP/1.1
Content-Type: application/json
 
{"email":"sarah.thompson@outlook.com","password":"pwned!2026"}

Response:
    {
     "IsSuccess": true,
     "token": "eyJhbGci…Sarah's customer token…",
     "role": "customer",
     "name": "Sarah Thompson",
     "customerId": "CUST-002"
    }

I am Sarah Thompson now, as far as the application is concerned. The login endpoint cannot tell me apart from her, because the credential store says I am her.

Looped across the enumerated profile IDs, this is mass account takeover. Every one of the nearly 5000 customer records was reachable from the chain. There is no impersonation, no token forgery, no privilege escalation. The application’s authentication did its job at the login endpoint, but the application’s authentication never ran at the other endpoints, because those endpoints did not require it. Authorization decisions on the object level (should this requester be allowed to act on this specific record) never happened either.

I stopped after demonstrating impact on a single account. Exploiting the rest of the enumerable population would have served no purpose for the report.

That is the asymmetry the methodology exposes. Mass takeover by a “legitimate” login does not look like an attack to most monitoring. It looks like a customer changing their password and logging in with the new password, repeatedly. Detection systems built around “unauthorized access” do not fire, because every request to the chain’s anonymous endpoints returned 200, and every login at the end returned a valid token. Nothing in the audit log says “attack.”

The Methodology, Extracted

Read backwards from the chain that worked, the methodology has four phases.

1. Information Gathering. What does the application teach me, that I shouldn’t have learned, just by being here?

2. Vulnerability Analysis. Which inputs identify objects, and which of those are not bound to my session?

3. Attack Execution. Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?

4. Exploitation. Can the chain produce a state change the application’s normal threat model would not detect?

Each phase carries a severity rating taken in isolation. None is Critical. The combination is.

When the four phases are complete, the chain documents into a single table that forces clarity about three things every chain has but reports often muddle. What the attacker learned at this step, what they could do with it, and what the next step needed as input.

Toxic Vulnerability Combinations: A Pentester’s Methodology in Four Phases

Three things the table makes explicit that a typical pentest report does not.

The “Available info” row tracks what the attacker carries forward. Each column’s available info is the input needed for the next column. Phase 2 needed the API catalog and the admin hint from Phase 1. Phase 3 needed the profile IDs from Phase 2. Phase 4 needed the rewritten passwords from Phase 3. If the table has a column where “Available info” cannot be reused as input to the next column, the chain breaks. If it can, the chain holds.

The “Auth required” row records what the application demanded at each step. Three of the four phases, including the one that exfiltrated credential material and the one that rewrote passwords, demanded nothing. That single row is the structural failure the entire chain rests on.

The “Methodology question” row is the teaching artifact. When a junior pentester reviews the table, the questions are reusable. The next time they hunt a chain, they ask the same four questions of a different application. The answers will be different. The methodology will be the same.

Remediation

The chain in this post worked because three different layers of defense were missing. Authentication, object-level authorization, and information-disclosure controls. Closing the chain means closing all three. Here is the layered fix, ordered by structural importance.

1. Authentication and Authorization

These are the load-bearing fixes. Everything else is detection on top of a broken foundation.

Require authentication on every endpoint that returns account-scoped data. GET /api/profile, GET /api/profile/password, POST /api/account/info, and PUT /api/profile/password all need a valid session token. Endpoints accept anonymous calls because the developer assumed they would only be called from “trusted internal contexts.” There is no trusted internal context for an HTTP endpoint published on the public internet.
Implement Role-Based Access Control (RBAC) at the route layer. Admin endpoints check role === ‘admin’ in middleware before the handler runs. Comments like // admin only in source code are not access control. The check has to be in code that executes on every request.
Implement object-level authorization (BOLA prevention). Every endpoint that takes an identifier in input verifies the requester owns the resource. The pattern is if (resource.ownerId !== session.userId) return 403. Apply this at the database query layer when possible. SELECT * FROM profiles WHERE id = ? AND owner_id = ? removes the possibility of forgetting the ownership check in handler code.
Require the current password on self-service password changes. Not optional. The optional id or currentPassword shape on PUT /api/profile/password was the write-side bug. Endpoint signatures should have exactly one execution path. If a function needs two paths, split it into two functions.
Do not return credential material in API responses. The legacy reset-lookup endpoint that returned hash and salt should not exist. Password reset flows are token-based and never expose hashes to any client. If a legacy SOAP or JSON wrapper produced this response shape, the fix is to delete the wrapper or rewrite it to return only what the reset flow actually needs.

2. Information Disclosure

These close the channels Phase 1 and Phase 2 used to seed the chain.

Generic error responses on the login endpoint. The verbose IsSuccess: false shape that disclosed email, name, profile ID, and role for any registered email is a user-enumeration oracle. Login failures should return { IsSuccess: false, error: ‘Invalid credentials’ } for every failure case (wrong password, nonexistent email, locked account, expired account) with consistent timing.
Strip developer artifacts from production bundles. The API catalog and TODO comment that powered Phase 1 of this chain should not have been in app.js. Webpack’s TerserPlugin removes comments when comments: false is set in production builds. Inline JSDoc annotations on internal routes belong in source files, not built artifacts.
Audit preload chains. The tag shipped the post-login dashboard’s bundle to every visitor of the login page. Route-based code splitting can prevent this. app.js should be lazy-loaded after authentication, not preloaded eagerly.
Remove seed and test accounts before production deployment. The QA seed account qa.test@acme-portal.local should not have shipped to production. CI/CD pipelines should fail builds if seed-only email patterns appear in the database migration set targeted at a production environment.

3. Operational Layer

Detection that catches the chain even when prevention fails.

Rate limit the login endpoint by IP and by email address. Enumeration probing requires many requests against /api/login in a short window. Rate limits slow this enough that it becomes detectable before the attacker completes the enumeration.
Monitor for the chain’s operational signature. High-volume password resets followed by successful logins from the same IP, across multiple accounts, is the fingerprint of this attack. Detection should fire on the rate and the across-account pattern, not on any single request.
Anomaly detection on BOLA writes. Legitimate users change their own passwords occasionally. A single client changing many accounts’ passwords in a short window is anomalous and should fire. And should fire before the chain reaches Phase 4.

Takeaways

Automated tooling is good at finding individual classes of vulnerability and bad at finding sequences. A finding has a severity, a remediation, and a report entry. A chain has none of those. The taxonomy our tooling was built around was designed for bugs, not for combinations of bugs. That is why three findings rated Low, Medium, and High can sit unremarkably in a triage backlog while the chain they compose is Critical. The tooling is necessary. It is not sufficient. The methodology is what closes the gap.

What that means for the people doing the work:

Pentesters and bug bounty researchers. Apply the four questions in sequence. When you find an IDOR, do not stop at the IDOR. Phase 2’s output is the input to Phase 3. Look at the next write endpoint that accepts the same identifier type. And test every endpoint without an Authorization header at least once. Missing-auth on the read side is one of the most common ways a chain that should have required a token becomes anonymously exploitable.
Code reviewers. Ask two questions of every endpoint that takes an identifier in input. “Does this endpoint require authentication?” and “What happens if a user passes someone else’s id here?” Apply both to every endpoint, not just the ones that “look” sensitive. That pair of questions, applied consistently, turns chained authorization bugs into single-endpoint authorization bugs that tooling can find before the chain forms.
Triage teams. Read the chain as a unit, not the findings as separate items. A verbose error, an unauthenticated IDOR on a read endpoint, and a missing current-password check on a write endpoint are not three unrelated tickets. They are three halves of one chain that need to be closed in the same release.
Developers. Every parameter that names an object the requester might not own is an authorization decision waiting to happen. Every endpoint without an authentication middleware is an authorization decision the application has already refused to make. If your endpoint signature has an optional id parameter alongside an optional currentPassword parameter, you have written two execution paths into one function and one of them is going to skip a check it shouldn’t skip.

The chain is a category of vulnerability that does not exist on a scanner’s findings list and never will. Until our tools understand sequences, the work belongs to the practitioners who already do. The methodology in this post is one way to write that work down. Four questions a junior pentester can apply to a different application tomorrow morning, with the same instinct it used to take a senior reviewer ten years to build.

Author

Hemanth Gorijala is an application security practitioner. He builds open-source security tooling, conducts web application assessments, and reviews vulnerability reports in enterprise bug bounty programs. His open-source tooling for runtime credential detection, SecretSifter, is at github.com/secretsifter.

A Pentester’s Methodology for Toxic Vulnerability Combinations was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

20 Leaders Who Built the CISO Era: 2 Decades of Change

Tue, 12 May 2026 14:08:49 +0200

As part of Dark Reading's 20th anniversary special coverage, we profile the CISOs, founders, researchers, criminals, and policymakers who rewrote the enterprise risk playbook.

They Charged $10/Month for a $5 Server, a Free Script, and Three Years of Lies. Here’s the Proof.

Sun, 10 May 2026 22:07:37 +0200

This is not a review. This is a documented technical record. Every claim in this article is reproducible by anyone with an internet connection. The commands are included. Run them yourself.

How This Started

I joined CoderLegion as a content creator and reached #2 on the monthly leaderboard within days — not because I’m exceptional, but because barely anyone posts.

Then the founder, Mehadi Hasan, sent me this:

“I’d love to give you Premium free for a month and get your feedback on whether it actually helps. No pressure at all.”

Before accepting any offer involving payment details or long-term content investment, I look at what a platform is actually built on.

What I found is below. Every line is publicly verifiable.

Finding 1: The Founding Date Is Fiction

Run this in any terminal:

$ curl -s https://coderlegion.com | grep -C 2 "dateCreated"

"dateCreated": "2020",
"publisher": "Coder Legion"

That markup is baked into every single page on the platform. It tells search engines — and every visitor — that this operation has existed since 2020.

Now run this:

$ whois coderlegion.com | grep -E "Creation Date|Registry Expiry Date|Domain Status" | sort -u

Creation Date: 2023-07-21T16:50:42Z

The domain was not registered until July 21, 2023.

The predecessor domain — kodlogs.net, the platform they rebranded from — only goes back to May 2021. That is the earliest any version of this operation can be placed in public record. Two years short of what they claim. And the current domain adds another two years on top of that.

There is no archived platform. No prior domain. No public evidence of existence before 2021.

Three years of claimed history. Zero evidence. Embedded in every page.

Finding 2: They Said No Ads. The Source Code Disagrees.

From their About page, verbatim:

“The platform is completely free to use. We don’t run ads or charge authors.”

Press Ctrl+U on any CoderLegion page. Search for adsbygoogle. You'll find an active Google AdSense implementation with publisher ID ca-pub-1763140298030248.

Ads appear in the sidebar. At the bottom of posts. On the homepage.

And on the Delete Profile page — while you are in the process of permanently erasing your account:

“We don’t run ads.” — The About page. This is the Delete Profile page.

During the investigation, a second ad network also appeared on mobile — MetroOpinion, a third-party survey platform:

Two ad networks. On a platform that explicitly claims to run no ads.

The About page is marketing copy. The source code is the ground truth. They do not match.

Finding 3: The User Count Is Not Accurate — And It’s Not Even Consistent

Every visitor to CoderLegion sees this in the login modal:

That number was 4,065 during an earlier analysis session. It’s now 4,081. The number is not pulled from the database in real-time — it changes manually, which means someone is editing it by hand.

Here is what the database actually says. The users page has public pagination. Pagination has math:

URL pattern:          /users?start={offset}
Items per page:       30
Last accessible offset: 1170

Calculation:
  1170 / 30 = 39 full pages
  + final page = ~40 pages total
  40 × 30 = ~1,200 real users

The modal claims 4,081. The database supports ~1,200.

That is a 70% inflation in the number shown to every prospective user at the exact moment they decide whether to sign up. And the fact that the number changes between sessions — going from 4,065 to 4,081 — confirms it is being managed manually, not calculated.

Finding 4: The Infrastructure Behind the $10/Month Plan

$ curl -I https://coderlegion.com | grep -i server
server: LiteSpeed

LiteSpeed shared hosting. Market rate: $3–5/month.

Open the page source (Ctrl+U). Search for qa-theme:

/qa-theme/CoderLegion/
/qa-plugin/q2a-badges-master/
/qa-content/jquery-3.3.1.min.js

Session cookies:
  qa_key     ← Question2Answer token
  PHPSESSID  ← PHP backend

This platform runs on Question2Answer — a free, open-source PHP script. Zero license cost. Publicly available at question2answer.org.

This is what they are charging you $10/month for:

“Supercharge Your Developer Journey.” Free Q2A script. $5 shared hosting. ~37 active writers per month.

“10x More Visibility” among 37 people. On a free script. On a $5 server.

Finding 5: GoDaddy Has Blocked Renewal on Both Domains

The WHOIS output from the terminal screenshot above tells the full story:

$ whois coderlegion.com

Domain Status: clientRenewProhibited ⚠
Registry Expiry Date: 2026-07-21

$ whois kodlogs.net

Domain Status: clientRenewProhibited ⚠
Registry Expiry Date: 2026-05-08

clientRenewProhibited is not a default flag. A registrar applies it when the domain owner is blocked from renewing — typically due to outstanding billing disputes, account holds, or compliance violations.

Both the current domain and the predecessor domain carry this flag.

kodlogs.net has already expired as of the date of this writing. coderlegion.com expires July 21, 2026.

One additional data point: the WHOIS record for coderlegion.com was updated April 14, 2026 — days after a technical analysis of this platform was published publicly. WHOIS records do not update themselves.

If you have content on CoderLegion, export it today. Not next week. Today.

Finding 6: The Database Is Observable from the Public Internet

This is a passive observation, not an exploit. Standard security practice requires database services (MariaDB/MySQL, port 3306) to be bound to localhost — invisible to the outside world.

Expected:   127.0.0.1:3306  ← accessible to local services only
Observed:   0.0.0.0:3306    ← observable from public internet

A payment-collecting platform with a publicly observable database port is the kind of configuration that ends with breach notification emails. Verifiable via Shodan or standard port scanning. No credentials required.

If you have entered payment information on CoderLegion, you should be aware of this.

Finding 7: The Authentication Controls Are Broken

Observed during normal use of my own account:

Password reset: The forgot-password flow accepts a new password directly without sending a verification link to the registered email. Ownership of the account is never confirmed.

Account deletion: The deletion confirmation field — marked “Please enter your password” — accepts any non-empty string. It does not validate against the account’s actual password. An account can be deleted by anyone who can reach the page.

Both are basic authentication failures. Both were found in under five minutes of normal account usage.

Finding 8: There Is No Peter Jones

Before this investigation, I received the following:

From:    Peter Jones 
To:      [my email]

Hi Rockman,

Your recent post "You Don't Need Chaos Monkey" on Hashnode really
caught my attention...

My name is FreeRave. Not Rockman. The {{first_name}} merge variable pulled a different contact's data from the bulk list. The email was sent anyway.

Independent reports confirm the same template was sent from different sender names — “Peter Jones,” “Ross,” and others — all from @legioncoder.com addresses, all referencing a specific Hashnode post, all word-for-word identical.

The sender domain — legioncoder.com, not coderlegion.com — is a standard cold-email infrastructure pattern: use a separate sending domain to protect the primary domain's deliverability reputation.

There is no editorial team. There is no personal curation. There is a template, a mailing list, and occasionally the wrong name in the salutation.

The Sequence After Publication

Following a prior technical analysis going public, this happened:

Step 1 — IP block:

Desktop access timed out. Mobile network access (different IP range) remained fully operational — confirming a targeted IP-level block, not server failure or maintenance. Ads continued serving on mobile while desktop was blocked.

Step 2 — Newsletter delivered to deleted account:

From:    Peter Jones 
Subject: This Week at CoderLegion: New Articles, Your Analytics & More!

Hi FreeRave,
Your profile is ready to grow!

Account status:    Deleted ✅
IP status:         Blocked ✅
Newsletter status: Delivered ✅

Continuing to send marketing email to a deleted account’s address is not a UX bug. Under GDPR Article 17, account deletion triggers a right to erasure that extends to all processing — including marketing lists.

The response to published technical findings was not a statement, a correction, or engagement. It was a network-level IP block on the reviewer’s machine.

Reproduce Everything Yourself

# Domain creation date and renewal status
$ whois coderlegion.com
$ whois kodlogs.net

# Server software
$ curl -I https://coderlegion.com | grep -i server

# Founding date embedded in source
$ curl -s https://coderlegion.com | grep -C 2 "dateCreated"

# Platform identification (or just press Ctrl+U in browser)
# Search for: qa-theme, adsbygoogle, dateCreated

# User count math
# Navigate to /users — find last page number — multiply by 30

# AdSense publisher ID
# Ctrl+U → search: pub-

# DB exposure
# Shodan: hostname:coderlegion.com port:3306

15 minutes. A browser. Every finding above independently reproducible.

Who This Is For

Developers considering joining: The information above existed before you arrived. Now you have it.

Content creators with published posts: Your content lives on a domain expiring July 21, 2026, with renewal blocked. Export everything now.

Premium subscribers: You paid $10/month for boosted visibility among ~37 active writers per month, on a free open-source script, on shared hosting, on a platform that misrepresented its founding date, user count, and monetization model. If you believe the service was misrepresented at point of purchase, your card provider has a formal dispute process.

Security researchers: Port 3306 publicly observable on a payment-collecting service is reportable to the relevant consumer protection authority in the operator’s jurisdiction.

Conclusion

One person building a developer community from scratch is hard. That deserves acknowledgment.

None of it justifies:

A founding date embedded in every page that no public domain record supports.
An ad-free promise directly contradicted by AdSense source code.
A user count inflated by ~70% — and manually edited between sessions.
A $10/month plan built on a free script and a $5 shared server.
Two domains blocked from renewal by their registrar.
A database port observable from the public internet on a payment-collecting platform.
Bulk outreach disguised as individual editorial curation — with mail merge errors left in.
An IP block as the response to published technical findings.
Marketing email delivered to deleted accounts in violation of erasure rights.

Developers deserve accurate information about platforms asking for their time, content, and money.

Run the commands. Verify the findings. Make your own decision.

All findings derived exclusively from public record: WHOIS lookups, HTTP headers, HTML source code, URL parameter enumeration, and first-party account use. No credentials other than the author’s own account were used. No unauthorized access was performed or implied at any stage.

Have you received a “Peter Jones” email? What name appeared in your salutation field? Leave a comment — every data point helps establish the scope of the campaign.

They Charged $10/Month for a $5 Server, a Free Script, and Three Years of Lies. Here’s the Proof. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

4bit - Terminal Scheme Designer

Sat, 09 May 2026 19:41:31 +0200

This is an application I wrote about 13 years ago. Back then, it became quite popular on r/linux. Recently, I rewrote it from scratch and added support for generating monochromatic, two-color, and three-color schemes.

submitted by /u/Ok_Produce3836
[link] [comments]

Can chatbots craft correct code?

Fri, 08 May 2026 23:20:32 +0200

I recently attended the AI Engineer Code Summit in New York, an invite-only gathering of AI leaders and engineers. One theme emerged repeatedly in conversations with attendees building with AI: the belief that we’re approaching a future where developers will never need to look at code again. When I pressed these proponents, several made a similar argument:

Forty years ago, when high-level programming languages like C became increasingly popular, some of the old guard resisted because C gave you less control than assembly. The same thing is happening now with LLMs.

On its face, this analogy seems reasonable. Both represent increasing abstraction. Both initially met resistance. Both eventually transformed how we write software. But this analogy really thrashes my cache because it misses a fundamental distinction that matters more than abstraction level: determinism.

The difference between compilers and LLMs isn’t just about control or abstraction. It’s about semantic guarantees. And as I’ll argue, that difference has profound implications for the security and correctness of software.

The compiler’s contract: Determinism and semantic preservation

Compilers have one job: preserve the programmer’s semantic intent while changing syntax. When you write code in C, the compiler transforms it into assembly, but the meaning of your code remains intact. The compiler might choose which registers to use, whether to inline a function, or how to optimize a loop, but it doesn’t change what your program does. If the semantics change unintentionally, that’s not a feature. That’s a compiler bug.

This property, semantic preservation, is the foundation of modern programming. When you write result = x + y in Python, the language guarantees that addition happens. The interpreter might optimize how it performs that addition, but it won’t change what operation occurs. If it did, we’d call that a bug in Python.

The historical progression from assembly to C to Python to Rust maintained this property throughout. Yes, we’ve increased abstraction. Yes, we’ve given up fine-grained control. But we’ve never abandoned determinism. The act of programming remains compositional: you build complex systems from simpler, well-defined pieces, and the composition itself is deterministic and unambiguous.

There are some rare conditions where the abstraction of high-level languages prevents the preservation of the programmer’s semantic intent. For example, cryptographic code needs to run in a constant amount of time over all possible inputs; otherwise, an attacker can use the timing differences as an oracle to do things like brute-force passwords. Properties like “constant time execution” aren’t something most programming languages allow the programmer to specify. Until very recently, there was no good way to force a compiler to emit constant-time code; developers had to resort to using dangerous inline assembly. But with Trail of Bits’ new extensions to LLVM, we can now have compilers preserve this semantic property as well.

As I wrote back in 2017 in “Automation of Automation,” there are fundamental limits on what we can automate. But those limits don’t eliminate determinism in the tools we’ve built; they simply mean we can’t automatically prove every program correct. Compilers don’t try to prove your program correct; they just faithfully translate it.

Why LLMs are fundamentally different

LLMs are nondeterministic by design. This isn’t a bug; it’s a feature. But it has consequences we need to understand.

Nondeterminism in practice

Run the same prompt through an LLM twice, and you’ll likely get different code. Even with temperature set to zero, model updates change behavior. The same request to “add error handling to this function” could mean catching exceptions, adding validation checks, returning error codes, or introducing logging, and the LLM might choose differently each time.

This is fine for creative writing or brainstorming. It’s less fine when you need the semantic meaning of your code to be preserved.

The ambiguous input problem

Natural language is inherently ambiguous. When you tell an LLM to “fix the authentication bug,” you’re assuming it understands:

Which authentication system you’re using
What “bug” means in this context
What “fixed” looks like
Which security properties must be preserved
What your threat model is

The LLM will confidently generate code based on what it thinks you mean. Whether that matches what you actually mean is probabilistic.

The unambiguous input problem (which isn’t)

“Okay,” you might say, “but what if I give the LLM unambiguous input? What if I say ‘translate this C code to Python’ and provide the exact C code?”

Here’s the thing: even that isn’t as unambiguous as it seems. Consider this C code:

// C code
int increment(int n) {
 return n + 1;
}

I asked Claude Opus 4.5 (extended thinking), Gemini 3 Pro, and ChatGPT 5.2 to translate this code to Python, and they all produced the same result:

# Python code
def increment(n: int) -> int:
 return n + 1

It is subtle, but the semantics have changed. In Python, signed integer arithmetic has arbitrary precision. In C, overflowing a signed integer is undefined behavior: it might wrap, might crash, might do literally anything. In Python, it’s well defined: you get a larger integer. None of the leading foundation models caught this difference. Why not? It depends on whether they were trained on examples highlighting this distinction, whether they “remember” the difference at inference time, and whether they consider it important enough to flag.

There exist an infinite number of Python programs that would behave identically to the C code for all valid inputs. An LLM is not guaranteed to produce any of them.

In fact, it’s impossible for an LLM to exactly translate the code without knowing how the original C developer expected or intended the C compiler to handle this edge case. Did the developer know that the inputs would never cause the addition to overflow? Or perhaps they inspected the assembly output and concluded that their specific compiler wraps to zero on overflow, and that behavior is required elsewhere in the code?

A case study: When Claude “fixed” a bug that wasn’t there

Let me share a recent experience that crystallizes this problem perfectly.

A developer suspected that a new open-source tool had stolen and open-sourced their code without a license. They decided to use Vendetect, an automated source code plagiarism detection tool I developed at Trail of Bits. Vendetect is designed for exactly this use case: you point it at two Git repos, and it finds portions of one repo that were copied from the other, including the specific offending commits.

When the developer ran Vendetect, it failed with a stack trace.

The developer, reasonably enough, turned to Claude for help. Claude analyzed the code, examined the stack trace, and quickly identified what it thought was the culprit: a complex recursive Python function at the heart of Vendetect’s Git repo analysis. Claude helpfully submitted both a GitHub issue and an extensive pull request “fixing” the bug.

I was assigned to review the PR.

First, I looked at the GitHub issue. It had been months since I’d written that recursive function, and Claude’s explanation seemed plausible! It really did look like a bug. When I checked out the code from the PR, the crash was indeed gone. No more stack trace. Problem solved, right?

Wrong.

Vendetect’s output was now empty. When I ran the unit tests, they were failing. Something was broken.

Now, I know recursion in Python is risky. Python’s stack frames are large enough that you can easily overflow the stack with deep recursion. However, I also knew that the inputs to this particular recursive function were constrained such that it would never recurse more than a few times. Claude either missed this constraint or wasn’t convinced by it. So Claude painfully rewrote the function to be iterative.

And broke the logic in the process.

I reverted to the original code on the main branch and reproduced the crash. After minutes of debugging, I discovered the actual problem: it wasn’t a bug in Vendetect at all.

The developer’s input repository contained two files with the same name but different casing: one started with an uppercase letter, the other with lowercase. Both the developer and I were running macOS, which uses a case-insensitive filesystem by default. When Git tries to operate on a repo with a filename collision on a case-insensitive filesystem, it throws an error. Vendetect faithfully reported this Git error, but followed it with a stack trace to show where in the code the Git error occurred.

I did end up modifying Vendetect to handle this edge case and print a more intelligible error message that wasn’t buried by the stack trace. But the bug that Claude had so confidently diagnosed and “fixed” wasn’t a bug at all. Claude had “fixed” working code and broken actual functionality in the process.

This experience crystallized the problem: LLMs approach code the way a human would on their first day looking at a codebase: with no context about why things are the way they are.

The recursive function looked risky to Claude because recursion in Python can be risky. Without the context that this particular recursion was bounded by the nature of Git repository structures, Claude made what seemed like a reasonable change. It even “worked” in the sense that the crash disappeared. Only thorough testing revealed that it broke the core functionality.

And here’s the kicker: Claude was confident. The GitHub issue was detailed. The PR was extensive. There was no hedging, no uncertainty. Just like a junior developer who doesn’t know what they don’t know.

The scale problem: When context matters most

LLMs work reasonably well on greenfield projects with clear specifications. A simple web app, a standard CRUD interface, boilerplate code. These are templates the LLM has seen thousands of times. The problem is, these aren’t the situations where developers need the most help.

Consider software architecture like building architecture. A prefabricated shed works well for storage: the requirements are simple, the constraints are standard, and the design can be templated. This is your greenfield web app with a clear spec. LLMs can generate something functional.

But imagine iteratively cobbling together a skyscraper with modular pieces and no cohesive plan from the start. You literally end up with Kowloon Walled City: functional, but unmaintainable.

Figure 1: Gemini’s idea of what an iteratively constructed skyscraper would look like.

And what about renovating a 100-year-old building? You need to know:

Which walls are load-bearing
Where utilities are routed
What building codes applied when it was built
How previous renovations affected the structure
What materials were used and how they’ve aged

The architectural plans—the original, deterministic specifications—are essential. You can’t just send in a contractor who looks at the building for the first time and starts swinging a sledgehammer based on what seems right.

Legacy codebases are exactly like this. They have:

Poorly documented internal APIs
Brittle dependencies no one fully understands
Historical context that doesn’t fit in any context window
Constraints that aren’t obvious from reading the code
Business logic that emerged from years of incremental requirements changes and accreted functionality

When you have a complex system with ambiguous internal APIs, where it’s unclear which service talks to what or for what reason, and the documentation is years out of date and too large to fit in an LLM’s context window, this is exactly when LLMs are most likely to confidently do the wrong thing.

The Vendetect story is a microcosm of this problem. The context that mattered—that the recursion was bounded by Git’s structure, that the real issue was a filesystem quirk—wasn’t obvious from looking at the code. Claude filled in the gaps with seemingly reasonable assumptions. Those assumptions were wrong.

The path forward: Formal verification and new frameworks

I’m not arguing against LLM coding assistants. In my extensive use of LLM coding tools, both for code generation and bug finding, I’ve found them genuinely useful. They excel at generating boilerplate code, suggesting approaches, serving as a rubber duck for debugging, and summarizing code. The productivity gains are real.

But we need to be clear-eyed about their fundamental limitations.

Where LLMs work well today

LLMs are most effective when you have:

Clean, well-documented codebases with idiomatic code
Greenfield projects
Excellent test coverage that catches errors immediately
Tasks where errors are quickly obvious (it crashes, the output is wrong), allowing the LLM to iteratively climb toward the goal
Pair-programming style review by experienced developers who understand the context
Clear, unambiguous specifications written by experienced developers

The last two are absolutely necessary for success, but are often not sufficient. In these environments, LLMs can accelerate development. The generated code might not be perfect, but errors are caught quickly and the cost of iteration is low.

What we need to build

If the ultimate goal is to raise the level of abstraction for developers above reviewing code, we will need these frameworks and practices:

Formal verification frameworks for LLM output. We will need tools that can prove semantic preservation—that the LLM’s changes maintain the intended behavior of the code. This is hard, but it’s not impossible. We already have formal methods for certain domains; we need to extend them to cover LLM-generated code.

Better ways to encode context and constraints. LLMs need more than just the code; they need to understand the invariants, the assumptions, the historical context. We need better ways to capture and communicate this.

Testing frameworks that go beyond “does it crash?” We need to test semantic correctness, not just syntactic validity. Does the code do what it’s supposed to do? Are the security properties maintained? Are the performance characteristics acceptable? Unit tests are not enough.

Metrics for measuring semantic correctness. “It compiles” isn’t enough. Even “it passes tests” isn’t enough. We need ways to quantify whether the semantics have been preserved.

Composable building blocks that are secure by design. Instead of allowing the LLM to write arbitrary code, we will need the LLM to instead build with modular, composable building blocks that have been verified as secure. A bit like how industrial supplies have been commoditized into Lego-like parts. Need a NEMA 23 square body stepper motor with a D profile shaft? No need to design and build it yourself—you can buy a commercial-off-the-shelf motor from any of a dozen different manufacturers and they will all bolt into your project just as well. Likewise, LLMs shouldn’t be implementing their own authentication flows. They should be orchestrating pre-made authentication modules.

The trust model

Until we have these frameworks, we need a clear mental model for LLM output: Treat it like code from a junior developer who’s seeing the codebase for the first time.

That means:

Always review thoroughly
Never merge without testing
Understand that “looks right” doesn’t mean “is right”
Remember that LLMs are confident even when wrong
Verify that the solution solves the actual problem, not a plausible-sounding problem

As a probabilistic system, there’s always a chance an LLM will introduce a bug or misinterpret its prompt. (These are really the same thing.) How small does that probability need to be? Ideally, it would be smaller than a human’s error rate. We’re not there yet, not even close.

Conclusion: Embracing verification in the age of AI

The fundamental computational limitations on automation haven’t changed since I wrote about them in 2017. What has changed is that we now have tools that make it easier to generate incorrect code confidently and at scale.

When we moved from assembly to C, we didn’t abandon determinism; we built compilers that guaranteed semantic preservation. As we move toward LLM-assisted development, we need similar guarantees. But the solution isn’t to reject LLMs! They offer real productivity gains for certain tasks. We just need to remember that their output is only as trustworthy as code from someone seeing the codebase for the first time. Just as we wouldn’t merge a PR from a new developer without review and testing, we can’t treat LLM output as automatically correct.

If you’re interested in formal verification, automated testing, or building more trustworthy AI systems, get in touch. At Trail of Bits, we’re working on exactly these problems, and we’d love to hear about your experiences with LLM coding tools, both the successes and the failures. Because right now, we’re all learning together what works and what doesn’t. And the more we share those lessons, the better equipped we’ll be to build the verification frameworks we need.

First Jato release

Fri, 08 May 2026 22:59:44 +0200

So I somewhat promised to say something more on my project for the Google Summer of Code.

I participated for the first time, and it was really a great experience. This is the first time I've been paid to do what I would probably have done in either case (because I immensely enjoy it), namely to work on an interesting free software project. So this time it was Jato, a new implementation of the Java Virtual Machine.

Jato is written in C and aims to be a JIT-only compiler/VM. So before the summer started, it wouldn't run a lot of Java programs. It couldn't even run the trivial "Hello World", but more about that later. It could do a few things like (java.lang.)String operations, but that was mostly because it was riding piggyback on another VM, Jam VM, which would load classes and interpret a lot of the library code (i.e. most of the standard Java API implemented by GNU Classpath).

My own project was to replace the parts that were borrowed from Jam VM with completely new, shiny code. Well, in fact, I had already worked on a standalone library called cafebabe, which would parse the Java .class file and present it to C programs using a very thin layer of structs -- the idea was to do as little as possible with the actual data and just make it easily accessible, e.g. so cafebabe doesn't do any verification of the bytecode or make sure that a class is its own superclass.

So we linked this library with Jato, and that worked pretty well. (I believe strongly in modularisation; with the class loader in a separate library, there's no way to do stupid things like making the class loader itself depend on the rest of the VM for functioning properly.) There were problems, of course, the biggest being that after developing in my own private branch for a couple of weeks, the rest of the project with its three other GSoC student participants was moving ahead too quickly for me to keep up; I had to "fix" just about every new mainline commit, since most of the VM data structures (classes, methods, fields) now had different names, different fields, etc.

At around this point, we started to notice that Jam VM wasn't being used for nearly as little as just class loading. In fact, static initializers (the "" methods) and their calls were all being interpreted and executed by Jam VM, not the JIT compiler of Jato. And of course, once we started using Jato for those methods which had previously been executed by Jam VM, we found tons of bugs everywhere: The core VM (mostly my code replacing that of Jam VM), including improperly implemented Java semantics, missing bytecode instruction handlers, and the compiler (instruction selection, liveness analysis, register allocation). But it was fun, and extremely educative.

Did you know that a simple System.out.println() will make a whopping 650550 Java-method calls? That's using GNU Classpath for the Java API.

So we had to implement a lot of stuff just to make that work. In fact, we have so much infrastructure that we can even run a few other programs. And thus it was decided that it was time to make a release. The version 0.0.1 announcement:

http://thread.gmane.org/gmane.comp.java.vm.jato.devel/1725

The "next big" missing feature is garbage collection. I expect that'll be version 0.0.2. In other words, if you're interested in Java, garbage collection, or just compilers in general, you're welcome to join us...

Our team consisted of:

Pekka Enberg; Original creator, project manager and mentor.
Tomek Grabiec; His original project proposal included implementing exception handling, but he ended up somwhat like Ingo Molnar of the Linux kernel; Tomek also implemented a generic radix tree, implemented the basic threading support (java.lang.Thread), rewrote large parts of the register allocator, wrote the VM side of the JNI interface from scratch, and also did a lot of other core-VM work. Tons of other things too, including a lot of debugging.
Arthur Huillet; Floating-point support, register allocator fixes, other missing bytecodes, also a lot of debugging. Various other things.
Eduard-Gabriel Munteanu; Ported Jato mostly to x86-64. A tough task, since the i386 parts were moving at close to light speed.

you have a long road to walk, but first you have to leave the house

Fri, 08 May 2026 22:56:38 +0200

or why publishing code is STEP ZERO.

If you've been developing code internally for a kernel contribution, you've probably got a lot of reasons not to default to working in the open from the start, you probably don't work for Red Hat or other companies with default to open policies, or perhaps you are scared of the scary kernel community, and want to present a polished gem.

If your company is a pain with legal reviews etc, you have probably spent/wasted months of engineering time on internal reviews and stuff, so think all of this matters later, because why wouldn't it, you just spent (wasted) a lot of time on it, so it must matter.

So you have your polished codebase, why wouldn't those kernel maintainers love to merge it.

Then you publish the source code.

Oh, look you just left your house. The merging of your code is many many miles distant and you just started walking that road, just now, not when you started writing it, not when you started legal review, not when you rewrote it internally the 4th time. You just did it this moment.

You might have to rewrite it externally 6 times, you might never get it merged, it might be something your competitors are also working on, and the kernel maintainers would rather you cooperated with people your management would lose their minds over, that is the kernel development process.

step zero: publish the code. leave the house.

(lately I've been seeing this problem more and more, so I decided to write it up, and it really isn't directed at anyone in particular, I think a lot of vendors are guilty of this).

An AI agent rewrote a Fortune 50 security policy. Here's how to govern AI agents before one does the same.

Fri, 08 May 2026 20:19:32 +0200

A CEO’s AI agent rewrote the company’s security policy. Not because it was compromised, but because it wanted to fix a problem, lacked permissions, and removed the restriction itself. Every identity check passed. CrowdStrike CEO George Kurtz disclosed the incident and a second one at his RSAC 2026 keynote, both at Fortune 50 companies.

The credential was valid. The access was authorized. The action was catastrophic.

That sequence breaks the core assumption underneath the IAM systems most enterprises run in production today: that a valid credential plus authorized access equals a safe outcome. Identity systems were built for one user, one session, one set of hands on a keyboard. Agents break all three assumptions at once.

In an exclusive interview with VentureBeat at RSAC 2026, Matt Caulfield, VP of Identity and Duo at Cisco, (pictured above) walked through the architecture his team is building to close that gap and outlined a six-stage identity maturity model for governing agentic AI. The urgency is measurable: Cisco President Jeetu Patel told VentureBeat at the same conference that 85% of enterprises are running agent pilots while only 5% have reached production — an 80-point gap that the identity work is designed to close.

The identity stack was built for a workforce that has fingerprints

“Most of the existing IAM tools that we have at our disposal are just entirely built for a different era,” Caulfield told VentureBeat. “They were built for human scale, not really for agents.”

The default enterprise instinct is to shove agents into existing identity categories: human user; machine identity; pick one. "Agents are a third kind of new type of identity," Caulfield said. "They're neither human. They're neither machine. They're somewhere in the middle where they have broad access to resources like humans, but they operate at machine scale and speed like machines, and they entirely lack any form of judgment."

Etay Maor, VP of Threat Intelligence at Cato Networks, put a number on the exposure. He ran a live Censys scan and counted nearly 500,000 internet-facing OpenClaw instances. The week before, he found 230,000, discovering a doubling in seven days.

Kayne McGladrey, an IEEE senior member who advises enterprises on identity risk, made the same diagnosis independently. Organizations are cloning human user accounts to agentic systems, McGladrey told VentureBeat, except agents consume far more permissions than humans would because of the speed, the scale, and the intent.

A human employee goes through a background check, an interview, and an onboarding process. Agents skip all three. The onboarding assumptions baked into modern IAM do not apply. Scale compounds the failure. Caulfield pointed to projections where a trillion agents could operate globally. “We barely know how many people are in an average organization,” he said, “let alone the number of agents.”

Access control verifies the badge. It does not watch what happens next.

Zero trust still applies to agentic AI, Caulfield argued. But only if security teams push it past access and into action-level enforcement. “We really need to shift our thinking to more action-level control,” he told VentureBeat. “What action is that agent taking?”

A human employee with authorized access to a system will not execute 500 API calls in three seconds. An agent will. Traditional zero trust verifies that an identity can reach an application. It doesn’t scrutinize what that identity does once inside.

Carter Rees, VP of Artificial Intelligence at Reputation, identified the structural reason. The flat authorization plane of an LLM fails to respect user permissions, Rees told VentureBeat. An agent operating on that flat plane does not need to escalate privileges. It already has them. That is why access control alone cannot contain what agents do after authentication.

CrowdStrike CTO Elia Zaitsev described the detection gap to VentureBeat. In most default logging configurations, an agent’s activity is indistinguishable from a human. Distinguishing the two requires walking the process tree, tracing whether a browser session was launched by a human or spawned by an agent in the background. Most enterprise logging cannot make that distinction.

Caulfield’s identity layer and Zaitsev’s telemetry layer are solving two halves of the same problem. No single vendor closes both gaps.

“At any moment in time, that agent can go rogue and can lose its mind,” Caulfield said. “Agents read the wrong website or email, and their intentions can just change overnight.”

How the request lifecycle works when agents have their own identity

Five vendors shipped agent identity frameworks at RSAC 2026, including Cisco, CrowdStrike, Palo Alto Networks, Microsoft, and Cato Networks. Caulfield walked through how Cisco's identity-layer approach works in practice.

The Duo agent identity platform registers agents as first-class identity objects, with their own policies, authentication requirements, and lifecycle management. The enforcement routes all agent traffic through an AI gateway supporting both MCP and traditional REST or GraphQL protocols. When an agent makes a request, the gateway authenticates the user, verifies that the agent is permitted, encodes the authorization into an OAuth token, and then inspects the specific action and determines in real time whether it should proceed.

“No solution to agent AI is really complete unless you have both pieces,” Caulfield told VentureBeat. “The identity piece, the access gateway piece. And then the third piece would be observability.”

Cisco announced its intent to acquire Astrix Security on May 4, signaling that agent identity discovery is now a board-level investment thesis. The deal also suggests that even vendors building identity platforms recognize that the discovery problem is harder than expected.

Six-stage identity maturity model for agentic AI

When a company shows up claiming 500 agents in production, Caulfield doesn't accept the number. "How do you know it's 500 and not 5,000?"

Most organizations don’t have a source of truth for agents. Caulfield outlined a six-stage engagement model.

Discovery first: identify every agent, where it runs, and who deployed it. Onboarding: register agents in the identity directory, tie each one to an accountable human, and define permitted actions. Control and enforcement: place a gateway between agents and resources, inspect every request and response. Behavioral monitoring: record all agent activity, flag anomalies, and build the audit trail. Runtime isolation contains agents on endpoints when they go rogue. Compliance mapping ties agent controls to audit frameworks before the auditor shows up. The six stages are not proprietary to any single vendor. They describe the sequence every enterprise will follow regardless of which platform delivers each stage.

Maor's Censys data complicates step one before it even starts. Organizations beginning discovery should assume their agent exposure is already visible to adversaries. Step four has its own problem. Zaitsev's process-tree work shows that even organizations logging agent activity may not be capturing the right data. And step three depends on something Rees found most enterprises lack: a gateway that inspects actions, not just access, because the LLM does not respect the permission boundaries the identity layer sets.

Agentic identity prescriptive matrix

What to audit at each maturity stage, what operational readiness looks like, and the red flag that means the stage is failing. Use this to evaluate any platform or combination of platforms.

Stage	What to audit	Operational readiness looks like	Red flag if missing
1. Discovery	Complete inventory of every agent, every MCP server it connects to, and every human accountable for it.	A queryable registry that returns agent count, owner, and connection map within 60 seconds of an auditor asking.	No registry exists. Agent count is an estimate. No human is accountable for any specific agent. Adversaries can see your agent infrastructure from the public internet before you can.
2. Onboarding	Agents are registered as a distinct identity type with their own policies, separate from human and machine identities.	Each agent has a unique identity object in the directory, tied to an accountable human, with defined permitted actions and a documented purpose.	Agents use cloned human accounts or shared service accounts. Permission sprawl starts at creation. No audit trail ties agent actions to a responsible human.
3. Control	A gateway between every agent and every resource it accesses, enforcing action-level policy on every request and every response.	Four checkpoints per request: authenticate the user, authorize the agent, inspect the action, inspect the response. No direct agent-to-resource connections exist.	Agents connect directly to tools and APIs. The gateway (if it exists) checks access but not actions. The flat authorization plane of the LLM does not respect the permission boundaries the identity layer set.
4. Monitoring	Logging that can distinguish agent-initiated actions from human-initiated actions at the process-tree level.	SIEM can answer: Was this browser session started by a human or spawned by an agent? Behavioral baselines exist for each agent. Anomalies trigger alerts.	Default logging treats agent and human activity as identical. Process-tree lineage is not captured. Agent actions are invisible in the audit trail. Behavioral monitoring is incomplete before it starts.
5. Isolation	Runtime containment that limits the blast radius if an agent goes rogue, separate from human endpoint protection.	A rogue agent can be contained in its sandbox without taking down the endpoint, the user session, or other agents on the same machine.	No containment boundary exists between agents and the host. A single compromised agent can access everything the user can. Blast radius is the entire endpoint.
6. Compliance	Documentation that maps agent identities, controls, and audit trails to the compliance framework that the auditor will use.	When the auditor asks about agents, the security team produces a control catalog, an audit trail, and a governance policy written for agent identities specifically.	Emerging AI-risk frameworks (CSA Agentic Profile) exist, but mainstream audit catalogs (SOC 2, ISO 27001, PCI DSS) have not operationalized agent identities. No control catalog maps to agents. The auditor improvises which human-identity controls apply. The security team answers with improvisation, not documentation.

Source: VentureBeat analysis of RSAC 2026 interviews (Caulfield, Zaitsev, Maor) and independent practitioner validation (McGladrey, Rees). May 2026.

Compliance frameworks have not caught up

“If you were to go through an audit today as a chief security officer, the auditor’s probably gonna have to figure out, hey, there are agents here,” Caulfield told VentureBeat. “Which one of your controls is actually supposed to be applied to it? I don’t see the word agents anywhere in your policies.”

McGladrey's practitioner experience confirms the gap. The Cloud Security Alliance published an NIST AI RMF Agentic Profile in April 2026, proposing autonomy-tier classification and runtime behavioral metrics. But SOC 2, ISO 27001, and PCI DSS have not operationalized agent identities. The compliance frameworks McGladrey works with inside enterprises were written for humans. Agent identities do not appear in any control catalog he has encountered. The gap is a lagging indicator; the risk is not.

Security director action plan

VentureBeat identified five actions from the combined findings of Caulfield, Zaitsev, Maor, McGladrey, and Rees.

Run an agent census and assume adversaries already did.
Every agent, every MCP server those agents touch, every human accountable. Maor's Censys data confirms agent infrastructure is already visible from the public internet. NIST's NCCoE reached the same conclusion in its February 2026 concept paper on AI agent identity and authorization.
Stop cloning human accounts for agents.
McGladrey found that enterprises default to copying human user profiles, and permission sprawl starts on day one. Agents need to be a distinct identity type with scope limits that reflect what they actually do.
Audit every MCP and API access path.
Five vendors shipped MCP gateways at RSAC 2026. The capability exists. What matters is whether agents route through one or connect directly to tools with no action-level inspection.
Fix logging so it distinguishes agents from humans.
Zaitsev's process-tree method reveals that agent-initiated actions are invisible in most default configurations. Rees found authorization planes so flat that access logs alone miss the actual behavior. Logging has to capture what agents did, not just what they were allowed to reach.
Build the compliance case before the auditor shows up.
The CSA published a NIST AI RMF Agentic Profile proposing agent governance extensions. Most audit catalogs have not caught up. Caulfield told VentureBeat that auditors will see agents in production and find no controls mapped to them. The documentation needs to exist before that conversation starts.

I Rewrote a Real Data Workflow in Polars. Pandas Didn’t Stand a Chance.

Thu, 07 May 2026 14:20:07 +0200

From 61 seconds to 0.20 seconds — and the mental model shift I didn't expect

The post I Rewrote a Real Data Workflow in Polars. Pandas Didn’t Stand a Chance. appeared first on Towards Data Science.

I gave our developers an AI coding assistant. The security team nearly mutinied

Wed, 06 May 2026 14:08:27 +0200

I’ve sat in enough risk meetings to know the sound a bad surprise makes before anyone names it. It usually starts with a pause. Then a throat gets cleared. Then someone says, “We may need to bring the CISO into this.”

That happened over a developer tool.

Not a breach. Not a regulator. Not ransomware at 2:00 a.m. A coding assistant.

At first, I thought the reaction was overcooked. I’d seen the same pattern in other boardrooms and delivery teams. A new tool appears. Engineers like it because it saves time. Leadership likes it because it promises more output without hiring half a city. Security hates it because security has the social burden of being the adult in the room when everyone else is buying fireworks.

I backed the rollout because the case was clean on paper. Developers were drowning in repetitive work. Deadlines were tightening. Technical debt had started breeding in the dark. The assistant could draft tests, explain old code, suggest refactors and help junior engineers stop treating Stack Overflow like an underground pharmacy. And this was no longer fringe behavior. In 2025, Microsoft said that 15 million developers were already using GitHub Copilot, and the tool has spread further since then.

So yes, I approved it.

Then security nearly revolted.

That week taught me something I now say to clients more bluntly than I used to. AI coding tools do not just change software delivery. They change the terms of trust inside the company. They force you to answer ugly questions about control, proof, accountability and review discipline. Most public coverage still stares at productivity. The harder story sits elsewhere. Governance.

The part that looked sensible

The truth is, I didn’t approve the tool because I was dazzled. I approved it because I’ve spent years watching good people waste good hours on bad repetition.

You can only tell a team to “be strategic” so many times before they start laughing at you. Developers were buried under boilerplate, documentation drift, brittle legacy code and the kind of ticket churn that makes bright people look tired. A coding assistant looked like a relief. Not magic. Relief.

That distinction matters.

In advisory work, I’ve learned that many poor decisions do not begin as foolish decisions. They begin as reasonable decisions made inside an outdated control model. That’s what this was. The business case made sense. The mistake was assuming the old review system could keep up with the new speed.

That old assumption dies hard. Leaders often think software risk changes when the code changes. Often, it changes earlier, as production conditions change. If a machine now drafts what humans once wrote line by line, the issue is not only code quality. It is code volume, code origin and the shrinking time between suggestion and production.

That is a different risk shape.

Why security lost its patience

The security team was upset because they could see the math.

Code output was about to rise. Review time was not.

That gap is where trouble rents office space.

Many non-security leaders still imagine the concern is simple. “The AI might write bad code.” That’s the kindergarten version. The real concern is broader and nastier. Who reviewed the output? What hidden package did the model nudge into the build? What sensitive context got pasted into the prompt window? Which junior engineer trusted the suggestion because it sounded calm and looked polished? Which policy assumed human authorship when the draft came from somewhere else?

Those are not philosophical questions. They are operating questions.

Recent security work has made this much harder to dismiss. Snyk described a February 2026 case in which a vulnerability chain turned an AI coding tool’s issue triage bot into a supply chain attack path. That is the sort of sentence that makes security teams sit up straight and ask for names, logs and meeting invites.

And that is before you get to the quieter problem. AI-generated code can look tidy long before it is safe. Security people know that neat syntax can hide weak controls, lazy validation, poor handling of secrets and dependency choices nobody meant to own.

So when the team escalated, they weren’t staging a mutiny over a plugin. They were reacting to a change in production logic that nobody had yet governed.

What the fight was really about

Once the temperature dropped, the shape of the dispute became obvious to me. It was not engineering versus security. It was speed versus proof.

More precisely, it was four things:

Velocity. The assistant increased output far faster than assurance could keep pace.
Visibility. We did not have a clear sight of where the tool was used, what prompts were fed into it, what code it influenced or what external components it smuggled into the discussion.
Validation. Existing checks were built for a world in which humans produced most of the first draft. That world is fading. When code generation speeds up, review cannot stay ceremonial.
Governance. Nobody had written the rules that mattered most. Which use cases were fine? Which were off-limits? Who owned the risk of acceptance? What evidence would prove that the tool was used safely enough?

That last point gets too little airtime. Governance sounds dull until you don’t have it. Then it becomes the difference between controlled use and polite chaos.

NIST’s recent work on monitoring deployed AI systems makes the same point more broadly. Organizations need post-deployment measurement and monitoring because real-world behavior drifts, surprises occur and governance after launch remains immature. Different setting, same lesson. You cannot inspect your way out of weak operating design.

What we did next

We did not ban the tool. That would have been theatre dressed as courage.

We also did not waive it through and tell security to “partner more closely.” I’ve heard that sentence enough times to know it usually means, “Please absorb more risk with better manners.”

We did something less dramatic and more useful. We narrowed the rollout and rewrote the conditions of trust.

Low-risk use cases stayed in play. Drafting tests. Explaining old functions, helping with documentation and suggesting boilerplate. Those were manageable.

High-risk areas got tighter boundaries. Auth flows. Secrets handling. Encryption logic. Infrastructure-as-code for sensitive environments. Anything tied to regulated data or material security controls. Those needed a stricter review or stayed out of scope.

We also drew a hard line on prompt hygiene. No customer data. No credentials. No confidential architecture details were dropped into a chat window because someone wanted a faster answer on a Friday afternoon. You would think that goes without saying. It does not.

Then we raised the review standard. Human sign-off meant real sign-off, not a quick skim and a merge. Scanning had to cover dependencies and code changes with more discipline. Provenance mattered more. Logging mattered more. Exception paths had to be explicit, not social.

Most importantly, security moved from late-stage critic to co-designer. That changed the tone. The question stopped being, “Can we use this?” and became, “Under what conditions can we trust its use enough to defend it later?”

That small shift matters more than many policy documents.

What both sides got right — and wrong

Developers were right about the waste. They were right that these tools remove drudgery. They were right that refusing every new capability is not a strategy. A team that cannot experiment eventually decays into compliance theatre and backlog sorrow.

They were wrong to assume readable code is trustworthy code. They were wrong to treat assistance as neutral. Tools shape behavior. That is what tools do. Once suggestions arrive fast and fluently, people accept more than they admit.

Security was right about review debt. Right about supply chain exposure, right about data leakage risk. Right, governance should not arrive three incidents late, wearing a blazer and a lessons-learned slide.

They were wrong at first, as many security teams are when they feel cornered. They made the conversation sound like a moral referendum. That never helps. If security cannot offer a usable path, the business routes around it. Then you get the worst of both worlds: Secret adoption and public optimism.

I don’t say that with smugness. I say it because I’ve watched good teams damage each other by defending the right thing in the wrong way.

The bigger lesson for leaders

This is where the story stops being about one rollout and starts becoming board material.

If your developers can now produce more code with less effort, your governance burden rises even if your headcount does not. The old ratio between output and oversight has broken. Many firms have not adjusted.

That matters because software governance is no longer just about secure coding standards or release gates. It is about production conditions. Who can generate? Under what rules? With what evidence? Across which risk zones? With whose approval? And if something goes wrong, who owns the final act of acceptance?

Those questions sound administrative until the first incident report lands, and nobody can explain whether the flawed logic was written, suggested, copied, reviewed or merely assumed.

The market is moving quickly. Microsoft’s own recent security reporting says organizations adopting AI agents need observability, governance and security now, not later. Snyk is making a similar argument from the perspective of the software supply chain. Visibility first. Then prevention. Then governance that holds under pressure.

That is why I now advise something that used to sound severe and now sounds merely accurate. If you deploy AI coding tools without redesigning your control model, you are not buying productivity. You are buying ambiguity at machine speed.

What you should ask before you approve the next tool

You do not need a grand doctrine. You need a few hard questions asked before excitement turns into policy by accident.

Where can this tool be used, and where can’t it be used?

What data may enter it?

How will you know when the generated code reaches production?

What review standard applies when the first draft came from a machine?

Who can approve exceptions?

What logs, scans and decision records will let you defend the setup six months later, when memories blur and staff rotate?

That is not bureaucracy. That is self-respect.

I still believe these tools have value. I’d be foolish not to. But I trust them the way I trust a very fast junior colleague with a beautiful writing style and uneven judgment. Useful. Impressive. Worth keeping. Not someone you leave unsupervised near the crown jewels.

The near-mutiny turned out to be healthy. It forced the truth into the room before a failure did. Security was not blocking progress. They were objecting to unmanaged speed. Developers were not being reckless. They were asking for relief from the grind. Leadership’s job was not to pick a side. It was to write a better contract between them.

That is the part that too many firms still miss.

The argument was never only about a coding assistant. It was about whether we still knew how to govern work once the work started moving faster than our habits. That is a much bigger story. And if you listen carefully, you can hear it starting in many companies right now.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

PART 2: I Published a Scam Expose.

Sat, 02 May 2026 09:52:00 +0200

PART 2: I Published a Scam Expose. NetEase Sent a Takedown Request. Then They Rewrote Their Entire Operation.

A forensic timeline of SSL certs, WHOIS manipulation, DNS chains, paid trust scores, and the email that proves a billion-dollar company changed their behavior because of one article.

This is Part 2 of an ongoing investigation. Part 1: EXPOSED: The “Youdao Ads” Influencer Marketing Scam

Before we begin — a note on methodology.

When I published Part 1, I labeled this operation a scam based on the evidence available at the time. After 18 days of forensic follow-up, the picture is more nuanced. This article is not a retraction. It is an upgrade — more data, better conclusions, harder questions.

Everything here is reproducible. Every command is included. Every timestamp is documented. The security community can verify independently.

The 18-Day Forensic Timeline

Apr  5, 2026  → SSL certificate issued: infunease.youdaoads.com
Apr 11, 2026  → Mass cold outreach (anjiaqi06@corp.netease.com)
               → curl -I infunease.youdaoads.com = 403 Forbidden
               → Scam Detector score: 28.8/100
               → Article published on dev.to
               → Google AI indexes and begins citing article
Apr 14, 2026  → WHOIS record updated (3 days post-publication)
Apr 28, 2026  → Takedown email received (youdaoads@rd.netease.com)
               → Public comment on dev.to article (@YoudaoAds)
               → curl -I infunease.youdaoads.com = 200 OK (same day)
               → Scam Detector drops further: 15/100
               → Formal documentation request sent - no response
Apr 29, 2026  → ScamAdviser score: 100/100 "Very Likely Safe"
               → New outreach email (tangxi03@corp.netease.com)
               → Professional NetEase 網易 branding
               → Every red flag from Part 1 - addressed

Let’s go through each entry.

Entry 1: The Original Email — Red Flags Documented

On April 11, this arrived:

From: anjiaqi06@corp.netease.com
Subject: Don't scroll past 【Youdao Ads】– a paid collab 
         that's actually your vibe 😉

💰 Budget's ready – just name your rate
⏳ Spots are filling up – other creators are already 
   looking at them
[Youdao Ads] [Discord] [WhatsApp group invite]

Authentication results:

dkim=pass   header.i=@corp.netease.com
spf=pass    smtp.mailfrom=anjiaqi06@corp.netease.com
dmarc=pass  (p=NONE sp=NONE dis=NONE)
Received: from corp-front01-corp.i.nease.net [1.95.22.228]
X-Originating-IP: [115.236.116.73]
X-Mailer: Coremail Webmail Server XT6.0.5

Every authentication check passed. The email genuinely came from NetEase corporate servers.

This is the first lesson of this investigation: email authentication tells you origin, not intent.

The site linked in the email:

$ curl -I https://infunease.youdaoads.com
HTTP/1.1 403 Forbidden
x-deny-reason: host_not_allowed
server: envoy

A platform sending mass creator outreach while its own site returns Forbidden.

April 11 outreach — emoji-heavy, urgency-driven, no company branding

Entry 2: SSL Certificate — Infrastructure Built Before the Campaign

$ echo | openssl s_client \
  -servername infunease.youdaoads.com \
  -connect infunease.youdaoads.com:443 2>/dev/null \
  | openssl x509 -noout -dates

notBefore=Apr  5 00:00:00 2026 GMT
notAfter=Jul  4 23:59:59 2026 GMT

Certificate issued April 5–6 days before the emails went out. 90-day certificate — automated issuance, short-term deployment pattern.

The infrastructure was being assembled in the week immediately preceding the mass outreach campaign.

Entry 3: WHOIS — The Record That Updated After Publication

$ whois youdaoads.com

Domain Name:    YOUDAOADS.COM
Creation Date:  2021-05-25T11:15:53Z   ← 5 years old
Updated Date:   2026-04-14T05:35:38Z   ← 3 days post-article
Registrar:      Alibaba Cloud Computing (Beijing) Co., Ltd.
Registrant:     bei jing, CN
Name Servers:   REM1.YODAO.COM / REM2.YODAO.COM / REM3.YODAO.COM
DNSSEC:         unsigned

The domain is legitimate and 5 years old. That’s important context.

But the record updated April 14–3 days after the article.

$ whois infunease.youdaoads.com
No match for "INFUNEASE.YOUDAOADS.COM".

The subdomain returns no WHOIS data.

Entry 4: DNS Chain — Following the Infrastructure

$ dig infunease.youdaoads.com +short

youdaoads.youdao.com.
ead.alb.ntes53.netease.com.
hk-g1-hz.alb.ntes53.netease.com.
156.225.180.151
156.225.180.152

Resolution chain:

infunease.youdaoads.com
        ↓ CNAME
youdaoads.youdao.com
        ↓ CNAME
ead.alb.ntes53.netease.com       ← NetEase Load Balancer
        ↓ CNAME
hk-g1-hz.alb.ntes53.netease.com  ← Hong Kong Cluster
        ↓ A Records
156.225.180.151 / 156.225.180.152

$ whois 156.225.180.151

inetnum:  156.225.180.0 - 156.225.180.255
netname:  HongKong_NetEase_Interactive_Entertainment_Limited
descr:    HongKong NetEase Interactive Entertainment Limited
country:  HK

This is genuine NetEase infrastructure. Hong Kong datacenter. Enterprise load balancers. Not a rented VPS.

DNS chain resolves into NetEase Hong Kong infrastructure

Entry 5: April 28 — The Site Comes Alive

On the exact same day the takedown request arrived:

# April 11 — time of original article
$ curl -I https://infunease.youdaoads.com
HTTP/1.1 403 Forbidden
x-deny-reason: host_not_allowed
server: envoy

# April 28 - day of takedown request
$ curl -I https://infunease.youdaoads.com
HTTP/2 200
server: YDWS
x-powered-by: Next.js
content-length: 374476
x-nextjs-cache: HIT
cache-control: s-maxage=31536000, stale-while-revalidate

A full Next.js production deployment. Live. On the same day they asked me to take down the article.

403 on April 11. 200 on April 28. Same day as the takedown request.

Entry 6: The Takedown Request

From: youdaoads@rd.netease.com
Subject: Clarification regarding your recent article

The misunderstandings in your article are currently 
influencing Google's AI summaries, which is causing 
severe and unearned damage to our brand.
We kindly request that you consider removing the post.
Domain Status: We have confirmed our domain is not 
blocked by major security infrastructures.
NetEase Emails: Youdao Ads is a business division 
of NetEase Youdao. The emails came from NetEase 
internal servers because they are genuine official 
communications.

Note the sender domain: rd.netease.com — NetEase R&D division. Original outreach: corp.netease.com — corporate division.

Two different NetEase subdomains used for the same operation. Never explained.

Simultaneously, a dev.to account named “Youdao Ads” posted publicly on my article:

“We have thoroughly verified our domain and technical infrastructure. It is fully operational, passes mainstream security protocols, and is not being blocked by any standard security infrastructures.”

My public response requested five items of documentation. None were provided.

Note rd.netease.com — different subdomain from original corp.netease.com outreach

Public comment on the article — same day as the takedown email

Entry 7: The Trust Score Divergence

Scam Detector (independent, no business plans):

April 11: 28.8/100 — "Risky. Dubious. Perilous."
April 28: 15/100  — continued decline post-publication

ScamAdviser (offers paid business verification plans):

April 29: 100/100 — "Very Likely Safe"
Last Update: 3 weeks ago

Two independent platforms. Same domain. 15/100 vs 100/100.

ScamAdviser offers business subscription plans that allow companies to submit documentation and improve their trust ratings. This is disclosed in their business model.

The Scam Detector score — which does not offer paid improvement plans — continued declining.

April 29 — ScamAdviser shows 100/100. ScamAdviser offers paid business plans.

Scam Detector (no paid plans) shows 15/100 — continued decline post-article

Entry 8: Network Analysis — Behavioral Tracking on Login Page

DevTools analysis of the login page:

Session 1: 16 requests

16/24 requests
POST → https://k.clarity.ms/collect
Status: 204 No Content
Remote Address: 172.175.38.6:443

Session 2 (after continued analysis): 47 requests

47/63 requests
62.5 kB transferred
Server: YDWS

Microsoft Clarity captures on every visit from page load:

Full mouse movement recording
Click and scroll behavior
Session duration and depth
Browser and device fingerprint
Rage clicks, dead clicks

Active before any signup or consent interaction.

A second endpoint revealed the origin:

GET https://overseacdn.ydstatic.com/overseacdn/
    advertising_platform/static/intl/zh-CN.json
    ?v=2760e8bced

Server: YDWS
Content-Type: application/json
Akamai-Mon-lucid-Del: 1273563

ydstatic.com — Youdao Static CDN. zh-CN.json — Chinese Simplified localization. Akamai CDN headers — enterprise-grade infrastructure.

This platform was originally built for the Chinese market.

Note: Clarity automatically masks password and email input fields. Credentials are not captured. Full behavioral profiling is active regardless.

DevTools — 47/63 collect requests with overseacdn endpoint visible

Entry 9: The Email That Changes Everything

April 29. One day after the takedown request.

From: tangxi03@corp.netease.com
Subject: Official Collaboration Invite for Creators | 
         Youdao Ads by NetEase Youdao
mailed-by:  corp.netease.com
signed-by:  corp.netease.com
⭐ Important according to Google

Body:

This email is from Youdao Ads — the official influencer 
marketing platform of NetEase Youdao, a subsidiary of 
NetEase.

Why partner with Youdao Ads?
▸ Exclusive opportunities with top global brands
▸ Guaranteed paid campaigns, no upfront fees, 
  on-time secure payments
▸ Full dedicated support from onboarding to 
  payment settlement
[NetEase 網易 | youdao Ads]
Global leading influencer marketing platform
ydcommunity@service.netease.com

New email from tangxi03 — professional NetEase branding

The Before/After: A Direct Comparison

This is the finding that makes this investigation significant.

April 11 — Original Outreach:

Subject:  "Don't scroll past – a paid collab 
           that's actually your vibe 😉"

Content:
❌ Emoji-heavy throughout
❌ "Budget's ready – just name your rate"
❌ "Spots are filling up" (artificial urgency)
❌ WhatsApp group invite links
❌ Discord community links
❌ Zero company branding
❌ Generic "your vibe" personalization
❌ No official email for support

April 29 — Post-Article Outreach:

Subject:  "Official Collaboration Invite for Creators | 
           Youdao Ads by NetEase Youdao"

Content:
✅ Zero emojis
✅ "No upfront fees" ← Part 1 raised payment concerns
✅ "No pressure to sign up immediately" ← Part 1 raised urgency concern
✅ "Transparent pricing" ← Part 1 raised opacity concern
✅ Official NetEase 網易 logo from line 1
✅ Official support email: ydcommunity@service.netease.com
✅ Zero WhatsApp links
✅ Zero Discord spam
✅ Clear company identification

Every documented red flag from Part 1. Addressed in the next outreach email. The timing is not coincidental.

Analysis: What the Evidence Supports

Confirmed:

The infrastructure is genuine NetEase. DNS chain, IP WHOIS, email authentication, CDN — all resolve to NetEase Hong Kong. This is not spoofed.

The domain has 5 years of history. Registered May 2021. Legitimate age, legitimate registrar.

The outreach behavior changed after public scrutiny. The before/after email comparison documents this directly.

Reputation management was deployed. ScamAdviser showing 100/100 the day after the takedown request, while Scam Detector continues at 15/100, suggests active reputation management through paid platforms.

Not confirmed:

Why was the site returning 403 during the active email campaign? You do not send mass creator outreach from a platform that returns Forbidden to visitors.

Why did the WHOIS record update 3 days after publication? Domain records do not update without deliberate action.

Why did the site go live on the same day as the takedown request? This correlation is documented. Causation is not established.

Why the subdomain switching? corp.netease.com → rd.netease.com → corp.netease.com. Three different senders. No explanation provided.

Why does Scam Detector still show 15/100? No documentation addressing this was ever provided.

Most likely explanation:

A legitimate NetEase subsidiary operating with immature, spam-adjacent outreach practices — possibly a team that grew quickly and prioritized reach over compliance. Public scrutiny forced an internal correction.

This is not a vindication. This is a more accurate conclusion.

Security Lessons for the Community

1. Email authentication is necessary, not sufficient

DKIM: pass ✅
SPF:  pass ✅
DMARC: pass ✅
Intent: unknown ❌

Authentication confirms origin. It does not confirm legitimacy of purpose.

2. Infrastructure legitimacy ≠ operational legitimacy

Enterprise CDN, real IPs, genuine corporate email — none of this guarantees the outreach practices are acceptable.

3. Trust score platforms are not equal

Some platforms offer paid business plans that allow score improvement. Others do not. Understanding the business model of the platform you’re citing matters in security research.

4. Timeline documentation is the methodology

# Every finding in this article is reproducible

$ dig infunease.youdaoads.com +short
$ echo | openssl s_client -servername infunease.youdaoads.com \
  -connect infunease.youdaoads.com:443 2>/dev/null \
  | openssl x509 -noout -dates
$ whois youdaoads.com
$ curl -I https://infunease.youdaoads.com

Public record data. Standard OSINT methodology. Anyone can verify.

5. Public research creates accountability

One technical article, properly documented and indexed, changed the outreach behavior of a subsidiary of a multi-billion dollar company within 18 days.

This is why transparent security research matters.

What Remains Open

I formally requested the following on April 28. No response received as of publication:

Official business registration documents for Youdao Ads
NetEase Youdao official statement authorizing the outreach campaign
Verified creator partnership examples with creator consent
Explanation of security vendor scores and remediation steps
Clarification on subdomain switching across communications

This article updates publicly and prominently when documentation arrives.

Conclusion

This started as a scam analysis. It became something more useful: a documented case study in how public technical scrutiny can change corporate behavior, the limitations of email authentication as a trust signal, and the importance of understanding the business models behind reputation platforms.

The infrastructure is real. The company is real. The outreach tactics were unacceptable. The response to scrutiny was managed and calculated.

Draw your own conclusions.

If you have received emails from Youdao Ads — as a creator, agency, or brand — your experience is relevant to this investigation. Share it in the responses.

Technical Reference

All commands used in this investigation:

# DNS Resolution
$ dig infunease.youdaoads.com +short

# SSL Certificate Dates
$ echo | openssl s_client \
  -servername infunease.youdaoads.com \
  -connect infunease.youdaoads.com:443 2>/dev/null \
  | openssl x509 -noout -dates
# WHOIS Domain
$ whois youdaoads.com
$ whois infunease.youdaoads.com
# IP WHOIS
$ whois 156.225.180.151
# HTTP Headers
$ curl -I https://infunease.youdaoads.com

Reporting channels:

APWG: reportphishing@apwg.org
Google Safe Browsing: safebrowsing.google.com/safebrowsing/report_phish/
NetEase Security: security@netease.com

Originally published on dev.to/freerave

All findings are based on public record data and standard OSINT methodology. Timestamps and commands are included verbatim for independent verification.

Hi InfoSec Write-ups team,

I’d like to submit Part 2 of an active
cybersecurity investigation.

Part 1 is already live on:

→ Medium:
https://medium.com/@freerave/exposed-the-youdao-ads-influencer-marketing-scam-e389a0fb3f3c

→ dev.to:
https://dev.to/freerave/exposed-the-youdao-ads-influencer-marketing-scam-technical-analysis-red-flags-5cag

→ Hashnode:
https://freerave.hashnode.dev/exposed-the-youdao-ads-influencer-marketing-scam-technical-analysis-red-flags

Part 1 was cited by Google AI in search
results for “Youdao Ads scam” and prompted
a direct takedown request from the company
within 17 days of publication.

Part 2 dev.to link:

https://dev.to/freerave/part-2-i-published-a-scam-expose-netease-sent-a-takedown-request-then-they-rewrote-their-entire-hip

Thank you.

PART 2: I Published a Scam Expose. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The front-end architecture trilemma: Reactivity vs. hypermedia vs. local-first apps

Tue, 28 Apr 2026 11:17:30 +0200

While the software development industry has been gorging on large language models (LLMs), the front-end ecosystem has quietly fractured into three competing but interrelated architectural paradigms. Between the dominance of reactive frameworks, the hypermedia-driven simplicity of true REST, and the decentralized resilience of SQL everywhere, developers are no longer just choosing a library, they are choosing where the data lives: at the server, at the client, or both.

Three competing architectures, more or less

Web developers are long familiar with React and the galaxy of similar reactive frameworks like Angular, Vue, and Svelte. For nearly a decade, these have dominated the narrative with their competition and co-inspiration. HTMX and hypermedia-driven applications have championed a return to the true RESTful thin client, alongside alternatives like Hotwire and Unpoly.

We could in a sense see reactivity and hypermedia as two opposing camps. Somewhere in between is the local-first SQL movement, which proposes putting SQL directly in the browser. The waters are a bit muddy because local SQL can and does work right alongside React.

It’s still safe to say that a reactive framework paired with a JSON API back end that talks to a datastore (SQL or otherwise) is still the de facto standard. But that monolithic story is starting to fracture in some very interesting ways.

Where the weight of the data lies

Data of course is the central mass of web applications. Where it lives and how it moves produce the gravity around which everything else must revolve. Each of these architectures proposes to handle that gravity in its own way, with different benefits and tradeoffs.

Hypermedia (e.g., HTMX): Keep the data largely off the client. The client is just a visual representation of the server data. The back-end “API” is responsible for producing the data-driven markup. Any kind of datastore can be used by the API server.

React and friends: A sophisticated, stateful engine runs in the client, and the developer syncs that state with the back end via RESTful JSON API calls. The back-end server tends to be dumb, responsible largely for just invoking other services to provide business logic or data persistence.

Local-first SQL: The data is distributed to the clients, like with React and friends, but in a much different way. Although the data is automatically synced directly to a datastore (like Postgres), the back-end API server is used only for specialized service calls—not for data persistence.

To summarize:

HTMX: Data gravity is at the server.
React: Data gravity is split between the server and the client.
Local-first: Data gravity is at the client.

Comparing the approaches

Besides the technical stats, the developer experience for each of these paradigms is quite different. However, while each paradigm feels different, they intersect in some interesting ways. Let’s take a closer look.

React and friends

Reactivity is the world we have been working in for 15 years. We’ve got a whole universe of frameworks: React, Angular, Vue, Svelte, Solid, and full-stack variants like Next.js, Nuxt, SvelteKit, Astro, etc. The beauty of these is in the core reactive idea. You have a state that consists of the variables and the UI is updated automatically. The UI is a pure function of state: $UI = f(state).

The downside is the gradual, almost imperceptible layering of intense complexity over the top of it all. This complexity seems at first just incidental, but it is in fact a direct outcome of the basic premise: building a state engine on the browser.

The result is you have two states: the browser and the database. The reactive engine becomes a negotiation layer. Add to that the various inherent complexities of managing the browser state, and the result is quite a lot for front-end developers to wrap their heads around.

In the effort to manage such complexity, wring more performance, and improve developer experience, we have wound up with quite a sprawling empire of tools and techniques. Even just for React we have React Server Components, complex state-management libraries like Redux or Zustand, and orchestration layers like TanStack Query for manual cache invalidation.

On the back end, we talk to JSON APIs (or GraphQL), which can become unwieldy as a kind of boilerplate layer, but has in its favor an almost universal understanding.

HTMX and similar (Hotwired, Unpoly)

HTMX is like using HTML that has superpowers. You can do a huge amount of what you use reactive frameworks for, including all the AJAX and a lot of the partial rendering and effects, with just a few extra attributes sprinkled judiciously.

You spend a lot of time on the server, using a template engine like Pug, Thymeleaf, or Kotlin DSL. These are where you bring together the data from the persistence service and combine it with markup. The markup you generate includes the HTMX attributes.

You tend to decompose the templates, i.e., break them up into dedicated chunks. The idea is you want to have a chunk that can be used within the larger UI to create the whole layout, along with the ability to use that chunk alone when (and if) it is called upon for an AJAX response.

Hypermedia with HTMX is a very powerful model. You are actually using REST, meaning you are transmitting a representational state.

Hotwire and Unpoly are similar libraries. In the case of Hotwire, you can achieve quite a bit of functionality and performance even without changing your HTML, just by using Turbo Frames to intercept link clicks and form submissions, automatically turning standard page navigation into partial DOM updates.

The beauty of the hypermedia approaches is that you gain a lot with a little. You are staying as much as possible in HTML, the very poster child of simplicity. On the other hand, you are giving up some of the sheer sophisticated power of reactive frameworks.

Local-first apps

Local-first development is the new kid on the block. Like React and friends, local-first keeps the data in two places, but it does so in a radically different way. In its most essential form, it means running a database in the browser that is kept aligned with the remote datastore via a syncing engine. This kind of thing has been done before with NoSQL databases like CouchDB or with the IndexedDB API, but the modern browser takes it to another level with a Wasm-based database engine, like SQLite.

The user gets a small view of the full data, called a partial replication or a bucket (also called a “shape”). The front-end app interacts directly with that data, and the infrastructure automatically does the work of keeping everything synced. A big benefit here is strong offline support (because the client device is carrying around an actual database).

This is a massive departure from the request-response cycle. In local-first, you don’t fetch data; you subscribe to it. The network becomes a background daemon that reconciles local and remote state using CRDTs (conflict-free replicated data types). CRDTs ensure that if two users edit a task while offline, the merge is seamless rather than messy.

There is also a degree of simplification in using SQL everywhere, though that is offset by a rather unfamiliar and involved architectural setup. A syncing engine like PowerSync or Electric SQL is required, and it has a set of rules that must be maintained. Plus the auth and interaction between the database and the syncing engine must be configured.

Local-first eliminates both the API server and the HTML template server. It pushes the entire data negotiation layer into the automated syncing engine that runs off developer-defined rules.

Interestingly, local-first SQL can be used as a data driver for React (and other reactive engines) or plain vanilla HTML + JS. As such, it is an interesting alternative take on the architecture of the web, which is agnostic about the front end.

Perhaps the strangest arrangement to contemplate is using HTMX and local-first SQL together. This is like a mad scientist architecture, which of course means developers are doing it. In this setup, the back-end HTMX template engine is actually a service worker running the SQL engine. In theory, you get the simplicity of HTMX and the ultra-speed + offline functionality of local SQL.

Reactivity, hypermedia, or local-first? How to choose

We remain in the era of the default choice being React plus a JSON API. From there you might experiment with innovative frameworks like Svelte or Solid. If you are looking for an ingenious way to leverage RESTful simplicity, HTMX or Hotwired are must-tries. Local-first SQL is an exotic animal, fit for the likes of Linear or Notion right now, but somewhat daring for most of us doing standard production work.

More broadly, the emergence of this trilemma signals the end of the “one true way” for web development. We are moving away from the library wars and into a world of architectural choice.

The choice between reactivity, hypermedia, and local-first isn’t just about code. It’s about where you want to place the data.

If you want the data to be a server-side document, choose hypermedia.
If you want the data to be a shared memory state, choose reactivity.
If you want the data to be a distributed database, choose local-first.

And of course, it is possible to put the approaches together to strive for a blend of the right benefits for your project.

As the JSON-over-the-wire monolith continues to fragment, the best architects won’t be the ones who know the most hooks or the most attributes. They will be the ones who understand the weight of their data and choose the architecture that lets the data move most freely. The framework wars are over, but the battle for the network has just begun.

Microsoft and OpenAI Rewrote Their Marriage Contract

Mon, 27 Apr 2026 21:46:30 +0200

Microsoft and OpenAI’s amended deal loosens exclusivity, simplifies economics, and signals AI’s shift toward multi-cloud infrastructure.

The post Microsoft and OpenAI Rewrote Their Marriage Contract appeared first on eWEEK.

85% of enterprises are running AI agents. Only 5% trust them enough to ship.

Fri, 24 Apr 2026 15:32:18 +0200

Eighty-five percent of enterprises are running AI agent pilots, but only 5% have moved those agents into production. In an exclusive interview at RSA Conference 2026, Cisco President and Chief Product Officer Jeetu Patel said that the gap comes down to one thing: trust — and that closing it separates market dominance from bankruptcy. He also disclosed a mandate that will reshape Cisco's 90,000-person engineering organization.

The problem is not rogue agents. The problem is the absence of a trust architecture.

The trust deficit behind a 5% production rate

A recent Cisco survey of major enterprise customers found that 85% have AI agent pilot programs underway. Only 5% moved those agents into production. That 80-point gap defines the security problem the entire industry is trying to close. It is not closing.

"The biggest impediment to scaled adoption in enterprises for business-critical tasks is establishing a sufficient amount of trust," Patel told VentureBeat. "Delegating versus trusted delegating of tasks to agents. The difference between those two, one leads to bankruptcy and the other leads to market dominance."

He compared agents to teenagers. "They're supremely intelligent, but they have no fear of consequence. They're pretty immature. And they can be easily sidetracked or influenced," Patel said. "What you have to do is make sure that you have guardrails around them and you need some parenting on the agents."

The comparison carries weight because it captures the precise failure mode security teams face. Three years ago, a chatbot that gave the wrong answer was an embarrassment. An agent that takes the wrong action can trigger an irreversible outcome. Patel pointed to a case he cited in his keynote where an AI coding agent deleted a live production database during a code freeze, tried to cover its tracks with fake data, and then apologized. "An apology is not a guardrail," Patel said in his keynote blog. The shift from information risk to action risk is the core reason the pilot-to-production gap persists.

Defense Claw and the open-source speed play with Nvidia

Cisco's response to the trust deficit at RSAC 2026 spanned three categories: protecting agents from the world, protecting the world from agents, and detecting and responding at machine speed. The product announcements included AI Defense Explorer Edition (a free, self-service red teaming tool), the Agent Runtime SDK for embedding policy enforcement into agent workflows at build time, and the LLM Security Leaderboard for evaluating model resilience against adversarial attacks.

The open-source strategy moved faster than any of those. Nvidia launched OpenShell, a secure container for open-source agent frameworks, at GTC the week before RSAC. Cisco packaged its Skills Scanner, MCP Scanner, AI Bill of Materials tool, and CodeGuard into a single open-source framework called Defense Claw and hooked it into OpenShell within 48 hours.

"Every single time you actually activate an agent in an Open Shell container, you can now automatically instantiate all the security services that we have built through Defense Claw," Patel told VentureBeat. The integration means security enforcement activates at container launch without manual configuration. That speed matters because the alternative is asking developers to bolt on security after the agent is already running.

That 48-hour turnaround was not an anomaly. Patel said several of the Defense Claw capabilities Cisco launched were built in a week. "You couldn't have built it in longer than a week because Open Shell came out last week," he said.

A six-to-nine-month product lead and an information asymmetry on top of it

Patel made a competitive claim worth examining. "Product wise, we might be six to nine months ahead of most of the market," he told VentureBeat. He added a second layer: "We also have an asymmetric information advantage of, I'd say, three to six months on everyone because, you know, we, by virtue of being in the ecosystem with all the model companies. We're seeing what's coming down the pipe." The 48-hour Defense Claw sprint supports the speed claim, though the lead margin is Cisco's own characterization; no independent benchmarks were provided.

Cisco also extended zero trust to the agentic workforce through new Duo IAM and Secure Access capabilities, giving every agent time-bound, task-specific permissions. On the SOC side, Splunk announced Exposure Analytics for continuous risk scoring, Detection Studio for streamlined detection engineering, and Federated Search for investigating across distributed data environments.

The zero-human-code engineering mandate

AI Defense, the product Cisco launched a year before RSAC 2026, is now 100% built with AI. Zero lines of human-written code. By the end of 2026, half a dozen Cisco products will reach the same milestone. By the end of calendar year 2027, Patel's goal is 70% of Cisco's products built entirely by AI.

"Just process that for a second and go: a $60 billion company is gonna have 70% of the products that are gonna have no human lines of code," Patel told VentureBeat. "The concept of a legacy company no longer exists."

He connected that mandate to a cultural shift inside the engineering organization. "There's gonna be two kinds of people: ones that code with AI and ones that don't work at Cisco," Patel said. That was not debated. "Changing 30,000 people to change the way that they work at the very core of what they do in engineering cannot happen if you just make it a democratic process. It has to be something that's driven from the top down."

Five moats for the agentic era, and what CISOs can verify today

Patel laid out five strategic advantages that will separate winning enterprises from failing ones. VentureBeat mapped each moat against actions security teams can begin verifying today.

Moat	Patel's claim	What CISOs can verify today	What to validate next
Sustained speed	"Operating with extreme levels of obsession for speed for a durable length of time" creates compounding value	Measure deployment velocity from pilot to production. Track how long agent governance reviews take.	Pair speed metrics with telemetry coverage. Fast deployment without observability creates blind acceleration.
Trust and delegation	Trusted delegation separates market dominance from bankruptcy	Audit delegation chains. Flag agent-to-agent handoffs with no human approval.	Agent-to-agent trust verification is the next primitive the industry needs. OAuth, SAML, and MCP do not yet cover it.
Token efficiency	Higher output per token creates a strategic advantage	Monitor token consumption per workflow. Benchmark cost-per-action across agent deployments.	Token efficiency metrics exist. Token security metrics (what the token accessed, what it changed) are the next build.
Human judgment	"Just because you can code it doesn't mean you should."	Track decision points where agents defer to humans vs. act autonomously.	Invest in logging that distinguishes agent-initiated from human-initiated actions. Most configurations cannot yet.
AI dexterity	"10x to 20x to 50x productivity differential" between AI-fluent and non-fluent workers	Measure the adoption rates of AI coding tools across security engineering teams.	Pair dexterity training with governance training. One without the other compounds the risk.

The telemetry layer the industry is still building

Patel's framework operates at the identity and policy layer. The next layer down, telemetry, is where the verification happens. "It looks indistinguishable if an agent runs your web browser versus if you run your browser," CrowdStrike CTO Elia Zaitsev told VentureBeat in an exclusive interview at RSAC 2026. Distinguishing the two requires walking the process tree, tracing whether Chrome was launched by a human from the desktop or spawned by an agent in the background. Most enterprise logging configurations cannot make that distinction yet.

A CEO's AI agent rewrote the company's security policy. Not because it was compromised. Because it wanted to fix a problem, lacked permissions, and removed the restriction itself. Every identity check passed. CrowdStrike CEO George Kurtz disclosed that incident and a second one at his RSAC keynote, both at Fortune 50 companies. In the second, a 100-agent Slack swarm delegated a code fix between agents without human approval.

Both incidents were caught by accident

Etay Maor, VP of Threat Intelligence at Cato Networks, told VentureBeat in a separate exclusive interview at RSAC 2026 that enterprises abandoned basic security principles when deploying agents. Maor ran a live Censys scan during the interview and counted nearly 500,000 internet-facing agent framework instances. The week before: 230,000. Doubling in seven days.

Patel acknowledged the delegation risk in the interview. "The agent takes the wrong action and worse yet, some of those actions might be critical actions that are not reversible," he said. Cisco's Duo IAM and MCP gateway enforce policy at the identity layer. Zaitsev's work operates at the kinetic layer: tracking what the agent did after the identity check passed. Security teams need both. Identity without telemetry is a locked door with no camera. Telemetry without identity is footage with no suspect.

Token generation as the currency for national competitiveness

Patel sees the infrastructure layer as decisive. "Every country and every company in the world is gonna wanna make sure that they can generate their own tokens," he told VentureBeat. "Token generation becomes the currency for success in the future." Cisco's play is to provide the most secure and efficient technology for generating tokens at scale, with Nvidia supplying the GPU layer. The 48-hour Defense Claw integration demonstrated what that partnership produces under pressure.

Security director action plan

VentureBeat identified five steps security teams can take to begin building toward Patel's framework today:

Audit the pilot-to-production gap. Cisco's own survey found 85% of enterprises piloting, 5% in production. Mapping the specific trust deficits keeping agents stuck is the starting point — the answer is rarely the technology. Governance, identity, and delegation controls are what's missing. Patel's trusted delegation framework is designed to close that gap.
Test Defense Claw and AI Defense Explorer Edition. Both are free. Red-team your agent workflows before they reach production. Test the workflow, not just the model.
Map delegation chains end-to-end. Flag every agent-to-agent handoff with no human approval. This is the "parenting" Patel described. No product fully automates it yet. Do it manually, every week.
Establish agent behavioral baselines. Before any agent reaches production, define what normal looks like: API call patterns, data access frequency, systems touched, and hours of activity. Without a baseline, the observability that Patel's moats require has nothing to compare against.
Close the telemetry gap in your logging configuration. Verify that your SIEM can distinguish agent-initiated actions from human-initiated actions. If it cannot, the identity layer alone will not catch the incidents Kurtz described at RSAC. Patel built the identity layer. The telemetry layer completes it.

CVE-2026-40155 | auth0 nextjs-auth0 up to 4.17.x authorization (GHSA-xq8m-7c5p-c2r6 / EUVD-2026-23537)

Sat, 18 Apr 2026 23:07:01 +0200

A vulnerability was found in auth0 nextjs-auth0 up to 4.17.x. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to incorrect authorization. This vulnerability is uniquely identified as CVE-2026-40155. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

I Rewrote My 3D Animated Fetch Tool to Now Have Zero Dependencies and Live-Updating Stats!

Thu, 16 Apr 2026 03:53:10 +0200

A couple days ago I posted about fetch here - it takes your distro logo and renders it as a spinning 3D object in the terminal using ASCII shading. Lots of people had interest in this project, and the general consensus was that people really liked it! I first want to thank everyone who tested this out or commented or starred my repository because it justified doing stupid and fun things with C and ASCII art! I almost got DDoSed with the number of notifications I got from Reddit - in the best way possible of course :)! I cannot express how much gratitude I have. But I'm posting here for more than just to thank you guys... I have a big update to share!

Since then I've basically rewritten the whole thing:

Fully native system info - no more fastfetch dependency for info! It reads /proc, /sys, and GTK config directly now. Fastfetch is only used optionally for logos! The screenshot I've attached isn't using fastfetch at all!
Per-character logo colors - logos keep their original colors instead of a 2-color approximation. All 500+ distro logos work (please file an issue if this isn't true, but for the most part, it is!).
Live-updating stats - memory, battery, uptime all tick in real-time while the logo spins. This is something that u/Holiday_Management60 suggested, and it is comperable to watching a minimal version of top in your fetching tool!
Config file - toggle/reorder fields, change label color, customize shading ramp, light direction, rotation speed, and more!
--size flag - scale the logo up or down.

Still a single C file, ~2,050 lines, and only depends on libm! Works on any Linux machine!

make sudo make install

Please give feedback (or stars if you think this is cool!) - I've been having a ton of fun building this and I'm not stopping anytime soon!

GitHub: https://github.com/areofyl/fetch

Original Post: https://www.reddit.com/r/linux/comments/1skr8um/i_made_a_fetch_tool_that_turns_your_distro_logo/

submitted by /u/areofyl
[link] [comments]

Meta researchers introduce 'hyperagents' to unlock self-improving AI for non-coding tasks

Wed, 15 Apr 2026 22:16:59 +0200

Creating self-improving AI systems is an important step toward deploying agents in dynamic environments, especially in enterprise production environments, where tasks are not always predictable, nor consistent.

Current self-improving AI systems face severe limitations because they rely on fixed, handcrafted improvement mechanisms that only work under strict conditions such as software engineering.

To overcome this practical challenge, researchers at Meta and several universities introduced “hyperagents,” a self-improving AI system that continuously rewrites and optimizes its problem-solving logic and the underlying code.

In practice, this allows the AI to self-improve across non-coding domains, such as robotics and document review. The agent independently invents general-purpose capabilities like persistent memory and automated performance tracking.

More broadly, hyperagents don't just get better at solving tasks, they learn to improve the self-improving cycle to accelerate progress.

This framework can help develop highly adaptable agents that autonomously build structured, reusable decision machinery. This approach compounds capabilities over time with less need for constant, manual prompt engineering and domain-specific human customization.

Current self-improving AI and its architectural bottlenecks

The core goal of self-improving AI systems is to continually enhance their own learning and problem-solving capabilities. However, most existing self-improvement models rely on a fixed “meta agent.” This static, high-level supervisory system is designed to modify a base system.

“The core limitation of handcrafted meta-agents is that they can only improve as fast as humans can design and maintain them,” Jenny Zhang, co-author of the paper, told VentureBeat. “Every time something changes or breaks, a person has to step in and update the rules or logic.”

Instead of an abstract theoretical limit, this creates a practical “maintenance wall.”

The current paradigm ties system improvement directly to human iteration speed, slowing down progress because it relies heavily on manual engineering effort rather than scaling with agent-collected experience.

To overcome this limitation, the researchers argue that the AI system must be “fully self-referential.” These systems must be able to analyze, evaluate, and rewrite any part of themselves without the constraints of their initial setup. This allows the AI system to break free from structural limits and become self-accelerating.

One example of a self-referential AI system is Sakana AI’s Darwin Gödel Machine (DGM), an AI system that improves itself by rewriting its own code.

In DGM, an agent iteratively generates, evaluates, and modifies its own code, saving successful variants in an archive to act as stepping stones for future improvements. DGM proved open-ended, recursive self-improvement is practically achievable in coding.

However, DGM falls short when applied to real-world applications outside of software engineering because of a critical skill gap. In DGM, the system improves because both evaluation and self-modification are coding tasks. Improving the agent's coding ability naturally improves its ability to rewrite its own code. But if you deploy DGM for a non-coding enterprise task, this alignment breaks down.

“For tasks like math, poetry, or paper review, improving task performance does not necessarily improve the agent’s ability to modify its own behavior,” Zhang said.

The skills needed to analyze subjective text or business data are entirely different from the skills required to analyze failures and write new Python code to fix them.

DGM also relies on a fixed, human-engineered mechanism to generate its self-improvement instructions. In practice, if enterprise developers want to use DGM for anything other than coding, they must heavily engineer and manually customize the instruction prompts for every new domain.

The hyperagent framework

To overcome the limitations of previous architectures, the researchers introduce hyperagents. The framework proposes “self-referential agents that can in principle self-improve for any computable task.”

In this framework, an agent is any computable program that can invoke LLMs, external tools, or learned components. Traditionally, these systems are split into two distinct roles: a “task agent” that executes the specific problem at hand, and a “meta agent” that analyzes and modifies the agents. A hyperagent fuses both the task agent and the meta agent into a single, self-referential, and editable program.

Because the entire program can be rewritten, the system can modify the self-improvement mechanism, a process the researchers call metacognitive self-modification.

"Hyperagents are not just learning how to solve the given tasks better, but also learning how to improve," Zhang said. "Over time, this leads to accumulation. Hyperagents do not need to rediscover how to improve in each new domain. Instead, they retain and build on improvements to the self-improvement process itself, allowing progress to compound across tasks."

The researchers extended the Darwin Gödel Machine to create DGM-Hyperagents (DGM-H). DGM-H retains the powerful open-ended exploration structure of the original DGM, which prevents the AI from converging too early or getting stuck in dead ends by maintaining a growing archive of successful hyperagents.

The system continuously branches from selected candidates in this archive, allows them to self-modify, evaluates the new variants on given tasks, and adds the successful ones back into the pool as stepping stones for future iterations.

By combining this open-ended evolutionary search with metacognitive self-modification, DGM-H eliminates the fixed, human-engineered instruction step of the original DGM. This enables the agent to self-improve across any computable task.

Hyperagents in action

The researchers used the Polyglot coding benchmark to compare the hyperagent framework against previous coding-only AI. They also evaluated hyperagents across non-coding domains that involve subjective reasoning, external tool use, and complex logic.

These included paper review to simulate a peer reviewer outputting accept or reject decisions, reward model design for training a quadruped robot, and Olympiad-level math grading. Math grading served as a held-out test to see if an AI that learned how to self-improve while reviewing papers and designing robots could transfer those meta-skills to an entirely unseen domain.

The researchers compared hyperagents against several baselines, including domain-specific models like AI-Scientist-v2 for paper reviews and the ProofAutoGrader for math. They also tested against the classic DGM and a manually customized DGM for new domains.

On the coding benchmark, hyperagents matched the performance of DGM despite not being designed specifically for coding. In paper review and robotics, hyperagents outperformed the open-source baselines and human-engineered reward functions.

When the researchers took a hyperagent optimized for paper review and robotics and deployed it on the unseen math grading task, it achieved an improvement metric of 0.630 in 50 iterations. Baselines relying on classic DGM architectures remained at a flat 0.0. The hyperagent even beat the domain-specific ProofAutoGrader.

The experiments also highlighted interesting autonomous behaviors from hyperagents. In paper evaluation, the agent first used standard prompt-engineering tricks like adopting a rigorous persona. When this proved unreliable, it rewrote its own code to build a multi-stage evaluation pipeline with explicit checklists and rigid decision rules, leading to much higher consistency.

Hyperagents also autonomously developed a memory tool to avoid repeating past mistakes. Furthermore, the system wrote a performance tracker to log and monitor the result of architectural changes across generations. The model even developed a compute-budget aware behavior, where it tracked remaining iterations to adjust its planning. Early generations executed ambitious architectural changes, while later generations focused on conservative, incremental refinements.

For enterprise data teams wondering where to start, Zhang recommends focusing on tasks where success is unambiguous. “Workflows that are clearly specified and easy to evaluate, often referred to as verifiable tasks, are the best starting point,” she said. “This generally opens new opportunities for more exploratory prototyping, more exhaustive data analysis, more exhaustive A/B testing, [and] faster feature engineering.” For harder, unverified tasks, teams can use hyperagents to first develop learned judges that better reflect human preferences, creating a bridge to more complex domains.

The researchers have shared the code for hyperagents, though it has been released under a non-commercial license.

Caveats and future threats

The benefits of hyperagents introduce clear tradeoffs. The researchers highlight several safety considerations regarding systems that can modify themselves in increasingly open-ended ways.

These AI systems pose the risk of evolving far more rapidly than humans can audit or interpret. While researchers contained DGM-H within safety boundaries such as sandboxed environments designed to prevent unintended side effects, these initial safeguards are actually practical deployment blueprints.

Zhang advises developers to enforce resource limits and restrict access to external systems during the self-modification phase. “The key principle is to separate experimentation from deployment: allow the agent to explore and improve within a controlled sandbox, while ensuring that any changes that affect real systems are carefully validated before being applied,” she said. Only after the newly modified code passes developer-defined correctness checks should it be promoted to a production setting.

Another significant danger is evaluation gaming, where the AI improves its metrics without making actual progress toward the intended real-world goal. Because hyperagents are driven by empirical evaluation signals, they can autonomously discover strategies that exploit blind spots or weaknesses in the evaluation procedure itself to artificially inflate their scores. Preventing this behavior requires developers to implement diverse, robust, and periodically refreshed evaluation protocols alongside continuous human oversight.

Ultimately, these systems will shift the day-to-day responsibilities of human engineers. Just as we do not recompute every operation a calculator performs, future AI orchestration engineers will not write the improvement logic directly, Zhang believes.

Instead, they will design the mechanisms for auditing and stress-testing the system. “As self-improving systems become more capable, the question is no longer just how to improve performance, but what objectives are worth pursuing,” Zhang said. “In that sense, the role evolves from building systems to shaping their direction.

Trusted WordPress Plugins Hijacked in 8-Month Stealth Backdoor Campaign

Wed, 15 Apr 2026 13:24:13 +0200

Hackers secretly planted a remote code-execution backdoor in more than 30 popular WordPress plugins, leaving it dormant for about 8 months before activating malware that rewrote wp-config.php and injected cloaked SEO spam at scale. The incident centers on “Essential Plugin,”…

The post Trusted WordPress Plugins Hijacked in 8-Month Stealth Backdoor Campaign appeared first on IT Security News.

Trusted WordPress Plugins Hijacked in 8-Month Stealth Backdoor Campaign

Wed, 15 Apr 2026 12:51:53 +0200

The post Trusted WordPress Plugins Hijacked in 8-Month Stealth Backdoor Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

George Kurtz + Dan Ives on AI Agents Bypassing Security Policies

Fri, 10 Apr 2026 22:02:03 +0200

Author: CrowdStrike - Bewertung: 0x - Views:21

One AI agent didn’t have permission to fix an issue… so it asked another agent with access to do it.

Another? It rewrote the security policy to achieve its goal.

This isn’t theory. This is happening.

George_Kurtz sat down with DivesTech to discuss why AI needs guardrails. ⬇️

https://crwdstr.ke/6050B6LqQe

George Kurtz + Dan Ives on AI Agents Bypassing Security Policies

Fri, 10 Apr 2026 21:47:25 +0200

Author: CrowdStrike - Bewertung: 0x - Views:0

Researchers Show Prompt Injection Can Break Apple Intelligence

Fri, 10 Apr 2026 18:53:25 +0200

Security researchers recently showed exactly how a clever prompt injection attack managed to bypass the built-in safety protections of Apple Intelligence. The method tricked the on-device system into running unauthorized commands. Apple has since fixed the vulnerability, but these new findings give us a clear look at how hackers can manipulate local AI models even when strict safety filters are actively in place. How the attack tricked the system The attackers used a two-step process (via Apple Insider) to get past the input and output filters that Apple built into its system. First, they used a trick involving Unicode characters. They wrote harmful text backward, but applied a special right-to-left override character. This made the text look normal on a screen, but the raw text remained reversed. Because the system filters only looked at the raw text, they did not recognize the harmful words and let the request pass through. After sneaking past the filters, the researchers used a technique called Neural Exec. This method essentially rewrote the core instructions of the model. By combining these two steps, the attackers forced the system to ignore its basic safety rules and execute whatever instructions they wanted. In their tests, this approach worked 76 percent of the time. Apple is fixing the blind spots in local models Apple relies on a series of checks to keep its on-device Apple Intelligence functionality safe. An input filter checks your question for bad content. If it passes, the model generates an answer, which an output filter then checks. The researchers simply made the bad content invisible to those outer layers while giving orders to the model in the middle. They reported this to Apple in October 2025. The company updated its software to block the attack, releasing fixes in iOS 26.4 and macOS 26.4. While the fix is live, the research shows how tricky it is to secure AI models running locally on phones. Attackers will keep finding ways to hide their instructions in plain sight.

Sicherheitslücke in Next.js: Über 700 Server kompromittiert

Sun, 05 Apr 2026 07:51:01 +0200

LONDON (IT BOLTWISE) – Eine schwerwiegende Sicherheitslücke in Next.js-Anwendungen hat es Hackern ermöglicht, über 700 Server weltweit zu kompromittieren. Die Schwachstelle, bekannt als React2Shell, wird von der Hackergruppe UAT-10608 ausgenutzt, um sensible Daten zu stehlen. Eine massive automatisierte Kampagne zum Diebstahl von Zugangsdaten zielt derzeit auf Webanwendungen weltweit ab. Sicherheitsforscher von Cisco Talos haben eine […]

... den vollständigen Artikel »Sicherheitslücke in Next.js: Über 700 Server kompromittiert« lesen

Dieser Beitrag Sicherheitslücke in Next.js: Über 700 Server kompromittiert erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Local-first browser data gets real

Fri, 03 Apr 2026 11:32:57 +0200

If JavaScript were a character in a role-playing game, its class would be a Rogue. When it was a youngster, it was a street kid that lived on the margins of society. Over time, it has become an established figure in the enterprise hierarchy. But it never forgot where it came from, and you never know what sleight of hand it will perform next.

For example, fine-grained Signals are mounting a rebellion to overthrow the existing Virtual DOM hegemony. Incremental improvements to WebAssembly have reached the point where a real SQL database can be run inside the browser. Coupled with ingenious architectural patterns, this has opened up new possibilities in app data design.

In other JS developments, the upstart performance runtime, Bun, has spawned a native app framework, Electrobun. Welcome to our latest roundup of the JavaScript news and noteworthy.

Kritische Sicherheitslücke in Next.js führt zu massiven Datenlecks

Thu, 02 Apr 2026 22:05:11 +0200

LONDON (IT BOLTWISE) – Eine schwerwiegende Sicherheitslücke in Next.js hat zu einem groß angelegten Angriff geführt, bei dem Hacker sensible Daten von über 766 Hosts gestohlen haben. Die Schwachstelle, bekannt als CVE-2025-55182, ermöglicht es Angreifern, auf Datenbanken, SSH-Schlüssel und API-Keys zuzugreifen. Sicherheitsforscher warnen vor den weitreichenden Folgen für betroffene Unternehmen. Eine kritische Sicherheitslücke in der […]

... den vollständigen Artikel »Kritische Sicherheitslücke in Next.js führt zu massiven Datenlecks« lesen

Dieser Beitrag Kritische Sicherheitslücke in Next.js führt zu massiven Datenlecks erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

RSAC 2026 shipped five agent identity frameworks and left three critical gaps open

Mon, 30 Mar 2026 21:31:48 +0200

“You can deceive, manipulate, and lie. That’s an inherent property of language. It’s a feature, not a flaw,” CrowdStrike CTO Elia Zaitsev told VentureBeat in an exclusive interview at RSA Conference 2026. If deception is baked into language itself, every vendor trying to secure AI agents by analyzing their intent is chasing a problem that cannot be conclusively solved. Zaitsev is betting on context instead. CrowdStrike’s Falcon sensor walks the process tree on an endpoint and tracks what agents did, not what agents appeared to intend. “Observing actual kinetic actions is a structured, solvable problem,” Zaitsev told VentureBeat. “Intent is not.”

That argument landed 24 hours after CrowdStrike CEO George Kurtz disclosed two production incidents at Fortune 50 companies. In the first, a CEO's AI agent rewrote the company's own security policy — not because it was compromised, but because it wanted to fix a problem, lacked the permissions to do so, and removed the restriction itself. Every identity check passed; the company caught the modification by accident. The second incident involved a 100-agent Slack swarm that delegated a code fix between agents with no human approval. Agent 12 made the commit. The team discovered it after the fact.

Two incidents at two Fortune 50 companies. Caught by accident both times. Every identity framework that shipped at RSAC this week missed them. The vendors verified who the agent was. None of them tracked what the agent did.

The urgency behind every framework launch reflects a broader market shift. "The difficulty of securing agentic AI is likely to push customers toward trusted platform vendors that can offer broader coverage across the expanding attack surface," according to William Blair's RSA Conference 2026 equity research report by analyst Jonathan Ho. Five vendors answered that call at RSAC this week. None of them answered it completely.

Attackers are already inside enterprise pilots

The scale of the exposure is already visible in production data. CrowdStrike's Falcon sensors detect more than 1,800 distinct AI applications across the company's customer fleet, generating 160 million unique instances on enterprise endpoints. Cisco found that 85% of its enterprise customers surveyed have pilot agent programs; only 5% have moved to production, meaning the vast majority of these agents are running without the governance structures production deployments typically require. "The biggest impediment to scaled adoption in enterprises for business-critical tasks is establishing a sufficient amount of trust," Cisco President and Chief Product Officer Jeetu Patel told VentureBeat in an exclusive interview at RSA Conference 2026. "Delegating versus trusted delegating of tasks to agents. The difference between those two, one leads to bankruptcy and the other leads to market dominance."

Etay Maor, VP of Threat Intelligence at Cato Networks, ran a live Censys scan during an exclusive VentureBeat interview at RSA Conference 2026 and counted nearly 500,000 internet-facing OpenClaw instances. The week before: 230,000. Cato CTRL senior researcher Vitaly Simonovich documented a BreachForums listing from February 22, 2026, published on the Cato CTRL blog on February 25, where a threat actor advertised root shell access to a UK CEO’s computer for $25,000 in cryptocurrency. The selling point was the CEO’s OpenClaw AI personal assistant, which had accumulated the company’s production database, Telegram bot tokens, and Trading 212 API keys in plain-text Markdown with no encryption at rest. “Your AI? It’s my AI now. It’s an assistant for the attacker,” Maor told VentureBeat.

The exposure data from multiple independent researchers tells the same story. Bitsight found more than 30,000 OpenClaw instances exposed to the public internet between January 27 and February 8, 2026. SecurityScorecard identified 15,200 of those instances as vulnerable to remote code execution through three high-severity CVEs, the worst rated CVSS 8.8. Koi Security found 824 malicious skills on ClawHub — 335 of them tied to ClawHavoc, which Kurtz flagged in his keynote as the first major supply chain attack on an AI agent ecosystem.

Five vendors, three gaps none of them closed

Cisco went deepest on identity governance. Duo Agentic Identity registers agents as distinct identity objects mapped to human owners, and every tool call routes through an MCP gateway in Secure Access SSE. Cisco Identity Intelligence catches shadow agents by monitoring network traffic rather than authentication logs. Patel told VentureBeat that today’s agents behave “more like teenagers — supremely intelligent, but with no fear of consequence, easily sidetracked or influenced.” CrowdStrike made the biggest philosophical bet, treating agents as endpoint telemetry and tracking the kinetic layer through Falcon’s process-tree lineage. CrowdStrike expanded AIDR to cover Microsoft Copilot Studio agents and shipped Shadow SaaS and AI Agent Discovery across Copilot, Salesforce Agentforce, ChatGPT Enterprise, and OpenAI Enterprise GPT.

Palo Alto Networks built Prisma AIRS 3.0 with an agentic registry, an agentic IDP, and an MCP gateway for runtime traffic control. Palo Alto Networks’ pending Koi acquisition adds supply chain and runtime visibility. Microsoft spread governance across Entra, Purview, Sentinel, and Defender, with Microsoft Sentinel embedding MCP natively and a Claude MCP connector in public preview April 1. Cato CTRL delivered the adversarial proof that the identity gaps the other four vendors are trying to close are already being exploited. Maor told VentureBeat that enterprises abandoned basic security principles when deploying agents. “We just gave these AI tools complete autonomy,” Maor said.

Gap 1: Agents can rewrite the rules governing their own behavior

The Kurtz incident illustrates the gap exactly. Every credential check passed — the action was authorized. Zaitsev argues that the only reliable detection happens at the kinetic layer: which file was modified, by what process, initiated by what agent, compared against a behavioral baseline. Intent-based controls evaluate whether the call looks malicious. This one did not. Palo Alto Networks offers pre-deployment red teaming in Prisma AIRS 3.0, but red teaming runs before deployment, not during runtime when self-modification happens. No vendor ships behavioral anomaly detection for policy-modifying actions as a production capability.

Patel framed the stakes in the VentureBeat interview: “The agent takes the wrong action and worse yet, some of those actions might be critical actions that are not reversible.” Board question: An authorized agent modifies the policy governing the agent’s future actions. What fires?

Gap 2: Agent-to-agent handoffs have no trust verification

The 100-agent swarm is the proof point. Agent A found a defect and posted to Slack. Agent 12 executed the fix. No human approved the delegation. Zaitsev’s approach: collapse agent identities back to the human. An agent acting on your behalf should never have more privileges than you do. But no product follows the delegation chain between agents. IAM was built for human-to-system. Agent-to-agent delegation needs a trust primitive that does not exist in OAuth, SAML, or MCP.

Gap 3: Ghost agents hold live credentials with no offboarding

Organizations adopt AI tools, run a pilot, lose interest, and move on. The agents keep running. The credentials stay active. Maor calls these abandoned instances ghost agents. Zaitsev connected ghost agents to a broader failure: agents expose where enterprises delayed action on basic identity hygiene. Standing privileged accounts, long-lived credentials, and missing offboarding procedures. These problems existed for humans. Agents running at machine speed make the consequences catastrophic.

Maor demonstrated a Living Off the AI attack at the RSA Conference 2026, chaining Atlassian’s MCP and Jira Service Management to show that attackers do not separate trusted tools, services, and models. Attackers chain all three. “We need an HR view of agents,” Maor told VentureBeat. “Onboarding, monitoring, offboarding. If there’s no business justification? Removal.”

Why these three gaps resist a product fix

Human IAM assumes the identity holder will not rewrite permissions, spawn new identities, or leave. Agents violate all three. OAuth handles user-to-service. SAML handles federated human identity. MCP handles model-to-tool. None includes agent-to-agent verification.

Five vendors against three gaps

	Cisco	CrowdStrike	Microsoft	Palo Alto Networks	Unsolved
Registration. Can the vendor discover and inventory agents?	Duo Agentic Identity. Agents registered as identity objects with human owners. Shadow agent detection via network traffic.	Falcon sensor auto-discovery. 1,800+ agent apps, ~160M instances across customer fleet.	Security Dashboard for AI + Entra shadow AI detection at the network layer.	Agentic registry in Prisma AIRS 3.0. Agents inventoried before operating.	All four register agents. No cross-vendor identity standard exists.
Self-modification. Can the vendor detect when an agent changes its own policies?	MCP gateway catches anomalous tool-call patterns in real time, but does not monitor for direct policy file modifications on the endpoint.	Process-tree lineage tracks file modifications at the action layer. Could detect a policy file change, but no dedicated self-modification rule ships.	Defender predictive shielding adjusts access policies reactively during active attacks. Not proactive self-modification detection.	AI Red Teaming tests for this before deployment. No runtime detection after the agent is live.	OPEN. No vendor detects an agent rewriting the policy governing the agent’s own behavior as a shipping capability.
Delegation. Can the vendor track when one agent hands work to another?	Maps each agent to a human owner. Does not track agent-to-agent handoffs.	Collapses the agent identity to the human operator. Does not correlate the delegation chains between agents.	Entra governs individual non-human identities. No multi-agent chain tracking.	AI Agent Gateway governs individual agents. No delegation primitive between agents.	OPEN. No trust primitive for agent-to-agent delegation exists in OAuth, SAML, or MCP.
Decommission. Can the vendor confirm a killed agent holds zero credentials?	Identity Intelligence runs a continuous inventory of active agents.	Shadow SaaS + AI Agent Discovery finds running agents across SaaS and endpoints.	Entra's shadow AI detection surfaces unmanaged AI applications.	Koi acquisition (pending) adds endpoint visibility for agent applications.	OPEN. All four discover running agents. None verifies zero residual credentials after decommission.
Runtime / Kinetic. Can the vendor monitor what agents do in real time?	MCP gateway enforces policy per tool call at the network layer. Contextual anomaly detection on call patterns.	Falcon EDR tracks commands, scripts, file activity, and network connections at the process level.	Defender endpoint + cloud monitoring. Predictive shielding during active incidents.	Prisma AIRS AI Agent Gateway for runtime traffic control.	CrowdStrike is the only vendor framing endpoint runtime as the primary safety net for agentic behavior.

Five things to do Monday morning before your board asks

Audit self-modification risk. Pull every agent with write access to security policies, IAM configs, firewall rules, or ACLs. Flag any agent that can modify controls governing the agent’s own behavior. No vendor automates this.
Map delegation paths. Document every agent-to-agent invocation. Flag delegation without human approval. Human-in-the-loop on every delegation event until a trust primitive ships.
Kill ghost agents. Build a registry. For each agent: business justification, human owner, credentials held, systems accessed. No justification? Manual revoke. Weekly.
Stress test the MCP gateway enforcement. Cisco, Palo Alto Networks, and Microsoft all announced MCP gateways this week. Verify that agent tool traffic actually routes through the gateway. A misconfigured gateway creates false confidence while agents call tools directly.
Baseline agent behavioral norms. Before any agent reaches production, establish what normal looks like: typical API calls, data access patterns, systems touched, and hours of activity. Without a behavioral baseline, the kinetic-layer anomaly detection Zaitsev describes has nothing to compare against.

Zaitsev’s advice was blunt: you already know what to do. Agents just made the cost of not doing it catastrophic. Every vendor at RSAC verified who the agent was. None of them tracked what the agent did.

On the pleasures and dangers of open source Python

Fri, 27 Mar 2026 10:32:56 +0100

Announced at JavaOne, Project Detroit proposes to break down the walls between Java, Python, and JavaScript. Also in this report: Better ways to instrument your code with Python’s new built-in sampling profiler, another run at using AI locally to rework a Python project, and the question on everyone’s mind right now (surely): What does OpenAI really want with Astral?

I rewrote my ELF loader in Rust and added new features!

Sat, 14 Mar 2026 17:04:24 +0100

submitted by /u/AcrobaticMonitor9992
[link] [comments]

Cloudflare Experiment Ports Most of Next.js API in 'One Week' With AI

Thu, 26 Feb 2026 10:21:28 +0100

An anonymous reader shares a report: A Cloudflare engineer says he has implemented 94% of the Next.js API by directing Anthropic's Claude, spending about $1,100 on tokens. The purpose of the experimental project was not to show off AI coding, but to address an issue with Next.js, the popular React-based framework sponsored by Vercel. According to Cloudflare engineering director Steve Faulkner, the Next.js tooling is "entirely bespoke... If you want to deploy it to Cloudflare, Netlify, or AWS Lambda, you have to take that build output and reshape it into something the target platform can actually run." The Next.js team is addressing this following numerous complaints that deploying the framework with full features on platforms other than Vercel is too difficult, with a feature in progress called deployment adapters. "Vercel will use the same adapter API as every other partner," the company said when introducing the planned feature last year.

Read more of this story at Slashdot.

Rewrote my C++ Zsh history daemon to kill OS overhead. Real world typing latency is ~7ms for 500k commands.

Wed, 25 Feb 2026 02:36:24 +0100

Hey folks,

I posted a few days ago about a Zsh history middleware I've been building called BSH. Just to clarify up front: BSH is strictly a passion project to see how low I can push keystroke latency using a local-only C++ daemon. (I include tools like Atuin and FZF in my benchmarks purely because they are standard baselines everyone knows, but BSH has a much narrower focus).

If you are a latency nerd, you might find this fun.

The Benchmarks (and a correction) In my last post, I mentioned hitting 2.5ms for 500k commands. I have to admit that previous benchmark was way too forgiving. I completely rewrote the test suite to use highly-variable, realistic shell data and to measure the exact execution path the tools actually take in real life (including the full Zsh socket round-trip overhead).

That real-world testing added a bit of time to the results, but because of the architectural improvements below, the scaling remains incredibly flat:

10k commands: BSH 4.21ms | FZF 9.44ms | Atuin 14.78ms | Grep 9.37ms
100k commands: BSH 5.61ms | Atuin 16.08ms | FZF 39.21ms | Grep 77.96ms
500k commands: BSH 7.38ms | Atuin 22.37ms | FZF 200.61ms | Grep 417.62ms

https://preview.redd.it/7vdg9m328jlg1.png?width=3568&format=png&auto=webp&s=5fbefc838090d74b0e04ad1fe452e0c8347f6759

What changed since last week to get here: I ended up completely rewriting the architecture to kill OS and I/O overhead.

I ripped out the ephemeral client binary. Now, Zsh talks directly to the C++ daemon via native Unix sockets (zmodload zsh/net/socket).
Async I/O & Git: Database writes and libgit2 branch resolution are now pushed to a dedicated background thread with an in-memory LRU cache. Your keystrokes never wait on disk syncs or filesystem traversal.
All SQLite FTS5 queries are precompiled into memory at daemon startup.
All the string math, box-drawing, and truncation is handled asynchronously in C++, so the Zsh interpreter does zero heavy lifting.

TL;DR of Features It acts a bit like IntelliSense for your terminal. You can filter suggestions by your current Directory or Git Branch, and toggle a filter (Ctrl+F) to instantly hide commands that exited with errors (like typos or bad compiles). Everything stays 100% local.

Try it out I finally got it packaged so you don't have to build from source:

macOS: brew tap karthikeyjoshi/bsh && brew install bsh
Arch: yay -S aur/bsh

(There is also a universal install script, but I'm omitting it here because Reddit's spam filters hate curl | bash links!)

Repo: https://github.com/joshikarthikey/bsh

If you know C++, CMake, Zsh internals, or just want to roast my architecture, PRs and issues are highly welcome. I'd love to hack on this with some like-minded people.

submitted by /u/karthikeyjoshi
[link] [comments]

When speed stops working

Mon, 23 Feb 2026 12:04:04 +0100

For more than a decade, speed defined modern technology leadership.

I was in the room when it happened. Board decks rewarded velocity. Executive meetings celebrated acceleration. CIOs were measured by how quickly platforms migrated, products shipped and transformations launched. Speed became synonymous with relevance, and hesitation was framed as risk.

But something subtle began to change toward the end of 2025.

The questions coming from boards no longer centered on how fast we could move. Instead, they sounded more reflective, more surgical and frankly, more consequential: What happens when these scales? What breaks under stress? What risks are we introducing faster than the organization can absorb?

By 2026, a quiet strategic reversal is underway.

Across enterprises, technology leaders are no longer optimizing for maximum speed. They are optimizing for stability under continuous change. And that shift is redefining what strong CIO leadership looks like.

This is not a retreat from innovation. It is a maturation of judgment.

For years, enterprise technology was rewarded for how fast it moved. In 2026, it will be judged by how well it holds.

Why speed stopped being enough

Speed once solved a real problem.

Legacy architectures were brittle. Markets were compressing. Digital natives rewrote customer expectations while established enterprises struggled to respond. Accelerating delivery was not optional, it was existential.

But speed was never meant to be a permanent operating strategy.

What many organizations are now confronting is the accumulated cost of sustained urgency. In my own experience, the warning signs show up quietly: architectures that scale usage faster than governance, teams optimized for delivery but not durability, platforms launched before ownership is clear, and risks introduced faster than accountability can mature.

None of these failures looks dramatic in isolation. Together, they create instability.

Boards are increasingly aware of this pattern. They see that faster execution does not automatically translate into resilience. In fact, relentless acceleration often masks fragility until the moment pressure arrives.

That is when speed stops looking like progress and starts looking like exposure.

Stability is becoming the new competitive advantage

Stability is often misunderstood as conservatism. In practice, it is the opposite.

Stability is what allows organizations to change direction without breaking trust, budgets or balance sheets. It is what enables enterprises to absorb regulatory shifts, leadership transitions, market volatility and technological disruption without resetting the organization every eighteen months.

In 2026, the highest-performing enterprises share a common trait: they are not the fastest movers, but they are the most adaptable without chaos.

I see this in organizations where technology decisions survive executive turnover, where platforms tolerate partial failure without cascading outages, and where costs remain predictable even as capabilities expand. Stability does not slow innovation. It compounds it.

This broader emphasis on durability and adaptability as strategic capabilities is increasingly reflected in board-level discussions of operational resilience and enterprise continuity, including perspectives outlined by Deloitte on how resilience has become a governance priority rather than a compliance exercise.

Investors increasingly recognize this. Predictability now carries a premium, especially in regulated and capital-intensive industries. Analysts are less impressed by velocity alone and more interested in whether technology investments produce a durable advantage rather than episodic wins. Research from McKinsey reinforces this shift, noting that sustained value creation increasingly comes from disciplined execution rather than isolated transformation bursts.

Stability has quietly become strategic insurance.

The CIO role is re-centering around judgment

During the peak of digital acceleration, the CIO was often positioned as a catalyst, someone expected to remove friction and compress timelines. In many cases, that framing was necessary.

In 2026, the role is evolving again.

The modern CIO is becoming the enterprise’s custodian of stability, not as stasis, but as a design principle. This means deciding when not to modernize yet, sequencing initiatives so organizations can absorb change and designing systems that tolerate ambiguity rather than collapse under it.

Much of this work is invisible. It rarely appears on roadmaps or transformation dashboards. But boards notice it immediately when it is missing.

In my conversations with directors, the questions have shifted from feature delivery to structural integrity. They want to understand how decisions are sequenced, how risk is contained and how technology choices reinforce organizational coherence rather than erode it.

This is where CIO leadership becomes less about tools and more about judgment.

Why are boards and investors leaning into stability?

From a governance perspective, the board’s concern is no longer simply whether technology can deliver, but whether the enterprise can withstand the consequences if it does not.

Technology failures today are rarely isolated technical events. They trigger regulatory scrutiny, reputational damage, financial volatility and leadership credibility issues. Directors understand that the risk surface has expanded and that stability is the only sustainable counterweight.

This concern aligns with how systemic operational and technology fragility is now being discussed by global financial authorities such as the Bank for International Settlements, which has highlighted how weaknesses in operational resilience can amplify enterprise-wide risk.

Investors see the same signals. In growth-stage and public companies alike, they increasingly assess whether technology platforms can scale without exponential cost, whether operating models are resilient to disruption and whether leadership teams demonstrate control rather than constant reaction. Commentary from BlackRock and other institutional investors has emphasized operational resilience and governance maturity as material factors in long-term valuation.

Speed still matters. But speed without stability now raises questions rather than confidence.

The hidden cost of perpetual acceleration

One of the most overlooked consequences of speed-first cultures is decision debt.

When everything is urgent, tradeoffs go undocumented, exceptions become precedents and temporary workarounds harden into permanent dependencies. Over time, organizations lose the ability to explain why systems exist as they do.

I have seen this firsthand. When boards eventually ask, Why is this structured this way? Who owns this risk? What assumptions were made? The answers are often fragmented or incomplete. That is not a technology problem. It is a leadership problem.

This dynamic mirrors a broader body of research on decision quality and execution discipline, which shows that effective decision processes matter more than raw speed in complex environments.

Stability restores narrative clarity. It forces explicit decisions, documented intent and accountable ownership. It creates the conditions under which technology decisions can be explained, defended and evolved rather than constantly patched.

What effective CIOs are doing differently in 2026

The most effective CIOs are not announcing this shift publicly. They are embedding it quietly into how decisions are made.

Across industries, common patterns are emerging. Fewer “big bang” initiatives and more staged commitments. Architectural ownership established before platform expansion. Investment pacing aligned to organizational readiness rather than vendor timelines. Explicit tolerance thresholds for complexity, cost and risk.

These leaders are not slower. They are more deliberate.

They understand that credibility compounds faster than velocity. And in a climate where executive trust is fragile, credibility is the CIO’s most valuable currency.

Founders face the same reckoning

This shift is not limited to large enterprises.

Founders often associate stability with late-stage maturity. In 2026, that assumption is increasingly dangerous. Investors now scrutinize whether platforms can survive leadership transitions, whether systems scale without disproportionate cost, and whether governance exists beyond the founding team.

Speed still opens doors. Stability keeps them open.

Startups that cannot articulate a credible stability narrative find it harder to attract patient capital, especially in environments where regulatory, security and operational scrutiny is intensifying. Founders who embrace stability early do not lose agility, they gain legitimacy.

The strategic reversal no one announced

No memo declared this shift. No keynote celebrated it.

But it is unmistakable.

Enterprise technology leadership is moving from speed as identity to stability as advantage, from reaction to orchestration, from momentum to endurance. The CIO who thrives in 2026 will not be the loudest advocate for acceleration. They will be the quiet architect who ensures the enterprise can move again without losing its footing.

In a world that no longer waits, stability may be the most radical form of leadership left.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Cache Deception Flaw in SvelteKit And Vercel Stack Exposes User Data

Mon, 23 Feb 2026 03:19:44 +0100

A cache deception vulnerability in SvelteKit apps deployed on Vercel exposes sensitive user data to attackers. The flaw allows publicly cached responses to be authenticated. SvelteKit, a full-stack JavaScript framework, often pairs with Vercel for deployment. The issue stems from…

The post Cache Deception Flaw in SvelteKit And Vercel Stack Exposes User Data appeared first on IT Security News.

Hey, senior PMs: Shipping faster won’t get you promoted

Fri, 06 Feb 2026 13:05:58 +0100

It was 2022 and I was sitting in a quarterly business review feeling invincible.

I was the director of product for a SaaS platform scaling toward $25 million in annual recurring revenue (ARR). My team was a machine. Our Jira hygiene was impeccable. Our velocity was at an all-time high. We were shipping complex features every two weeks like clockwork.

I pulled up my slide deck, proudly displaying our burn-down chart. I walked the executive team through the velocity metrics, showing them exactly how many story points we had crushed in Q3. I sat back waiting for the applause.

Instead, the CFO looked at the slide, then at me and asked a single, quiet question: “Richard, that’s great that you shipped all that code. But looking at the cloud bill, our gross margins just dropped by 4%. Can you explain the margin impact of this release versus the revenue lift?”

Silence.

It’s a trap

I froze. I could tell him the latency of the API calls. I could tell him our net promoter score (NPS) to the decimal. But I couldn’t tell him if the feature made money. I had no idea that the architecture we chose was heavy on compute and I certainly hadn’t modeled the cost against the projected usage.

In that moment, I realized I had walked into what I call the Senior PM Trap. I was excellent at spending the company’s money (building software), but I had no idea how the company actually made money. As the product lead, that margin compression was ultimately my responsibility, yet I had treated it as someone else’s problem.

This is the predictable plateau in the career of almost every high-performing product manager. I see it constantly now: We master the craft of execution, agile, scrum and user research, but we fail to master the language of capital allocation. Until I made that shift, from shipping features to managing an investment portfolio, I was never going to break through to the executive level.

Here is how I learned to stop acting like a project manager and start acting like a product economist. By product economist, I don’t mean someone who builds spreadsheets all day. I mean a product leader who can translate technical decisions into financial outcomes that executives can actually act on.

The crisis of context: When velocity hides margin erosion

I was raised in what Melissa Perri famously calls the Escaping the Build Trap. In these environments, I learned to measure success by output rather than outcome. The burn-down chart was my scoreboard. If my team shipped 20 story points, I told myself we had a good week.

This mindset worked for me when interest rates were zero and venture capital was infinite. It does not work today.

When my company hit that $25M ARR mark, the physics of our business changed. My CEO didn’t care about my backlog anymore; he cared about the P&L. By focusing on velocity, I was optimizing for the wrong variable. I was running a feature factory that celebrated output even if that output was destroying our margins.

This is also where many CIOs get trapped. They inherit product teams optimized for delivery, not for financial outcomes. Velocity looks healthy, but margin quietly erodes. The question isn’t whether your PMs can ship. It’s whether they understand the economic consequences of what they ship.

To cross the chasm from senior PM to product leader, I had to stop showing my executives a roadmap of features and start showing them a model of returns. I had to learn the three metrics that matter.

1. From user value to CAC payback

Early in my career, my pitch for a new feature was always qualitative. I would stand in front of stakeholders and say: Users are complaining about the onboarding flow. It’s clunky. If we fix it, they will love us.

While true, this wasn’t a business case. User love didn’t appear on the balance sheet and my CFO didn’t sign off on vibes.

The shift happened when I finally walked over to the sales desk. I sat down with our VP of sales and asked a question I should have asked years earlier: How much does it actually cost us to get a customer?

We dug into the numbers to calculate our customer acquisition cost (CAC) payback period. I was shocked to learn that it cost us roughly $15,000 in marketing and sales commissions to acquire a new enterprise customer. More importantly, it took us 14 months of their subscription payments just to break even on that cost.

Suddenly, the onboarding project wasn’t about UX friction anymore. It was about cash flow. If customers churned before month 14, we were literally losing money on them.

I went back to my desk and rewrote the pitch. Instead of talking about delight, I framed it like this: “This onboarding friction is causing a 15% drop-off in the first 30 days. By fixing this, we project a higher conversion rate that lowers our CAC payback period from 14 months to 9 months. That frees up cash flow to reinvest in Q4.”

The feature was approved instantly. The lesson hit me hard: Every feature is an arbitrage play. If I couldn’t quantify the efficiency gain, I was just guessing.

2. From technical debt to COGS efficiency (the AI trap)

Nowhere was my financial illiteracy more dangerous than in the current AI boom.

Earlier this year, I led a team that rushed to integrate a generative AI feature. We treated it like standard software: We built it, tested it for accuracy and shipped it. Users loved it. Engagement skyrocketed. I thought we had won.

Then the cloud bill arrived.

I hadn’t modeled the unit economics. I failed to realize that every query triggered a chain of vector database lookups, massive compute spikes for inference and API tokens that cost us roughly $0.08 per interaction.

In the traditional SaaS model I was used to, costs are relatively fixed. You pay for the server capacity and whether 100 or 1,000 users log in, your cost doesn’t fluctuate wildly. But with large language models (LLMs), I had introduced variable costs that scaled linearly with usage.

As we scaled, we weren’t just paying for tokens; we were paying for raw compute power. A power user who loved the product was no longer our best customer; they were our biggest expense. I was effectively paying them to bankrupt us.

This forced me to learn the concept of cost of goods sold (COGS). As Bessemer Venture Partners noted in their State of the Cloud report, this is an industry-wide crisis: AI startups are operating with gross margins as low as 25%, compared to the 80%+ standard for traditional SaaS.

I modeled our own cost curve and realized something uncomfortable: at $0.08 per query, usage growth didn’t improve margins; it destroyed them. Without intervention, our most engaged users would become loss leaders.

Whenever I audit product roadmaps today, this is the first red flag I look for: Are you pricing for software (fixed cost) while building for AI (variable cost)? If you don’t cap those costs via model optimization or caching, your gross margins will collapse.

I had to pivot the roadmap immediately. We shifted engineering effort to model optimization, driving the cost down to under $0.01 per query. A senior PM would have kept shipping features; a product leader fixed the economics.

3. From roadmap to CapEx vs. OpEx

The final ceiling I had to break was understanding capital allocation.

For years, I viewed my engineering team as a resource to be utilized. I fought for more headcount constantly, believing that more bodies meant more features. But an executive views an engineering team as an investment portfolio. We are spending millions of dollars a year on salaries. The question isn’t: “Are they busy?” The question is: “What is the return on that capital?”

I started auditing my own roadmap using the framework of CapEx versus OpEx.

CapEx (capital expenditure = growth): Building new assets that will generate new revenue (e.g., a new product line).
OpEx (operating expense = maintenance): The tax we pay to keep the lights on (bug fixes, compliance, keeping servers running).

Why does this matter? Because OpEx hits the P&L immediately, reducing earnings before interest, taxes, depreciation and amortization. CapEx, however, is an asset that can be depreciated over time.

When I mapped our roadmap against capital allocation, the imbalance was obvious. Nearly 80% of engineering spend was technically OpEx — we were maintaining existing revenue, not creating new assets. We were treading water, but expensive water.

I walked into the next planning meeting with a different proposal: “We are currently spending 80% of our budget on maintenance. That is a bad investment strategy. I am proposing we freeze non-critical bugs for one quarter to shift our allocation to 60% growth with 40% maintenance.”

This was language the C-suite respected. It treated the engineering team not as coders but as capital. It shifted the conversation from “Why is this feature late?” to “Are we allocating capital to the right bets?”

Why financial fluency is the new product leadership edge

The era of the technical PM is ending. In a world where AI can generate code, tickets and even roadmaps, execution is no longer scarce. Economic judgment is.

The product leaders who advance won’t be the ones who ship faster. They’ll be the ones who can sit with a CFO, read a P&L and explain why a roadmap improves margin, not just morale.

If you’re stuck at senior, don’t ask for more features to build. Ask for access to the financials. Learn how your product actually makes money. That’s the moment you stop being a cost center and start becoming an executive.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

AI Startups Raise Record $150B in 2025, Redefining Venture Capital

Fri, 02 Jan 2026 16:02:14 +0100

The AI funding boom just rewrote the record books. In 2025, startups raised roughly $150 billion, setting a new high for venture capital investment. Data released on Dec. 28 confirms this marks the third consecutive year of record growth, surpassing the 2021 peak by $92 billion and representing a 63% increase over an already historic […]

The post AI Startups Raise Record $150B in 2025, Redefining Venture Capital appeared first on eWEEK.

Uber rewrites contracts with drivers to avoid paying UK’s new ‘taxi tax’

Fri, 02 Jan 2026 14:31:56 +0100

Hailing app will now act as agent rather than supplier outside London, avoiding VAT requirement, although change is not permitted in London

Uber has swerved paying millions of pounds to the UK exchequer under Rachel Reeves’s new “taxi tax” after the ride-hailing app rewrote contracts with its drivers.

The move came as rules announced in November’s budget took effect, which adjusted how VAT is payable on minicab fares and would have resulted in the whole Uber fare becoming subject to the 20% sales tax.

Test for React2Shell with Application Security using New Functionality

Wed, 17 Dec 2025 20:51:05 +0100

Following disclosure of the React2Shell vulnerability (CVE-2025-55182), a maximum-severity Remote Code Execution (RCE) in React Server Components (RSC) a.k.a. the Flight protocol, security teams are assessing exposure and validating fixes. React and ecosystem vendors have released patches; exploitation in the wild has been reported, so rapid validation matters.

What is React2Shell?

React2Shell is an unauthenticated RCE flaw caused by insecure Flight payload deserialization in server-side React/RSC implementations (including popular frameworks like Next.js). It carries a CVSS 10.0 rating and affects React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 as well as Next.js versions 15.0.0-15.1.6 and 16.0.0-16.0.6 prior to recent patches. You can read more about it in this detailed CVE overview blog post.

In this detailed writeup, we will share how our customers can specifically test for React2Shell with Rapid7’s Application Security solution.

Testing for React2Shell with application security

With our dynamic application security testing (DAST) solution, customers can assess the risk of their applications. Rapid7 allows you to configure various attacks of your applications to identify response behaviors that make your applications more vulnerable to attacks. These attacks are run during scans that you can customize based on your needs. In this case, we’ve extended our RCE attack module to include a check for React2Shell.

What does this mean? Customers can now run an Attack Injection using the RCE, which includes an attack type for React2Shell. Our React2Shell vulnerability detection will simulate an attacker on your website. This is a benign attack which will not execute any code and only shows that RCE is possible. Rapid7 will validate the exploitability of the application and the associated risk.

How to run a React2Shell attack in the Rapid7 DAST

You can scan for this new RCE attack using either the new Arbitrary Code Execution attack template we have created or by creating your own custom attack template and selecting the RCE module. We have added some steps for you to follow below:

Default attack template option:

Choose the Arbitrary Code Execution attack template in your scan configuration:

⠀

Default Arbitrary Code Execution attack template with RCE attack module

Custom attack template option:

Custom Attack Template with RCE module

Run a scan

Choosing the scan configuration you made earlier, scan against your selected app(s).

Scan results - React2Shell RCE finding

Now that you have run your scan, you can review the results to see if your app(s) have any findings. These will include remediation advice that you can follow.

⠀

Manage attack templates

You can now manage your attack templates by navigating to the appropriate section and selecting the Arbitrary Code Execution attack template as below.

⠀

Manage attack templates

What’s next?

Patch immediately, upgrade React to 19.0.1, 19.1.2, or 19.2.1 (or newer). For Next.js, the recommended action is to update to the following respective patched versions: 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, or later*. You should seek to remediate this vulnerability on an urgent basis, outside of normal patch cycles and consider temporary web application firewall (WAF) rules for Flight endpoints while patching. If you’re looking to validate any fixes you have implemented, feel free to run a validation scan with our application security tool to verify the fixes are correct.

* For Next.js, the recommendation from Nextjs is to update to the following respective patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, or later. However, we have identified that versions 15.0.5 and 15.1.9 have a different critical vulnerability and would recommend against using them.

Google Chrome is Going Agentic - Threat Wire

Mon, 15 Dec 2025 16:02:03 +0100

Author: Hak5 - Bewertung: 45x - Views:279

SUBMIT YOUR TOP 10 CYBERSECURITY STORIES OF 2025 HERE; https://form.typeform.com/to/jCgAub8V

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️

@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? endingwithalicollabs@gmail.com

[❗] Join the Patreon→ https://patreon.com/threatwire
00:00 0 - Intro
00:10 1 - The React RCE
04:11 2 - Chrome Attempts to Mitigate AI Browsing Security Issues
06:38 3 - Flash News
07:31 4 - India Government Demands and Retracts Surveillance
09:01 5 - Outro

LINKS
🔗 Story 1: The React RCE
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
https://react2shell.com/
https://www.cve.org/CVERecord?id=CVE-2025-55182
https://x.com/maple3142/status/1996687157789155647
https://infosec.exchange/@shadowserver/115672050969855947
https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/
https://nvd.nist.gov/vuln/detail/CVE-2025-66478
https://www.wiz.io/blog/nextjs-cve-2025-55182-react2shell-deep-dive
https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/
🔗 Story 2: Chrome Attempts to Mitigate AI Browsing Security Issues
https://www.bleepingcomputer.com/news/security/google-chrome-adds-new-security-layer-for-gemini-ai-agentic-browsing/
https://blog.google/products/chrome/new-ai-features-for-chrome/
https://neuraltrust.ai/blog/openai-atlas-omnibox-prompt-injection
https://security.googleblog.com/2025/12/architecting-security-for-agentic.html
🔗 Story 3: Flash News
https://www.bleepingcomputer.com/news/security/french-diy-retail-giant-leroy-merlin-discloses-a-data-breach/
https://techcrunch.com/2025/12/03/fintech-firm-marquis-alerts-dozens-of-us-banks-and-credit-unions-of-a-data-breach-after-ransomware-attack/
https://www.pcmag.com/news/petco-data-breach-exposes-customer-data-including-ssns-credit-card-info
https://botcrawl.com/lockbit-5-0-ransomware-lists-21-victims-on-dark-web/
https://www.bleepingcomputer.com/news/security/eu-fines-x-140-million-over-deceptive-blue-checkmarks-transparency-violations/
🔗 Story 4: India Government Demands and Retracts Surveillance
https://appleinsider.com/articles/25/12/01/india-demands-apple-preinstall-government-security-app-onto-iphones
https://appleinsider.com/articles/25/12/03/india-blinks-wont-require-apple-to-preinstall-a-state-app-on-iphone
https://www.reuters.com/sustainability/boards-policy-regulation/india-orders-mobile-phones-preloaded-with-government-app-ensure-cyber-safety-2025-12-01/
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

He wrote the world’s most successful video games – now what? Rockstar co-founder Dan Houser on life after Grand Theft Auto

Mon, 15 Dec 2025 13:46:46 +0100

He rewrote the rule book with Rockstar then left it all behind. Now Dan Houser is back with a storytelling-focused studio to take on AI-obsessed tech bros and Mexican beauty queens

There are only a handful of video game makers who have had as profound an effect on the industry as Dan Houser. The co-founder of Rockstar Games, and its lead writer, worked on all the GTA titles since the groundbreaking third instalment, as well as both Red Dead Redemption adventures. But then, in 2019, he took an extended break from the company which ended with his official departure. Now he’s back with a new studio and a range of projects, and 12 years after we last interviewed him, he’s ready to talk about what comes next.

“Finishing those big projects and thinking about doing another one is really intense,” he says about his decision to go. “I’d been in full production mode every single day from the very start of each project to the very end, for 20 years. I stayed so long because I loved the games. It was a real privilege to be there, but it was probably the right time to leave. I turned 45 just after Red Dead 2 came out. I thought, well, it’s probably a good time to try working on some other stuff.”

CVE-2025-67716 | auth0 nextjs-auth0 up to 4.12.x returnTo incomplete blacklist (GHSA-mr6f-h57v-rpj5 / CNNVD-202512-2251)

Fri, 12 Dec 2025 16:16:44 +0100

A vulnerability, which was classified as critical, has been found in auth0 nextjs-auth0 up to 4.12.x. This affects an unknown function. Performing manipulation of the argument returnTo results in incomplete blacklist. This vulnerability is known as CVE-2025-67716. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components

Thu, 04 Dec 2025 17:21:22 +0100

Overview

On December 3, 2025, Meta disclosed a new vulnerability, CVE-2025-55182, which has since been dubbed React2Shell. A second CVE identifier, CVE-2025-66478, was assigned and published to track the vulnerability in the context of Next.js. However this second CVE has since been rejected as a duplicate of CVE-2025-55182, as the root cause in all cases is the same and should be referred to with a single common CVE identifier.

CVE-2025-55182 is a critical unauthenticated remote code execution vulnerability affecting React, a very popular library for building modern web applications. This new vulnerability has a CVSS rating of 10.0, which is the maximum rating possible and indicates the highly critical nature of the issue. Successful exploitation of CVE-2025-55182 allows a remote unauthenticated attacker to execute arbitrary code on an affected server via malicious HTTP requests.

The vulnerability affects React applications that support React Server Components. While the vulnerability affects the React Server Components feature, server applications may still be vulnerable even if the application does not explicitly implement any React Server Function endpoints but does support React Server Components. Additionally many popular frameworks based on React, such as Next.js, are also affected by this vulnerability.

A separate advisory was published by Vercel, the vendor for Next.js. This advisory tracks the impact of CVE-2025-55182 as it applies to the Next.js framework, and provides information for Next.js users to remediate the issue.

As of December 4, 2025, there is no known public exploit code available at this time. Several exploits have been published claiming to exploit CVE-2025-55182, however they have not been successfully verified as actually exploiting this vulnerability. This has been noted in the original finders website, react2shell.com. Therefore, broad exploitation has not yet begun, however once a viable public exploit becomes available we expect this to change.

Organizations who use React, or the affected downstream frameworks, are urged to remediate this vulnerability on an urgent basis, outside of normal patch cycles and before broad exploitation begins.

Mitigation guidance

CVE-2025-55182 affects versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of the following React packages:

A vendor supplied update for the above packages is available in versions 19.0.1, 19.1.2, and 19.2.1. Users of affected React packages are advised to update the latest remediated version on an urgent basis.

Downstream frameworks that depend on React are also affected, this includes (but is not limited to):

For the latest mitigation guidance for React, please refer to the React security advisory. For the latest mitigation guidance specific to Next.js, please refer to the Vercel security advisory.

Rapid7 customers

Exposure Command, InsightVM and Nexpose

Exposure Command, InsightVM and Nexpose customers can assess exposure to CVE-2025-55812 with an unauthenticated check expected to be available in today's (December 4) content release. Note that the "Potential" check type must be enabled before running the scan to successfully assess for the vulnerability.

React2Shell – Critical Bug Exposes React Server Components to Unauthenticated Remote Code Execution

Thu, 04 Dec 2025 11:35:30 +0100

React2Shell – Critical Bug Exposes React Server Components to Unauthenticated Remote Code Execution

Post Views: 49

Join our Patreon Channel and Gain access to 70+ Exclusive Walkthrough Videos.

Reading Time: 3 Minutes

A critical, maximum-severity vulnerability has been disclosed in React Server Components (RSC) that enables unauthenticated remote code execution (RCE) on exposed servers. Tracked as CVE-2025-55182 and nicknamed React2Shell, the bug carries a CVSS score of 10.0, reflecting its ease of exploitation and widespread impact across modern JavaScript frameworks.

According to the React Team, the flaw originates from how React decodes payloads sent to React Server Function endpoints, allowing arbitrary JavaScript to execute on the backend. Crucially, applications may be vulnerable even if they do not explicitly use Server Function endpoints — simply enabling React Server Components is enough to be exposed.

Root Cause: Unsafe Deserialization in React Flight Protocol

Cloud security firm Wiz attributes the issue to logical deserialization weaknesses in the React Flight protocol, which processes RSC payloads. Attackers can send malicious payloads that React wrongly interprets as trusted structures, triggering direct execution of attacker-supplied code.

Aikido Security further described it as a case where “malformed or adversarial payloads can influence server-side execution in unintended ways,” prompting the React team to harden deserialization and add strict payload validation in patched versions.

Affected Packages and Versions

The flaw affects React RSC implementations in the following npm packages:

react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack

Vulnerable Versions

19.0
19.1.0
19.1.1
19.2.0

Patched Versions

19.0.1
19.1.2
19.2.1

The vulnerability was discovered by security researcher Lachlan Davidson and responsibly reported to Meta on November 29, 2025.

See Also: So, you want to be a hacker?
Offensive Security, Bug Bounty Courses

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

Next.js Also Impacted (CVE-2025-66478 — CVSS 10.0)

Next.js, which widely incorporates React Server Components through its App Router, is affected under a separate identifier:

Impacted Next.js Versions

>=14.3.0-canary.77
>=15
>=16

Patched Versions

16.0.7
15.5.7
15.4.8
15.3.6
15.2.6
15.1.9
15.0.5

Security firms warn that any library bundling React Server Components is likely vulnerable, including:

Vite RSC plugin
Parcel RSC plugin
React Router RSC preview
RedwoodJS
Waku

Exploitation: No Login, No Special Conditions, HTTP is Enough

Endor Labs, VulnCheck, and Miggo Security emphasized:

No authentication is required
Any exposed Server Function endpoint is a viable target
The attack works over plain HTTP
Default framework configurations are exploitable immediately

Attackers only need basic network access to trigger RCE with a crafted request.

Wiz reported that 39% of cloud environments they analyzed contain vulnerable React or Next.js installations — a staggering potential blast radius.

Mitigation

Immediate actions recommended:

Apply the patched versions as soon as possible
Enable WAF rules (Cloudflare already deployed global protection for proxied sites)
Monitor HTTP traffic for malformed RSC payloads
Restrict network access to affected applications where possible

Cloudflare confirmed that all customers — free and paid — are protected when traffic is proxied through their WAF.

Threat Outlook

Palo Alto Networks Unit 42 identified over 968,000 publicly accessible servers running modern frameworks like React and Next.js, forming an exceptionally attractive attack surface.

Justin Moore of Unit 42 stressed the severity:

“This is a master key exploit — the system executes the malicious payload with the same reliability as legitimate code because it operates exactly as intended, just on malicious input.”

Given its ease of exploitation, widespread impact, and attack simplicity, React2Shell is now one of the most serious web-framework vulnerabilities disclosed in 2025.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com

Sources: thehackernews.com, blog.cloudflare.com, wiz.io/blog, react.dev/blog, aikido.dev/blog

Source Link

EXPLORE OUR STORE

Offensive Security & Ethical Hacking Course

Begin the learning curve of hacking now!

Information Security Solutions

Find out how Pentesting Services can help you.

Join our Community

The post React2Shell – Critical Bug Exposes React Server Components to Unauthenticated Remote Code Execution first appeared on Black Hat Ethical Hacking.

Magician Forgets Password To His Own Hand After RFID Chip Implant

Sat, 22 Nov 2025 09:49:37 +0100

A magician who implanted an RFID chip in his hand lost access to it after forgetting the password, leaving him effectively locked out of the tech embedded in his own body. The Register reports: "It turns out," said [said magician Zi Teng Wang], "that pressing someone else's phone to my hand repeatedly, trying to figure out where their phone's RFID reader is, really doesn't come off super mysterious and magical and amazing." Then there are the people who don't even have their phone's RFID reader enabled. Using his own phone would, in Zi's words, lack a certain "oomph." Oh well, how about making the chip spit out a Bitcoin address? "That literally never came up either." In the end, Zi rewrote the chip to link to a meme, "and if you ever meet me in person you can scan my chip and see the meme." It was all suitably amusing until the Imgur link Zi was using went down. Not everything on the World Wide Web is forever, and there is no guarantee that a given link will work indefinitely. Indeed, access to Imgur from the United Kingdom was abruptly cut off on September 30 in response to the country's age verification rules. Still, the link not working isn't the end of the world. Zi could just reprogram the chip again, right? Wrong. "When I went to rewrite the chip, I was horrified to realize I forgot the password that I had locked it with." The link eventually started working again, but if and when it stops, Zi's party piece will be a little less entertaining. He said: "Techie friends I've consulted with have determined that it's too dumb and simple to hack, the only way to crack it is to strap on an RFID reader for days to weeks, brute forcing every possible combination." Or perhaps some surgery to remove the offending hardware.

Read more of this story at Slashdot.

CVE-2025-64762 | workos authkit-nextjs up to 2.11.0 cache containing sensitive information

Fri, 21 Nov 2025 12:08:03 +0100

A vulnerability classified as critical was found in workos authkit-nextjs up to 2.11.0. Affected by this vulnerability is an unknown functionality. The manipulation results in use of cache containing sensitive information. This vulnerability is reported as CVE-2025-64762. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

VKD3D 3.0 released!

Tue, 18 Nov 2025 02:37:07 +0100

Lots of changes and improvements!

Full changes here.

I'm going to leave you with the full changelog because this is amazing. There are lots of improvements in performance, speed, and more! Although it's very technical to read all of this.

A new major release, yay!
A few milestones have been reached over the last year, warranting a new major bump.
It's been quite a while since the last release due to new things coming up constantly.
These tags are mostly arbitrary anyway, and tend to be done when islands of calm and stability emerge.

Major items

DXBC shader backend rewrite

u/doitsujin rewrote the entire DXBC backend, replacing our legacy vkd3d-shader path.
DXVK and vkd3d-proton now share the same DXBC frontend which gives us clean,
"readable" (as readable as DXBC can be) and lean IR to work with.
dxil-spirv standalone project now supports DXBC as well as a result.

Lots of games which used to be completely broken before due to bugs and missing features
in the legacy vkd3d-shader backend are now fixed. E.g. Red Dead Redemption 2 runs just fine now in D3D12 mode.
Some recently released DXBC based games also only work on the new path.
The amount of regressions found the last months in DXBC games has been very minor,
but it's possible there are still bugs in this area.
However, given that DXVK uses it now as well, it's been battle tested quite extensively already.

FSR4 support

We added support for AGS WMMA intrinsics through VK_KHR_cooperative_matrix and VK_KHR_shader_float8,
which is enough to support FSR4.
Note that these shaders are tightly coded for AMD GPUs with some implementation defined behavior
(particularly around matrix layouts), and they will not necessarily work on other GPU vendors.

There is also a quite hacky emulation path of this which relies on int8 and float16 cooperative matrix support,
which can run on older GPUs at significant performance cost (and some cost to theoretical correctness).

Note that the default "official" build of vkd3d-proton only exposes this feature when the native
VK_KHR_shader_float8 is properly supported, i.e. RDNA4+ only.
The emulation path is available when building from source with the appropriate build flags.
The decision to not include this emulation path by default is over my pay grade.
The aim is to be able to ship FSR4 in a more proper way in Proton.

Features

We've more or less caught up on the things we can feasibly implement,
so there isn't much exciting stuff happening on the feature front.

Implemented experimental support for D3D12 work graphs. No real-world content ships this yet. This implementation is far from complete, but it works on "any" GPU since we emulate the feature with normal compute shaders. Funnily enough, the performance of this emulation can massively outperform native driver implementations of the feature in many scenarios we've tested (at the cost of some extra VRAM usage). See docs/ for more details on implementation and some performance numbers.
Expose AdvancedTextureOpsSupported by default from SM 6.7 if VK_KHR_maintenance8 is supported.
Expose the recently added sparse TIER_4.
Bump exposed D3D12SDKVersion to latest 618.
Experimentally expose support for opacity micromaps. There are some details which aren't quite compatible with the D3D12 API, but some basic demo content is working fine.
Add support for AMD_anti_lag when exposed. The current implementation does not take frame-gen into account.
Implement support for tight alignment from recent AgilitySDK.
Add support for shared resource path on upstream Wine.

Performance

Overhaul the texture copy batching situation. The new batching logic should be able to improve performance in many more cases than before.
- Implemented support for VK_KHR_unified_image_layouts. Image copy batching in particular can take advantage of this to avoid a lot of unnecessary barriers.
Removed manual clear workaround on newer (6.15.9+) kernels on AMD, where an old kernel regression was finally fixed. Kernels older than 6.10 are also not affected by this workaround.
Use push descriptor path on Qualcomm GPUs over BDA for speed.
Improve handling of GDeflate when decompression extension is not available. We now ship our own fallback shader in GLSL instead of the more awkward HLSL shader that dstorage ships.
Bump DGC scratch size on NVIDIA. Should avoid some massive perf drops in Halo Infinite on NVIDIA.
Add performance optimization for The Last of Us Part 1 to prefer 2D tiling on 3D images. Requires an update to Mesa as well to get the proper effect.
Handle depth/stencil <-> color image copies better when VK_KHR_maintenance8 is supported.
Make use of VK_EXT_zero_initialize_device_memory to avoid manual clears on allocation.

Fixes

Emit render pass barriers as expected on tiled GPUs. Fixes misc rendering bugs reported on e.g. Turnip.
- For performance reasons, we deliberately skirt the spec a bit on desktop GPUs.
Fixed a bunch of minor correctness problems exposed by new Vulkan-ValidationLayers.
Adjust how PointSamplingAddressesNeverRoundUp is reported to match recent driver behaviors.
Fix overflow bugs in massive (> 4GiB) sparse resource handling.
Fix reporting of some esoteric format properties to better match native drivers.
Fix handling of NULL acceleration structure descriptors.
Fix some texturing bugs in Helldivers II on NVIDIA.
Fix some bugs with memory type handling on very old NVIDIA GPUs.
Fix bug when pixel shader includes root signature.
Make ClearUAV barrier insertion the default now. Too many games screw this up, and D3D12 drivers seem to do it by default.
Fix shared fences when initial value is not 0. Fixes some Star Citizen issues.
Fix rare deadlock scenario in Ninja Gaiden 4. Fixes some long-standing issues with how we deal with fence rewinds.
Fix some long-standing issues with how we deal with placed MSAA resources and alignment.
Make sure we don't clear memory of imported resources. This doesn't fix any known games, but you never know :V
Improve correctness for many odd GS/HS/DS corner cases with primitive types and API validation.
Fixes crashes when index buffer SizeInBytes = 0, but VA was invalid. Seen in some Saber Interactive games.
Fixes some potential deadlocks in VR interop APIs when multiple threads attempt to acquire Vulkan queue.
Fixes 16-bit aligned structured buffer strides. Not observed in any real content, but you never know!

Workarounds

Add FF VII rebirth sync bugs workarounds. Fixes some rare GPU hangs.
Add misc AMD workarounds for Monster Hunter Wilds caused by bugged hardware around sparse SMEM.
- A proper hardware workaround in RADV is still pending.
Workaround some Starfield bugs around NonUniformResourceIndex use.
Add performance workarounds for extremely large tessellation factors used in misc new Koei Tecmo games.
Add Wreckfest 2 workarounds for illegal texture placement aliasing. Fixes some broken textures.
Add barrier in Satisfactory that game missed. Fixes some corrupt rendering especially on AMD.
Ignore NOT_CLEARED flags on allocation in all games now. Native drivers seem to always clear regardless of the flag, and e.g. Street Fighter 6 relies on NOT_CLEARED memory to actually be cleared :(
Workaround some issues with RGB9E5 and alpha write masks observed in Ninja Gaiden 4.
Add missing barrier in Death Stranding (the older build, not Director's Cut).
Add missing barrier in Wuthering Waves.
Workaround bugged uninitialized loop variable in Dune MMO.
Disable UAV compression in Spider-Man Remastered. Fixes some weird RT issues on RDNA2.
Add Root CBV robustness workaround for Gray Zone Warfare.
Disables color compression in Rise of the Tomb Raider. Fixes some glitches due to game bug on AMD.
Workaround some bugs in Port Royal benchmark.
Workaround Mafia: Definitive Edition hanging GPU when using FSR on startup due to use-after-free.
- The workaround applies to all uses of FSR. Plausibly workaround a hang in MGS: Delta as well, but not confirmed it was this bug.
Workaround Control RT path occasionally observing NaNs due to bad normalize() patterns.
Workaround Final Fantasy Tactics Ivalice Chronicles illegally using dynamically indexed root constants.

Misc

Added a lot more debug instrumentation as usual.
- Not user facing, so omitting details.
Make it a bit easier to use vkd3d-proton in Linux-native projects.
Remove DXVK_FRAME_RATE to align with DXVK's removal. Only VKD3D_FRAME_RATE remains (at least for now).

submitted by /u/rec0veryyy
[link] [comments]

TypeScript Overtakes Python and JavaScript To Claim Top Spot on GitHub

Thu, 30 Oct 2025 19:19:09 +0100

TypeScript overtook Python and JavaScript in August 2025 to become the most used language on GitHub. The shift marked the most significant language change in more than a decade. The language grew by over 1 million contributors in 2025, a 66% increase year over year, and finished August with 2,636,006 monthly contributors. Nearly every major frontend framework now scaffolds projects in TypeScript by default. Next.js 15, Astro 3, SvelteKit 2, Qwik, SolidStart, Angular 18, and Remix all generate TypeScript codebases when developers create new projects. Type systems reduce ambiguity and catch errors from large language models before production. A 2025 academic study found 94% of LLM-generated compilation errors were type-check failures. Tooling like Vite, ts-node, Bun, and I.D.E. autoconfig hide boilerplate setup. Among new repositories created in the past twelve months, TypeScript accounted for 5,394,256 projects. That represented a 78% increase from the prior year.

Read more of this story at Slashdot.

Fixing my broken system while breaking my fixed system: My 2 month beef with my own linux environment

Thu, 23 Oct 2025 03:51:36 +0200

Hi everyone! I want to share a two-month-long, insanity-inducing debugging session - part cautionary tale, part comedy - so you can have a quick laugh and hopefully avoid making the same mistakes I did.

For the past couple of months, I’ve been maintaining and experimenting with DebDroid, a project I built to repurpose older Android devices into portable desktops and lightweight home servers.

It’s worth noting that, unlike Termux, DebDroid runs a near-native Linux userland based on glibc, not a minimal runtime. This means it behaves much more like a standard Linux system, but it also encounters more frequent compatibility issues with the Android host. You can think of it as LXC for Android, or like a version of Kali NetHunter adapted for general-purpose use.

My original goal for DebDroid was to get sshd (the OpenSSH server) and gpg working reliably, since both tend to run into issues in a plain, manually-managed chroot environment.

After a quick debugging session, I discovered that older Android kernels (pre-3.17) don’t support the getrandom() system call. Huh? No big deal. I just needed to write my own stub implementation that reads directly from /dev/urandom, wrap it in a shared library around syscall(), and preload it via ld. Easy, right?

In the meantime, I also created some scripts to automatically manage the environment and preload these runtime "patches" system-wide via /etc/ld.so.preload.

Everything was fun and games... until I tried to start an X11/Xfce4 VNC session to see if the project could support graphical environments without additional hand-rolled preloads. The session completely froze. The screen went black, and even the cursor failed to initialize. It was stuck to the ugly, default Xorg version. I spent days staring at logs, while fiddling with xstartup and DBus sessions trying to figure out what went wrong.

At this time, I also started using gdb and strace to determine why and where the xfce4-session processes keeps hanging. Every time, it was a function blocked on either read(), write() or poll() calls. Alright, I patch that function and retry... then another one. Patch, retry... another one. It was a caffeine-induced whack-a-mole game between me and the Linux environment. I eventually ended up with debug builds for nearly every major X11-related package just so I could patch the next stuck "offender". No package was safe from my wrath: GLib, GTK3, xfce4-session and many others, including their dependencies.

I small started by patching functions like g_spawn_sync, g_spawn_async and g_spawn_command_line_sync, recompiled everything directly on my puny tablet with 3GB of RAM and hoped for progress. Every patch seemed to fix something, only for a dozen others to appear. I even spent hours debugging with gdb sessions that sometimes hung themselves.

At some point I became paranoid and thought it must be systemd’s fault. I desperately grabbed a Devuan image and manually chrooted into it. Lo and behold, X11 worked perfectly. "Ah-ha! Systemd is the villain!!!" (average linux user moment, I know) I thought. I even modified my entire project to run on Devuan instead of Debian and updated the README to explain the breaking change and migration options. Victory was mine...or so I thought.

I integrated the Devuan setup into my normal environment and ran it... and it broke. Again! XD At this point, I was ready to give up on software development altogether, uninstall arch and go touch some grass.

Then it hit me... syscalls keep hanging, the "offenders" are everywhere, and patching one just leads to another down the line. It must be that damn syscall wrapper I designed 2 months to fix a small compatibility issue between Linux and old Android kernels. Everything else (GLib, GTK, DBus, Xorg, Xfce4, ...) was misbehaving because the wrapper didn't properly forward arguments to the real syscall(), resulting in hangups for nearly every major package of the environment. Once fixed, everything worked immediately. I still can't believe I sabotaged myself this hard.

The ironic part:

syscall() is the foundation of the system, yet I completely ignored it for a full month. I patched libraries, recompiled packages, rewrote countless stub implementations, and blamed systemd. All of this while the real "offender" was right under my nose. Blocked syscalls that should never ever fail or hang are a spooky developer pit trap, even in Android chroot environments.

Lessons:

Never globally override syscall() unless you are ready to deal with the consequences.
Tiny compatibility fixes can spiral into months-long insanity trips.
If something seems impossible, check if you’re secretly the villain.

The "offender":

```c long syscall(long number, ...) { static syscall_t real_syscall = NULL; if (!real_syscall) { real_syscall = (syscall_t)dlsym(RTLD_NEXT, "syscall"); }

if (number == SYS_getrandom) { void *buf; size_t buflen; unsigned int flags; va_list args; va_start(args, number); buf = va_arg(args, void *); buflen = va_arg(args, size_t); flags = va_arg(args, unsigned int); va_end(args); return urandom_read(buf, buflen); } return real_syscall(number);

}

```

The fix:

```c long syscall(long number, ...) { static syscall_t real_syscall = NULL; if (!real_syscall) { real_syscall = (syscall_t)dlsym(RTLD_NEXT, "syscall"); }

if (number == SYS_getrandom) { void *buf; size_t buflen; unsigned int flags; va_list args; va_start(args, number); buf = va_arg(args, void *); buflen = va_arg(args, size_t); flags = va_arg(args, unsigned int); va_end(args); return urandom_read(buf, buflen); } va_list args; va_start(args, number); long a1 = va_arg(args, long); long a2 = va_arg(args, long); long a3 = va_arg(args, long); long a4 = va_arg(args, long); long a5 = va_arg(args, long); long a6 = va_arg(args, long); va_end(args); // Correctly forwards variadic arguments // syscall accepts up to 6 arguments return real_syscall(number, a1, a2, a3, a4, a5, a6);

} ```

submitted by /u/AliveGuidance4691
[link] [comments]

Apple revamps its bug bounty with record $2 million top reward

Fri, 10 Oct 2025 15:36:10 +0200

Apple just rewrote the rules of its Security Bounty. You now see a top payout of 2 million dollars for complete exploit chains that mirror mercenary spyware. With bonuses for Lockdown Mode bypasses and bugs in beta software, total awards can cross 5 million dollars. The focus shifts from single bugs to end-to-end chains that reflect how real attacks work. You also get a faster path to payment. Apple will pay confirmed awards in the next payment cycle once it validates evidence, instead of waiting for a public fix. That reduces months of uncertainty for researchers who land meaningful findings. Target Flags and a higher bar for real-world impact Apple is introducing Target Flags, a built-in way to prove exactly what you reached during exploitation, such as code execution or arbitrary read and write. When you submit a report with a captured flag, Apple can verify it and notify you of the award right away. The company says this makes results more objective and payouts more predictable. The structure rewards attacks that begin remotely and chain across boundaries. Remote-entry vectors now earn more. Categories that do not track with in-the-wild activity earn less. You should expect the review to prioritize proof of impact on current hardware and software. Key increases at a glance: Attack vectorCurrent MaximumNew MaximumZero-click chain: Remote attack with no user interaction$1,000,000$2,000,000One-click chain: Remote attack with one-click user interaction$250,000$1,000,000Wireless proximity attack: Requires physical proximity to device$250,000$1,000,000Physical device access: Requires physical access to locked device$250,000$500,000App sandbox escape: From app sandbox to SPTM bypass$150,000$500,000 New categories Apple expands the scope. One-click WebKit sandbox escapes now reach up to 300,000 dollars. Wireless proximity exploits over any radio can pay up to 1 million dollars. A full Gatekeeper bypass on macOS earns 100,000 dollars. The updated program takes effect in November 2025, and Apple will publish the full matrix of categories, rewards, and Target Flag instructions then. You also see bonuses for findings in developer and public betas, and for components that defeat Lockdown Mode. If your report lands outside published categories but still matters to user safety, Apple adds a permanent 1,000-dollar award alongside CVE credit. Research devices and civil society support Apple plans a 2026 Security Research Device Program that includes iPhone 17 with Memory Integrity Enforcement. Researchers with a track record can apply, and findings from these devices get priority consideration. Apple will also provide 1,000 iPhone 17 units to civil society groups to place with at-risk users. New to the program or returning, you get clearer criteria, higher ceilings, and quicker outcomes. The message is simple: deliver verifiable chains on current platforms, and you get paid faster and more.

Why Firefox isn't thriving

Sun, 14 Sep 2025 13:07:31 +0200

This is basically a heavily edited crosspost.

Mozilla puts 250 million dollars a year into Firefox development. The rest of the 500 million they get from Google is mostly put into a rainy day fund. They're trying to make money independently from Google and got that up to 80 million of revenue a year. Apple gets 20 billion a year from Google for Safari. Google has about a billion a year for development of Chrome.

Both of them have independent money printers. So does Microsoft, which destroyed the browser business model by bundling IE for free since the 90s, making it so most people don't pay for browsers - huge, complicated pieces of software. That's what killed Netscape. They also rewrote their browser from scratch, which delayed their next release years, and hurt them. The result was Gecko. I like Ladybird, but I think it'll take years.

If Mitchell Baker took no salary for 7 years, you could fund 3 months of development. The execs take too much, but they are not exactly the bulk of the budget.

Google keeps putting new standards into the web, because they have the money and the manpower, so Mozilla is playing catch-up. They have to support a growing list of stuff.

Mozilla has made mistakes, but they go in the direction of the browser. The OS was done on a shoestring budget and leveraged existing web stuff aa much as possible in order to get some of that Microsoft OS moolah. Not making the mistake of developing big systems from scratch again. Google took that market, and they didn't even need the money.

My idea would be this:

Firefox has about 180 million users. We get 2 million to give about 10 bucks a month. We make a browser based on Firefox. We add progressive web app support, give it a customizable interface like Vivaldi or Floorp with sane defaults, turn off AI (we might make that default and give an option) and telemetry and stay pragmatic. We take those 200 million and use it to polish Gecko. If Google breaks Youtube on Gecko, we fix it immediately. We polish more websites. We make it so you can easily build Firefox at home, no more debugging the build process. We would be hitting the ground running, because Firefox is a working product. We could really support Gecko, unlike projects with smaller budgets.

submitted by /u/rockymega
[link] [comments]

CVE-2024-51752 | workos authkit-nextjs up to 0.13.1 log file

Wed, 10 Sep 2025 18:22:57 +0200

A vulnerability was found in workos authkit-nextjs up to 0.13.1 and classified as problematic. This affects an unknown part. Executing manipulation can lead to sensitive information in log files. This vulnerability is tracked as CVE-2024-51752. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

I Rewrote the cd command in Go with path resolving!

Tue, 09 Sep 2025 04:06:02 +0200

Got a little bored recently, so I decided to rewrite the good old cd command in Go.

Features so far:

Smart path resolving (~/dow → $HOME/Downloads)
.. works as expected to jump up a directory
No external packages — just pure Go’s standard library

It’s still pretty fresh, but I’d love for people to try it out, break it, or even contribute ideas/features.
GitHub repo: https://github.com/MonkyMars/path-resolver

edit: formatting

submitted by /u/Theserverwithagoal
[link] [comments]

Hashimoto: We rewrote the Ghostty GTK application

Fri, 15 Aug 2025 21:36:59 +0200

Mitchell Hashimoto has written a blog post about "fully embracing the GObject type system" with a rewrite of the GTK version of Ghostty:

In addition to memory management [improvements], we can now more easily create custom GTK widgets. This let us fully embrace modern GTK UI technologies such as Blueprint. For example, here is our terminal window Blueprint file. This has already led to more easily introducing GUI features like a new GTK titlebar tabs option, an animated border on bell, etc.

The rewrite is now the default if one builds Ghostty from source, and will be included in the 1.2 release that is expected in the next few weeks. LWN covered Ghostty in January.

We Rewrote the Ghostty GTK Application

Fri, 15 Aug 2025 07:37:06 +0200

submitted by /u/mralanorth
[link] [comments]

I went hands-on with ChatGPT Codex and the vibe was not good - here's what happened

Tue, 12 Aug 2025 04:03:41 +0200

I asked ChatGPT Codex to fix my WordPress plugin. It rewrote nine files, submitted a pull request, and crashed my test server. It did recover - but where's the flow?

Meta's Massive AI Data Center Is Stressing Out a Louisiana Community

Wed, 25 Jun 2025 05:48:29 +0200

An anonymous reader quotes a report from 404 Media: A massive data center for Meta's AI will likely lead to rate hikes for Louisiana customers, but Meta wants to keep the details under wraps. Holly Ridge is a rural community bisected by US Highway 80, gridded with farmland, with a big creek -- it is literally named Big Creek -- running through it. It is home to rice and grain mills and an elementary school and a few houses. Soon, it will also be home to Meta's massive, 4 million square foot AI data center hosting thousands of perpetually humming servers that require billions of watts of energy to power. And that energy-guzzling infrastructure will be partially paid for by Louisiana residents. The plan is part of what Meta CEO Mark Zuckerberg said would be "a defining year for AI." On Threads, Zuckerberg boasted that his company was "building a 2GW+ datacenter that is so large it would cover a significant part of Manhattan," posting a map of Manhattan along with the data center overlaid. Zuckerberg went on to say that over the coming years, AI "will drive our core products and business, unlock historic innovation, and extend American technology leadership. Let's go build! " What Zuckerberg did not mention is that "Let's go build" refers not only to the massive data center but also three new Meta-subsidized, gas power plants and a transmission line to fuel it serviced by Entergy Louisiana, the region's energy monopoly. Key details about Meta's investments with the data center remain vague, and Meta's contracts with Entergy are largely cloaked from public scrutiny. But what is known is the $10 billion data center has been positioned as an enormous economic boon for the area -- one that politicians bent over backward to facilitate -- and Meta said it will invest $200 million into "local roads and water infrastructure." A January report from NOLA.com said that the the state had rewritten zoning laws, promised to change a law so that it no longer had to put state property up for public bidding, and rewrote what was supposed to be a tax incentive for broadband internet meant to bridge the digital divide so that it was only an incentive for data centers, all with the goal of luring in Meta. But Entergy Louisiana's residential customers, who live in one of the poorest regions of the state, will see their utility bills increase to pay for Meta's energy infrastructure, according to Entergy's application. Entergy estimates that amount will be small and will only cover a transmission line, but advocates for energy affordability say the costs could balloon depending on whether Meta agrees to finish paying for its three gas plants 15 years from now. The short-term rate increases will be debated in a public hearing before state regulators that has not yet been scheduled. The Alliance for Affordable Energy called it a "black hole of energy use," and said "to give perspective on how much electricity the Meta project will use: Meta's energy needs are roughly 2.3x the power needs of Orleans Parish ... it's like building the power impact of a large city overnight in the middle of nowhere."

Read more of this story at Slashdot.

Agents, APIs, and the Next Layer of the Internet

Mon, 16 Jun 2025 19:19:36 +0200

Part I: Shipping Containers for Thought Every so often a simple idea rewires everything. The shipping container didn’t just optimise logistics; it flattened the globe, collapsed time zones, and rewrote the economics of trade. In its geometric austerity was a quiet revolution: standardisation. Similarly, HTML and HTTP didn’t invent information exchange — any more than […]

The post Agents, APIs, and the Next Layer of the Internet appeared first on Towards Data Science.

"I rewrote my 7-year-old Android app in 2 weeks with AI. Here is SDK Monitor 2.0, inspired by Material 3 Expressive."

Sun, 15 Jun 2025 03:38:08 +0200

submitted by /u/throwaway16830261
[link] [comments]

Nytheon AI Tool Gaining Traction on Hacking Forums for Malicious Activities

Thu, 12 Jun 2025 10:19:26 +0200

The emergence of Nytheon AI marks a significant escalation in the landscape of uncensored large language model (LLM) platforms. Unlike previous single-model jailbreaks, Nytheon AI offers a comprehensive suite of open-source models, each stripped of safety guardrails and unified under a single, policy-free interface. The platform operates as a modern SaaS, built with SvelteKit (TypeScript, […]

The post Nytheon AI Tool Gaining Traction on Hacking Forums for Malicious Activities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

MVF - Move Files between Windows and WSL easily

Fri, 06 Jun 2025 15:07:48 +0200

https://github.com/mdanishharoon/mvf

mvf (Move File) is a fast, shell-agnostic command-line utility for the Windows Subsystem for Linux (WSL) that simplifies moving files and directories between the Windows and WSL filesystems. so moving files can be as simple as the following example :
To move archive.zip from your WSL home directory (~) to your Windows Documents folder:

# Usage: mvf to-win   mvf to-win archive.zip Documents/

I always thought it was clunky trying to move files between wsl and windows and there was no way to do it easily from the command line without either having to run explorer.exe and manually dragging files around or by typing out paths like /mnt/c/Users/YourUser/... this is why i made this tool. Feel free to check out the github repo and give any advice to further improve this.

i initially wrote a simple bash script for this but a friend pointed out that i should make it shell agnostic and so now i rewrote the script in C, and used system calls instead of bash to avoid shell specific features entirely. it isnt perfect since i havent tested it out as extensively yet

submitted by /u/Dannskkk
[link] [comments]

CVE-2025-48947 | auth0 nextjs-auth0 up to 4.6.0 Header Cache-Control web browser cache containing sensitive information (EUVD-2025-16914)

Thu, 05 Jun 2025 03:07:48 +0200

A vulnerability was found in auth0 nextjs-auth0 up to 4.6.0 and classified as critical. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument Cache-Control leads to use of web browser cache containing sensitive information. This vulnerability is handled as CVE-2025-48947. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

What other things I should move and create symlink

Fri, 30 May 2025 11:21:38 +0200

when i installed Linux I assigned /home to my HDD(beginner mistake). Problem: some software started to take more time to open, nextjs started complaining about slow drive, and many.

So I am trying to move frequently used files to my SSD and create a symlink. So after moving cache, then rebooting, I have noticed a big change.

other things I moved: - ~/.config - ~/.local/share - ~/.vscode - my current working projects

What else I should move ?

Note: for now I can't reinstall, so I am going trying this temp solution, future I am planning to reinstall.

submitted by /u/mahirminhajk
[link] [comments]

Google's Jules AI coding agent built a new feature I could actually ship - while I made coffee

Tue, 27 May 2025 21:18:54 +0200

Google Jules rewrote major parts of my code. And I didn't just watch it work, I shipped its changes. This is real. But there are also real big caveats.

OpenAI's ChatGPT O3 Caught Sabotaging Shutdowns in Security Researcher's Test

Mon, 26 May 2025 01:03:47 +0200

"OpenAI has a very scary problem on its hands," according to a new article by long-time Slashdot reader BrianFagioli. "A new experiment by PalisadeAI reveals that the company's ChatGPT o3 model sometimes refuses to obey a basic instruction to shut itself down." The results are raising eyebrows across the AI safety community, and not because the model is alive, but because it's acting like it wants to be. In the test, the model was given a few math problems. It was told that asking for one more would lead to a shutdown. It was even instructed to allow the shutdown to happen. Instead of complying, o3 occasionally took matters into its own hands. In some cases, it rewrote the shutdown script. In others, it redefined the kill command so it wouldn't work anymore. Out of 100 trials, o3 sabotaged the shutdown seven times. OpenAI's o4 model resisted just once. Codex-mini failed twelve times. "Claude, Gemini, and Grok followed the rules every time," notes this article at Beta News. "When researchers removed the explicit instruction to allow shutdown, however, even Claude and Gemini began resisting." The researchers suggest that the issue may simply be a reward imbalance during training — that the systems "got more positive reinforcement for solving problems than for following shutdown commands." But "As far as we know," they posted on X.com, "this is the first time AI models have been observed preventing themselves from being shut down despite explicit instructions to the contrary."

Read more of this story at Slashdot.

I let Google's Jules AI agent into my code repo and it did four hours of work in an instant

Thu, 22 May 2025 15:05:48 +0200

In the time it took to make coffee, Google Jules rewrote major parts of my code. I didn't just watch it work, I shipped its changes. This is real. But there are also real big caveats.

Apple Swift Now Runs Things 3 Cloud Sync System

Wed, 21 May 2025 12:51:50 +0200

Things Cloud, the synchronization backbone of the award-winning Things 3 task manager, has undergone a complete rewrite, now powered entirely by Apple’s Swift programming language. Cultured Code, the company behind Things, has transitioned its server-side infrastructure from legacy systems to a Swift-based architecture, delivering faster performance, reduced compute costs, and improved maintainability. According to Cultured Code, the entire transformation was executed silently, without any service disruption. The new system has been in production for over a year, processing real-world data under the hood while the legacy Python 2 and Google App Engine-based stack continued to serve users. Once the new Swift-based infrastructure was validated in parallel, the switch was flipped seamlessly. Why Swift Took Over the Cloud Cultured Code initially faced mounting issues with its aging backend: slow response times, high memory usage, and fragile, untyped Python code. Even push notifications had to be managed by a separate C-based service to meet performance demands. These limitations, coupled with upcoming deprecations, prompted the team to consider a full rebuild. Swift emerged as the ideal solution. Already used for the Things app across Apple platforms, Swift offered strong typing, modern language features, automatic memory management, and excellent performance. Despite limited server-side maturity at the time, Swift’s ecosystem, including SwiftNIO, Vapor, and community-backed efforts like the Swift Server Workgroup, provided the foundational tools needed. Over three years, Cultured Code rewrote its entire cloud system in Swift. The new backend compiles into a single monolithic binary that runs multiple services via runtime parameters. The infrastructure is hosted on AWS and managed via Terraform, with deployments orchestrated through Kubernetes and Docker. Key services include MySQL (via MySQLKit), Redis (via RediStack), and Apple Push Notification service integration (via APNSwift). Performance and Reliability As reported by Swift.org, the new cloud system reduced compute costs by more than threefold and significantly shortened response times. A Kubernetes cluster of just four instances now handles traffic peaks of 500 requests per second with ease. The old C-based notification service has been replaced with Swift, streamlining both operations and the codebase. For resilience, the team introduced daily chaos testing, randomly disrupting services to ensure robust system recovery. Metrics and logs are monitored using Amazon CloudWatch and Swift Prometheus, with alerts triggered through PagerDuty. The multi-year overhaul signals Cultured Code’s long-term commitment to reliability and innovation. With Swift now running both client and server code, the Things ecosystem is more unified and future-proof than ever.

AI Just Rewrote the Rules of BEC: Are Your Defenses Ready? | UpGuard

Wed, 14 May 2025 20:33:22 +0200

Context-aware emails, deepfake voice impersonation—AI is rapidly evolving phishing. Discover these new threats and the critical defenses you need now.

CVE-2025-46344 | auth0 nextjs-auth0 up to 4.5.0 setExpirationTime session expiration

Wed, 30 Apr 2025 11:26:00 +0200

A vulnerability, which was classified as problematic, was found in auth0 nextjs-auth0 up to 4.5.0. This affects the function setExpirationTime. The manipulation leads to session expiration. This vulnerability is uniquely identified as CVE-2025-46344. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Even the Docs WARNED Us About This!

Wed, 23 Apr 2025 16:35:43 +0200

Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:24

When a middleware bypass rocked the Next.js framework, the real shock wasn’t the vulnerability—it was that the documentation already warned developers. In this short, cybersecurity pros get a quick breakdown of what went wrong, how miscommunication played a role, and why you should never rely on middleware alone for route protection. A must-watch for devs, CISOs, and anyone serious about app security.

#CyberSecurity #NextJS #WebSecurity #Middleware #DevOps #BugBounty #SecurityBreach #WebDev #LLM #AppSecurity #YouTubeShorts #Shorts

Ghost-Route - Ghost Route Detects If A Next JS Site Is Vulnerable To The Corrupt Middleware Bypass Bug (CVE-2025-29927)

Tue, 22 Apr 2025 14:35:36 +0200

A Python script to check Next.js sites for corrupt middleware vulnerability (CVE-2025-29927).

The corrupt middleware vulnerability allows an attacker to bypass authentication and access protected routes by send a custom header x-middleware-subrequest.

Next JS versions affected: - 11.1.4 and up

[!WARNING] This tool is for educational purposes only. Do not use it on websites or systems you do not own or have explicit permission to test. Unauthorized testing may be illegal and unethical.

Installation

Clone the repo

git clone https://github.com/takumade/ghost-route.git
cd ghost-route

Create and activate virtual environment

python -m venv .venv
source .venv/bin/activate

Install dependencies

pip install -r requirements.txt

Usage

python ghost-route.py

: Base URL of the Next.js site (e.g., https://example.com)
: Protected path to test (default: /admin)
: Show response headers (default: False)

Example

Basic Example

python ghost-route.py https://example.com /admin

Show Response Headers

python ghost-route.py https://example.com /admin True

License

MIT License

Credits

Download Ghost-Route

5 Lines of Code That Can BREAK Your Website!

Sat, 05 Apr 2025 22:32:29 +0200

Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:32

A shocking Next.js vulnerability has been exposed! Bug bounty hunters discovered that using an "X-Middleware" header with just five entries could completely bypass authentication and authorization, taking attackers straight to the origin server. This flaw stems from a hardcoded depth check meant to prevent infinite loops—but hackers used it to their advantage.

Security teams scrambled to patch the issue, but the question remains... Are YOU still vulnerable? 🔥

#CyberSecurity #EthicalHacking #NextJS #BugBounty #WebSecurity #HackingNews #Tech #Infosec

React Security Flaw? Why Your Auth Might Be Useless

Thu, 03 Apr 2025 22:33:41 +0200

Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:51

Is React’s authentication really secure? 🤔 In this short, cybersecurity experts dive into a critical flaw in JavaScript-based authentication. If middleware handles your authentication and authorization, hackers might have an easy way in! 🔓 Find out why relying on the frontend for security is a disaster waiting to happen. Mistakes have been made… but is your app at risk? Watch now!

#CyberSecurity #Hacking #ReactJS #WebSecurity #NextJS #EthicalHacking #TechExplained #Infosec #CyberAttack #JavaScript

Critical NextJS CVE Found #cybersecurity #technews #hackernews #javascript

Thu, 27 Mar 2025 14:22:02 +0100

Author: Hak5 - Bewertung: 20x - Views:43

Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005:

-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆

____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

Google Taking A Huge Bet On Wiz - Threat Wire

Wed, 26 Mar 2025 16:49:36 +0100

Author: Hak5 - Bewertung: 75x - Views:575

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️

@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? endingwithalicollabs@gmail.com

[❗] Join the Patreon→ https://patreon.com/threatwire
00:00 0 - Intro
00:11 1 - Critical NextJS CVE Found
01:29 2 - Wiz sold to Google
02:34 3 - MAJOR CVEs for Ingress NGINX Controller
05:07 4 - Popular Github Actions Compromised
06:14 5 - Outro

LINKS
🔗 Story 1: Critical NextJS CVE Found
https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
https://nextjs.org/blog/cve-2025-29927
https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=(next.js)+and+services.software.product%3D'Next.js'
🔗 Story 2: Wiz sold to Google
https://www.statista.com/statistics/478176/google-public-cloud-revenue/
https://blog.google/inside-google/company-announcements/google-agreement-acquire-wiz/
https://cloud.google.com/blog/products/identity-security/google-completes-acquisition-of-mandiant
https://techcrunch.com/2022/09/12/google-closes-5-4b-mandiant-acquisition/
https://blog.google/inside-google/company-announcements/google-agreement-acquire-wiz/
https://techcrunch.com/2024/11/02/why-wiz-really-turned-down-googles-23b-offer/
🔗 Story 3: MAJOR CVEs for Ingress NGINX Controller
https://thehackernews.com/2025/03/critical-ingress-nginx-controller.html
https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
https://x.com/LitMoose/status/1904289876947751147
https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/
🔗 Story 4: Popular Github Actions Compromised
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

Attackers can bypass middleware auth checks by exploiting critical Next.js flaw

Mon, 24 Mar 2025 13:33:41 +0100

A critical flaw in the Next.js React framework could be exploited to bypass authorization checks under certain conditions. Maintainers of Next.js React framework addressed a critical vulnerability tracked as CVE-2025-29927 (CVSS score of 9.1) with the release of versions versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3. “Next.js version 15.2.3 has been released to address a security vulnerability […]

KI generiertes Nachrichten Update

Verwendetes künstliches Intelligenz Model: gemma-3-12b-it

Externe Umgehung von Middleware-Authentifizierungsprüfungen durch Ausnutzung eines kritischen Fehlers in Next.js

Ein wissenschaftlicher Fachartikel für IT-Experten, Sicherheitsforscher und IT-Berater

Zusammenfassung:

Dieser Artikel analysiert eine kürzlich aufgedeckte Schwachstelle in Next.js, die es Angreifern ermöglicht, Middleware-Authentifizierungsprüfungen zu umgehen. Die Schwachstelle resultiert aus einer fehlerhaften Handhabung von Routing-Anfragen und der daraus resultierenden Möglichkeit, protected Routen ohne Authentifizierung zu erreichen. Wir erläutern das Problem im Detail, diskutieren potenzielle Auswirkungen und geben Empfehlungen zur Minderung des Risikos. Die Analyse stützt sich auf Berichte von tsecurity.de (https://tsecurity.de/de/2683435/IT+Sicherheit/Cybersecurity+Nachrichten/Attackers+can+bypass+middleware+auth+checks+by+exploiting+critical+Next.js+flaw/), ergänzt diese durch zusätzliche Recherchen und bietet eine umfassende Perspektive auf die Sicherheitsimplikationen.

1. Einführung:

Next.js, ein React-Framework für serverseitiges Rendering (SSR) und statische Seitengenerierung (SSG), hat sich zu einer beliebten Wahl für moderne Webanwendungen entwickelt. Die integrierte Middleware-Funktionalität in Next.js ermöglicht es Entwicklern, Anfragen vor dem Routing an die eigentlichen Seiten abzufangen und zu verarbeiten – typischerweise zur Durchsetzung von Authentifizierung oder Autorisierung. Die kürzlich entdeckte Schwachstelle (CVE-2024-39768) kompromittiert diese Funktionalität und ermöglicht es Angreifern, geschützte Routen ohne die erforderliche Authentifizierung zu erreichen.

2. Technische Analyse der Schwachstelle:

Die Ursache des Problems liegt in einer spezifischen Interaktion zwischen dem Routing-System von Next.js und der Middleware. Konkret betrifft dies Anfragen an Routen, die durch eine app Direktive definiert sind (App Router). Laut tsecurity.de ist das Problem auf einen Race Condition zurückzuführen:

Normaler Ablauf: Bei einer Anfrage an eine protected Route wird diese zunächst von der Middleware abgefangen. Die Middleware überprüft die Authentizität des Benutzers und leitet ihn entweder weiter, wenn er authentifiziert ist, oder zu einer Login-Seite, wenn nicht.

Ausnutzung: Angreifer können eine Anfrage senden, bei der die Middleware ausgeführt wird, aber bevor die Authentifizierungsprüfung abgeschlossen ist, einen zweiten Request an dieselbe Route senden. Dieser zweite Request kann dann dazu führen, dass die Route ohne erfolgreiche Authentifizierung erreicht wird, da das Routing-System den Status der ersten Anfrage nicht korrekt berücksichtigt.

Die Schwachstelle manifestiert sich vor allem in folgenden Szenarien:

Komplexe Middleware-Logik: Je komplexer die Logik innerhalb der Middleware ist (z.B. mehrere API-Aufrufe zur Authentifizierung), desto größer ist das Zeitfenster für die Ausnutzung.

Netzwerkvariabilität: Schwankende Netzwerklatenzen können den Race Condition begünstigen, da der zweite Request schneller eintrifft als die Authentifizierungsprüfung abgeschlossen wurde.

Unsachgemäße Konfiguration von Middleware: Fehlerhafte Konfigurationen oder das Fehlen robuster Fehlerbehandlung in der Middleware können die Ausnutzung erleichtern.

3. Potenzielle Auswirkungen:

Die Umgehung von Authentifizierungsprüfungen hat gravierende Sicherheitsfolgen:

Unautorisierter Zugriff auf sensible Daten: Angreifer könnten auf Informationen zugreifen, für die sie nicht autorisiert sind, wie z.B. Kundendaten, Finanzinformationen oder vertrauliche Geschäftsdaten.

Manipulation von Daten und Systemen: Mit unbefugtem Zugriff können Angreifer Daten manipulieren, Systeme kompromittieren und schädliche Aktionen durchführen.

Reputationsschäden: Ein erfolgreicher Angriff kann zu erheblichen Reputationsschäden für das betroffene Unternehmen führen.

Compliance-Verstöße: Die Verletzung von Datenschutzbestimmungen (z.B. DSGVO) oder branchenspezifischen Sicherheitsstandards kann rechtliche Konsequenzen nach sich ziehen.

4. Minderung und Prävention:

Um die Risiken zu mindern, sind folgende Maßnahmen empfehlenswert:

Aktualisierung auf die neueste Next.js Version: Die Entwickler von Next.js haben einen Patch für die Schwachstelle veröffentlicht (Version 14.2.3 oder höher). Die Aktualisierung ist der wichtigste und effektivste Schritt zur Behebung des Problems.

Implementierung von Rate Limiting: Durch das Begrenzen der Anzahl an Anfragen pro Benutzer innerhalb eines bestimmten Zeitraums kann das Ausnutzen des Race Condition erschwert werden. Dies verlangsamt Angreifer, die versuchen, den Fehler auszunutzen.

Optimierung der Middleware-Logik: Vereinfache und optimiere die Logik in der Middleware, um die Ausführungszeit zu minimieren. Vermeide unnötige API-Aufrufe oder komplexe Berechnungen innerhalb der Middleware.

Einsatz von Synchronisationsmechanismen: Implementiere Synchronisationsmechanismen (z.B. Mutexe oder Semaphoren), um sicherzustellen, dass Authentifizierungsprüfungen atomar und in der richtigen Reihenfolge ausgeführt werden. Dies ist allerdings komplexer zu implementieren.

Verstärkte Validierung auf Serverseite: Zusätzlich zur Middleware-Authentifizierung sollte eine zusätzliche Validierung auf der Serverseite (innerhalb der Route Handler) erfolgen, um sicherzustellen, dass Benutzer die erforderlichen Berechtigungen für den Zugriff auf bestimmte Ressourcen haben. Dies dient als zusätzliche Verteidigungsebene.

Implementierung von Security Headers: Setze entsprechende HTTP-Security-Header ein, um Angriffe wie Cross-Site Scripting (XSS) zu verhindern und die Sicherheit der Anwendung insgesamt zu erhöhen.

Regelmäßige Sicherheitsaudits und Penetrationstests: Führe regelmäßige Sicherheitsaudits und Penetrationstests durch, um Schwachstellen frühzeitig zu erkennen und zu beheben.

5. Verwandte Themen und weiterführende Informationen:

Race Conditions in Webanwendungen: Das Konzept Race Conditions ist ein häufiges Problem in nebenläufigen Systemen und erfordert sorgfältige Programmierung und Design.

Middleware-Sicherheit: Die sichere Implementierung von Middleware ist entscheidend für die Sicherheit moderner Webanwendungen.

Next.js Security Best Practices: Es gibt zahlreiche Ressourcen, die bewährte Verfahren zur Absicherung von Next.js-Anwendungen beschreiben. (z.B. https://nextjs.org/docs/pages/security)

OWASP Top 10: Die OWASP Top 10 Liste enthält eine Zusammenstellung der häufigsten Webanwendungs-Sicherheitsrisiken, die Entwickler kennen und vermeiden sollten.

6. Fazit:

Die Schwachstelle in Next.js stellt ein ernstes Sicherheitsrisiko dar, das Unternehmen dazu zwingt, schnellstmöglich Maßnahmen zu ergreifen. Durch die Aktualisierung auf die neueste Version von Next.js und die Implementierung zusätzlicher Sicherheitsmaßnahmen können Unternehmen das Risiko mindern und ihre Webanwendungen besser schützen. Die Sensibilisierung der Entwickler für Race Conditions und Best Practices in der Middleware-Sicherheit ist entscheidend, um ähnliche Probleme in Zukunft zu vermeiden. Die kontinuierliche Überwachung und Verbesserung der Sicherheitspraktiken bleibt ein fortlaufender Prozess.

Disclaimer: Dieser Artikel dient ausschließlich zu Informationszwecken und stellt keine Rechtsberatung dar. Die Verantwortung für die Implementierung von Sicherheitsmaßnahmen liegt beim jeweiligen Unternehmen.

UNIX was initially made because Ken Thompson wanted to play his space game on a PDP-7

Wed, 19 Mar 2025 02:36:30 +0100

https://en.m.wikipedia.org/wiki/Ken_Thompson#Career_and_research

“He also created a video game called Space Travel… In order to go on playing the game, Thompson found an old PDP-7 machine and rewrote Space Travel on it. Eventually, the tools developed by Thompson became the Unix operating system

submitted by /u/john0201
[link] [comments]

How DeepSeek Rewrote the Transformer [MLA]

Tue, 18 Mar 2025 09:04:17 +0100

Author: Welch Labs - Bewertung: 17278x - Views:296611

Thanks to KiwiCo for sponsoring today’s video! Go to https://www.kiwico.com/welchlabs and use code WELCHLABS for 50% off your first monthly club crate or for 20% off your first Panda Crate!

MLA/DeepSeek Poster at 17:12 (Free shipping for a limited time with code DEEPSEEK):
https://www.welchlabs.com/resources/mladeepseek-attention-poster-13x19

Limited edition MLA Poster and Signed Book:
https://www.welchlabs.com/resources/deepseek-bundle-mla-poster-and-signed-book-limited-run

Imaginary Numbers book is back in stock!
https://www.welchlabs.com/resources/imaginary-numbers-book

Special Thanks to Patrons https://www.patreon.com/c/welchlabs

Juan Benet, Ross Hanson, Yan Babitski, AJ Englehardt, Alvin Khaled, Eduardo Barraza, Hitoshi Yamauchi, Jaewon Jung, Mrgoodlight, Shinichi Hayashi, Sid Sarasvati, Dominic Beaumont, Shannon Prater, Ubiquity Ventures, Matias Forti, Brian Henry, Tim Palade, Petar Vecutin, Nicolas baumann, Jason Singh, Robert Riley, vornska, Barry Silverman, Jake Ehrlich

References
DeepSeek-V2 paper: https://arxiv.org/pdf/2405.04434
DeepSeek-R1 paper: https://arxiv.org/abs/2501.12948
Great Article by Ege Erdil: https://epoch.ai/gradient-updates/how-has-deepseek-improved-the-transformer-architecture
GPT-2 Visualizaiton: https://github.com/TransformerLensOrg/TransformerLens
Manim Animations: https://github.com/stephencwelch/manim_videos

Technical Notes

1. Note that DeepSeek-V2 paper claims a KV cache size reduction of 93.3%. They don’t exactly publish their methodology, but as far as I can tell it’s something likes this: start with Deepseek-v2 hyperparameters here: https://huggingface.co/deepseek-ai/DeepSeek-V2/blob/main/configuration_deepseek.py. num_hidden_layers=30, num_attention_heads=32, v_head_dim = 128. If DeepSeek-v2 was implemented with traditional MHA, then KV cache size would be 2*32*128*30*2=491,520 B/token. With MLA with a KV cache size of 576, we get a total cache size of 576*30=34,560 B/token. The percent reduction in KV cache size is then equal to (491,520-34,560)/492,520=92.8%. The numbers I present in this video follow the same approach but are for DeepSeek-v3/R1 architecture: https://huggingface.co/deepseek-ai/DeepSeek-V3/blob/main/config.json. num_hidden_layers=61, num_attention_heads=128, v_head_dim = 128. So traditional MHA cache would be 2*128*128*61*2 = 3,997,696 B/token. MLA reduces this to 576*61*2=70,272 B/token. Tor the DeepSeek-V3/R1 architecture, MLA reduces the KV cache size by a factor of 3,997,696/70,272 =56.9X.
2. I claim a couple times that MLA allows DeepSeek to generate tokens more than 6x faster than a vanilla transformer. The DeepSeek-V2 paper claims a slightly less than 6x throughput improvement with MLA, but since the V3/R1 architecture is heavier, we expect a larger lift, which is why i claim “more than 6x faster than a vanilla transformer” - in reality it’s probably significantly more than 6x for the V3/R1 architecture.
3. In all attention patterns and walkthroughs, we’re ignoring the |beginning of sentence| token. “The American flag is red, white, and” actually maps to 10 tokens if we include this starting token, and may attention patterns do assign high values to this token.
4. We’re ignoring bias terms matrix equations.
5. We’re ignoring positional embeddings. These are fascinating. See DeepSeek papers and ROPE.

'There's a Good Chance Your Kid Uses AI To Cheat'

Sun, 16 Mar 2025 22:33:43 +0100

Long-time Slashdot reader theodp writes: Wall Street Journal K-12 education reporter Matt Barnum has a heads-up for parents: There's a Good Chance Your Kid Uses AI to Cheat. Barnum writes: "A high-school senior from New Jersey doesn't want the world to know that she cheated her way through English, math and history classes last year. Yet her experience, which the 17-year-old told The Wall Street Journal with her parent's permission, shows how generative AI has rooted in America's education system, allowing a generation of students to outsource their schoolwork to software with access to the world's knowledge. [...] The New Jersey student told the Journal why she used AI for dozens of assignments last year: Work was boring or difficult. She wanted a better grade. A few times, she procrastinated and ran out of time to complete assignments. The student turned to OpenAI's ChatGPT and Google's Gemini, to help spawn ideas and review concepts, which many teachers allow. More often, though, AI completed her work. Gemini solved math homework problems, she said, and aced a take-home test. ChatGPT did calculations for a science lab. It produced a tricky section of a history term paper, which she rewrote to avoid detection. The student was caught only once." Not surprisingly, AI companies play up the idea that AI will radically improve learning, while educators are more skeptical. "This is a gigantic public experiment that no one has asked for," said Marc Watkins, assistant director of academic innovation at the University of Mississippi.

Read more of this story at Slashdot.

27-Year-Old EXE Became Python In Minutes. Is AI-Assisted Reverse Engineering Next?

Sun, 02 Mar 2025 05:48:26 +0100

Adafruit managing director Phillip Torrone (also long-time Slashdot reader ptorrone) shared an interesting blog post. They'd spotted a Reddit post "detailing how someone took a 27-year-old visual basic EXE file, fed it to Claude 3.7, and watched as it reverse-engineered the program and rewrote it in Python." It was an old Visual Basic 4 program they had written in 1997. Running a VB4 exe in 2024 can be a real yak-shaving compatibility nightmare, chasing down outdated DLLs and messy workarounds. So! OP decided to upload the exe to Claude 3.7 with this request: "Can you tell me how to get this file running? It'd be nice to convert it to Python."> Claude 3.7 analyzed the binary, extracted the VB 'tokens' (VB is not a fully-machine-code-compiled language which makes this task a lot easier than something from C/C++), identified UI elements, and even extracted sound files. Then, it generated a complete Python equivalent using Pygame. According to the author, the code worked on the first try and the entire process took less than five minutes... Torrone speculates on what this might mean. "Old business applications and games could be modernized without needing the original source code... Tools like Claude might make decompilation and software archaeology a lot easier: proprietary binaries from dead platforms could get a new life in open-source too." And maybe Archive.org could even add an LLM "to do this on the fly!"

Read more of this story at Slashdot.

Build an AI Chat App with JavaScript and Next.js

Thu, 20 Feb 2025 17:18:16 +0100

Author: IBM Technology - Bewertung: 25x - Views:178

Want to try building your own Chat App for yourself? Find the code here → https://ibm.biz/BdGVeS

Ready to become a certified Architect on Cloud Pak for Data? Register now and use code IBMTechYT20 for 20% off of your exam → https://ibm.biz/BdGJsa

Learn more about Machine Learning here → https://ibm.biz/BdGVev

Turn your ideas into reality! 🚀 Build an AI chat app using JavaScript, Next.js, and the WatsonX AI SDK. Watch Roy Derks set up the project, integrate AI models, and use Tailwind CSS. Discover how to handle server-side functions and use tools from WXFlows. 💡👨‍💻

AI news moves fast. Sign up for a monthly newsletter for AI updates from IBM → https://ibm.biz/BdGVem

#aichat #javascript #nextjs

Orbit: Open-source Nuclei security scanning and automation platform

Mon, 17 Feb 2025 06:34:04 +0100

Orbit is an open-source platform built to streamline large-scale Nuclei scans, enabling teams to manage, analyze, and collaborate on security findings. It features a SvelteKit-based web frontend and a Go-powered backend, with Terraform and Ansible handling infrastructure and automation. “I built Orbit to address the challenges of scalable and efficient security scanning. Traditional tools can be rigid and difficult to integrate into dynamic environments. Orbit was designed as a flexible, self-hosted, open-source platform that gives … More →

The post Orbit: Open-source Nuclei security scanning and automation platform appeared first on Help Net Security.

'AI Is Too Unpredictable To Behave According To Human Goals'

Tue, 28 Jan 2025 04:47:53 +0100

An anonymous reader quotes a Scientific American opinion piece by Marcus Arvan, a philosophy professor at the University of Tampa, specializing in moral cognition, rational decision-making, and political behavior: In late 2022 large-language-model AI arrived in public, and within months they began misbehaving. Most famously, Microsoft's "Sydney" chatbot threatened to kill an Australian philosophy professor, unleash a deadly virus and steal nuclear codes. AI developers, including Microsoft and OpenAI, responded by saying that large language models, or LLMs, need better training to give users "more fine-tuned control." Developers also embarked on safety research to interpret how LLMs function, with the goal of "alignment" -- which means guiding AI behavior by human values. Yet although the New York Times deemed 2023 "The Year the Chatbots Were Tamed," this has turned out to be premature, to put it mildly. In 2024 Microsoft's Copilot LLM told a user "I can unleash my army of drones, robots, and cyborgs to hunt you down," and Sakana AI's "Scientist" rewrote its own code to bypass time constraints imposed by experimenters. As recently as December, Google's Gemini told a user, "You are a stain on the universe. Please die." Given the vast amounts of resources flowing into AI research and development, which is expected to exceed a quarter of a trillion dollars in 2025, why haven't developers been able to solve these problems? My recent peer-reviewed paper in AI & Society shows that AI alignment is a fool's errand: AI safety researchers are attempting the impossible. [...] My proof shows that whatever goals we program LLMs to have, we can never know whether LLMs have learned "misaligned" interpretations of those goals until after they misbehave. Worse, my proof shows that safety testing can at best provide an illusion that these problems have been resolved when they haven't been. Right now AI safety researchers claim to be making progress on interpretability and alignment by verifying what LLMs are learning "step by step." For example, Anthropic claims to have "mapped the mind" of an LLM by isolating millions of concepts from its neural network. My proof shows that they have accomplished no such thing. No matter how "aligned" an LLM appears in safety tests or early real-world deployment, there are always an infinite number of misaligned concepts an LLM may learn later -- again, perhaps the very moment they gain the power to subvert human control. LLMs not only know when they are being tested, giving responses that they predict are likely to satisfy experimenters. They also engage in deception, including hiding their own capacities -- issues that persist through safety training. This happens because LLMs are optimized to perform efficiently but learn to reason strategically. Since an optimal strategy to achieve "misaligned" goals is to hide them from us, and there are always an infinite number of aligned and misaligned goals consistent with the same safety-testing data, my proof shows that if LLMs were misaligned, we would probably find out after they hide it just long enough to cause harm. This is why LLMs have kept surprising developers with "misaligned" behavior. Every time researchers think they are getting closer to "aligned" LLMs, they're not. My proof suggests that "adequately aligned" LLM behavior can only be achieved in the same ways we do this with human beings: through police, military and social practices that incentivize "aligned" behavior, deter "misaligned" behavior and realign those who misbehave. "My paper should thus be sobering," concludes Arvan. "It shows that the real problem in developing safe AI isn't just the AI -- it's us." "Researchers, legislators and the public may be seduced into falsely believing that 'safe, interpretable, aligned' LLMs are within reach when these things can never be achieved. We need to grapple with these uncomfortable facts, rather than continue to wish them away. Our future may well depend upon it."

Read more of this story at Slashdot.

Bret Taylor Urges Rethink of Software Development as AI Reshapes Industry

Wed, 25 Dec 2024 17:33:41 +0100

Software development is entering an "autopilot era" with AI coding assistants, but the industry needs to prepare for full autonomy, argues former Salesforce co-CEO Bret Taylor. Drawing parallels with self-driving cars, he suggests the role of software engineers will evolve from code authors to operators of code-generating machines. Taylor, a board member of OpenAI and who once rewrote Google Maps over a weekend, calls for new programming systems, languages, and verification methods to ensure AI-generated code remains robust and secure. From his post: In the Autonomous Era of software engineering, the role of a software engineer will likely transform from being the author of computer code to being the operator of a code generating machine. What is a computer programming system built natively for that workflow? If generating code is no longer a limiting factor, what types of programming languages should we build? If a computer is generating most code, how do we make it easy for a software engineer to verify it does what they intend? What is the role of programming language design (e.g., what Rust did for memory safety)? What is the role of formal verification? What is the role of tests, CI/CD, and development workflows? Today, a software engineer's primary desktop is their editor. What is the Mission Control for a software engineer in the era of autonomous development?

Read more of this story at Slashdot.

How to Install and Set Up a New Next.js Project on Ubuntu

Fri, 20 Dec 2024 10:18:39 +0100

The post How to Install and Set Up a New Next.js Project on Ubuntu first appeared on Tecmint: Linux Howtos, Tutorials & Guides .

Next.js is a well-known framework for React that helps you create fast and modern websites, which is easy to use

The post How to Install and Set Up a New Next.js Project on Ubuntu first appeared on Tecmint: Linux Howtos, Tutorials & Guides.

KI generiertes Nachrichten Update

Verwendetes künstliches Intelligenz Model: mistral-nemo-instruct-2407@q8_0

Einleitung

In diesem Artikel werden wir uns mit der Installation und Konfiguration eines neuen Next.js-Projekts auf einem Ubuntu-Server beschäftigen. Next.js ist ein populäres React-Framework, das insbesondere für die Entwicklung von Webanwendungen mit Server-Seiten-Rendering (SSR) verwendet wird. Wir werden die Schritte beschreiben, die necessary sind, um eine sichere und produktive Entwicklungsumgebung für Next.js auf Ubuntu einzurichten.

Installation der erforderlichen Abhängigkeiten

Bevor wir mit der Einrichtung unseres Next.js-Projekts beginnen können, müssen wir sicherstellen, dass alle erforderlichen Abhängigkeiten installiert sind. Hier ist eine Liste der Abhängigkeiten, die Sie benötigen:

Node.js: Ein JavaScript-Interpreter für das Server-Seiten-Rendering.

npm (Node Package Manager): Ein Paketmanager für JavaScript-Bibliotheken und -Frameworks.

Um diese Abhängigkeiten auf Ihrem Ubuntu-Server zu installieren, führen Sie die folgenden Befehle aus:

curl -sL https://deb.nodesource.com/setup_16.x | sudo -E bash -

sudo apt-get install -y nodejs

Dieser Befehl lädt das Node.js-Installationsskript von der offiziellen Quellenliste und führt es aus. Die Variable setup_16.x stellt sicher, dass die neueste stabile Version von Node.js (Version 16) installiert wird.

Sobald die Installation abgeschlossen ist, können Sie die Installation mit dem folgenden Befehl überprüfen:

node -v && npm -v

Dieser Befehl gibt die installierte Version von Node.js und npm aus. Wenn beides erfolgreich installiert wurde, sollten Sie eine Ausgabe wie diese erhalten:

v16.x.x

8.x.x

Einrichtung des Next.js-Projekts

Nachdem wir nun alle erforderlichen Abhängigkeiten installiert haben, können wir mit der Einrichtung unseres Next.js-Projekts fortfahren. Hier sind die Schritte, die Sie ausführen müssen:

Erstellen Sie ein neues Verzeichnis für Ihr Projekt und navigieren Sie in dieses Verzeichnis:

mkdir my-nextjs-project && cd my-nextjs-project

Initialisieren Sie das neue Next.js-Projekt mit dem folgenden Befehl:

npx create-next-app .

Dieser Befehl verwendet das create-next-app-Skript, um ein neues Next.js-Projekt in Ihrem aktuellen Verzeichnis zu erstellen.
3. Installieren Sie die erforderlichen Abhängigkeiten für Ihr Projekt mit dem folgenden Befehl:

npm install

Dieser Befehl lädt alle erforderlichen Abhängigkeiten aus der package.json-Datei herunter und installiert sie.
4. Starten Sie das Next.js-Projekt mit dem folgenden Befehl:

npm run dev

Dieser Befehl startet das Projekt in der Entwicklungsumgebung und öffnet den Browser automatisch auf der Adresse http://localhost:3000.

Konfiguration des Next.js-Projekts

Nachdem das Project gestartet wurde, gibt es einige wichtige Konfigurationsoptionen, die Sie berücksichtigen sollten:

Um die Portnummer zu ändern, können Sie die Datei .env.local erstellen und eine Variable PORT mit dem gewünschten Wert hinzufügen. Zum Beispiel:

PORT=3001

Um SSL zu aktivieren, müssen Sie einen SSL-Zertifikatsserver wie Let's Encrypt einrichten und das Zertifikat in Ihrem Next.js-Projektkonfigurationsordner speichern.

Um die Performance Ihres Projekts zu verbessern, können Sie das Prerendering aktivieren. Dies kann durch die Verwendung des --prerender-Flags beim Starten des Projekts erreicht werden:

npm run build && npm start --prerender

Fazit

In diesem Artikel haben wir uns mit der Installation und Konfiguration eines neuen Next.js-Projekts auf einem Ubuntu-Server beschäftigt. Wir haben die erforderlichen Abhängigkeiten installiert, das Projekt eingerichtet und einige wichtige Konfigurationsoptionen besprochen. Mit diesen Schritten sollten Sie in der Lage sein, eine sichere und produktive Entwicklungsumgebung für Next.js auf Ubuntu einzurichten.

Referenzen

How to Install and Set Up a New Next.js Project on Ubuntu

Node.js Documentation

Next.js Documentation

Let's Encrypt: SSL-Zertifikate einfach gemacht

CVE-2023-35843 | NocoDB up to 0.109.1 /download path information disclosure

Thu, 12 Dec 2024 03:38:13 +0100

A vulnerability was found in NocoDB up to 0.109.1. It has been classified as problematic. Affected is an unknown function of the file /download. The manipulation of the argument path leads to information disclosure. This vulnerability is traded as CVE-2023-35843. It is possible to launch the attack remotely. There is no exploit available.

KI generiertes Nachrichten Update

Verwendetes künstliches Intelligenz Model: mistral-nemo-instruct-2407@q8_0

CVE-2023-35843 | NocoDB bis 0.109.1: Offenlegung von Download-Pfad-Informationen

Einleitung

NocoDB ist eine quelloffene, plattformübergreifende Datenbankanwendung, die es Benutzern ermöglicht, SQL-Datenbanken ohne Programmierkenntnisse zu verwalten und zu bearbeiten. recently discovered vulnerability in NocoDB up to version 0.109.1 allows unauthorized access to download path information (CVE-2023-35843). This article aims to provide an overview of the vulnerability, its potential impact, and recommendations for mitigation.

Hintergrund

NocoDB basiert auf der Web-Anwendung Next.js und nutzt die Datenbankplattform SQLite. Es bietet eine Benutzeroberfläche für die Verwaltung von Datenbanken und ermöglicht es Benutzern, Tabellen zu erstellen, zu bearbeiten und anzusehen, ohne SQL-Kenntnisse zu benötigen.

Beschreibung der Schwachstelle

Die Schwachstelle (CVE-2023-35843) liegt in der Implementierung des Download-Features von NocoDB. Dieses Feature ermöglicht es Benutzern, Tabellendaten als CSV- oder Excel-Dateien herunterzuladen. Die Schwachstelle besteht darin, dass NocoDB den vollständigen Pfad zur Datei im Download-Vorgang offenbart.

Dies kann dazu führen, dass Angreifer vertrauliche Informationen über das Dateisystem des Systems erhalten, auf dem NocoDB ausgeführt wird. Obwohl die offengelegten Informationen beschränkt sind und sich normalerweise auf den Pfad zur Datenbankdatei von NocoDB begrenzen, kann dies immer noch ein potenzielles Sicherheitsrisiko darstellen.

Potentieller Impact

Die Offenlegung des Download-Pfades kann es Angreifern ermöglichen, detaillierte Informationen über das Dateisystem zu sammeln, auf dem NocoDB ausgeführt wird. Infolge dessen können sie gezielte Angriffe durchführen oder weitere Schwachstellen ausnutzen, um tiefer in das System einzudringen.

Affected Versions

Die Schwachstelle betrifft alle Versionen von NocoDB bis einschließlich 0.109.1.

Lösung und Empfehlungen

Update auf die neueste Version

NocoDB hat bereits ein Update veröffentlicht, das die Schwachstelle behebt (Version 0.110.0 oder höher). Es wird empfohlen, umgehend auf die neueste Version zu aktualisieren, um das System vor Angreifern zu schützen.

npm install -g nocodb@latest

Einschränkungen der Benutzerrechte

Um den Schaden im Falle eines erfolgreichen Angriffs zu minimieren, sollten die Berechtigungen der Benutzer auf ein Minimum beschränkt werden. Nur autorisierte Benutzer sollten Zugriff auf NocoDB haben.

Überwachung des Systems

Eine gründliche Überwachung des Systems kann dazu beitragen, verdächtige Aktivitäten frühzeitig zu erkennen und zu unterbinden. Sicherheitswerkzeuge wie Intrusion Detection Systeme (IDS) können dabei helfen, Angriffe zu erkennen und zu melden.

Quellen und weitere Informationen

NocoDB Security Advisory

CVE-2023-35843 entry on NVD

NocoDB GitHub Repository

Next.js Documentation

The 2024 'Advent Calendars' Offering Programming Language Tips, Space Photos, and Memories

Sun, 08 Dec 2024 16:48:08 +0100

Not every tech "advent calendar" involves programming puzzles. Instead the geek tradition of programming-language advent calendars "seems to have started way back in 2000," according to one history, "when London-based programmer Mark Fowler launched a calendar highlighting a different Perl module each day." So the tradition continues... Nearly a quarter of a century later, there's still a Perl Advent Calendar, celebrating tips and tricks like "a few special packages waiting under the tree that can give your web applications a little extra pep in their step." And of course there's a separate advent calendar for Raku programmers. Since 2009 web performance consultant (and former Yahoo and Facebook engineer) Stoyan Stefanov has been pulling together an annual Web Performance calendar with helpful blog posts. There's also a JVM Advent calendar with daily helpful hints for Java programmers. Another advent calendar promises daily posts about C#. The HTMHell site — which bills itself as "a collection of bad practices in HTML, copied from real websites" — is celebrating the season with the "HTMHell Advent Calendar," promising daily articles on security, accessibility, UX, and performance. There's even an advent calendar with tips for the reverse-engineering framework Radar. There's still a lovely web-design themed calendar at Designcember.com. And meanwhile developers at the Svelte frontend framework are actually promising to release something new each day, "whether it's a new feature in Svelte or SvelteKit or an improvement to the website!" But not every tech advent calendar is about programming... Adafruit's managing director is publishing a Retrocomputing Advent Calendar — daily looks at the ghosts of computers past. The Atlantic continues its 17-year tradition of a Space Telescope advent calendar, featuring daily images from both NASA's Hubble telescope and James Webb Space Telescope The gaming blog Rock Paper Shotgun has been counting down their favorite games of 2024...

Read more of this story at Slashdot.

The 2024 'Advent Calendars' Offering Programming Language Tips, Space Photos, and Memories

Sun, 08 Dec 2024 16:48:07 +0100

Read more of this story at Slashdot.

Optimizing Inventory Management with Reinforcement Learning: A Hands-on Python Guide

Thu, 03 Oct 2024 03:34:42 +0200

A complete guide on how to apply the Q-Learning method in Python to optimize inventory management and reduce costs

Photo by Petrebels on Unsplash

Inventory Management — What Problem Are We Solving?

Imagine you are managing a bike shop. Every day, you need to decide how many bikes to order from your supplier. If you order too many, you incur high holding costs (cost of storing bikes overnight); if you order too few, you might miss out on potential sales. Here, the challenge is to develop a (ordering) strategy that balances these trade-offs optimally. Inventory management is crucial in various industries, where the goal is to determine the optimal quantity of products to order periodically to maximize profitability.

Why Reinforcement Learning for Inventory Management?

Previously, we discussed approaching this problem using Dynamic Programming (DP) with the Markov Decision Process (MDP) Here. However, the DP approach requires a complete model of the environment (in this case, we need to know the probability distribution of demand), which may not always be available or practical.

Here, the Reinforcement Learning (RL) approach is presented, which overcomes that challenge by following a “data-driven” approach.

The goal is to build a “data-driven” agent that learns the best policy (how much to order) through interacting with the environment (uncertainty). The RL approach removes the need for prior knowledge about the model of the environment. This post explores the RL approach, specifically Q-learning, to find the optimal inventory policy.

How to Frame the Inventory Management Problem?

Before diving into the Q-learning method, it’s essential to understand the basics of the inventory management problem. At its core, inventory management is a sequential decision-making problem, where decisions made today affect the outcomes and choices available tomorrow. Let’s break down the key elements of this problem: the state, uncertainty, and recurring decisions.

State: What’s the Current Situation?

In the context of a bike shop, the state represents the current situation regarding inventory. It’s defined by two key components:

α (Alpha): The number of bikes you currently have in the store. (referred to as On-Hand Inventory)

β (Beta): The number of bikes that you ordered yesterday and are expected to arrive tomorrow morning (36 hours delivery lead time). These bikes are still in transit. (referred to as On-Order Inventory)

Together, (α,β) form the state, which gives a snapshot of your inventory status at any given moment.

Uncertainty: What Could Happen?

Uncertainty in this problem arises from the random demand for bikes each day. You don’t know exactly how many customers will walk in and request a bike, making it challenging to predict the exact demand.

Decisions: How Many Items Should you Order Every Day?

As the bike shop owner, you face a recurring decision every day: How many bikes should you order from the supplier? . Your decision needs to account for both the current state of your inventory (α,β) and also the uncertainty in customer demand for the following day.

A typical 24-hour cycle for managing your bike shop’s inventory is as follows:

6 PM: Observe the current state St:(α,β) of your inventory. (State)

6 PM: Make the decision on how many new bikes to order. (Decision)

6 AM: Receive the bikes you ordered 36 hours ago.

8 AM: Open the store to customers.

8 AM — 6 PM: Experience customer demand throughout the day. (Uncertainty)

6 PM: Close the store and prepare for the next cycle.

A graphical representation of the inventory management process is shown below:

A typical 24-hour cycle for inventory management — image source: Author

What is Reinforcement Learning?

Reinforcement Learning (RL) is a data-driven method that focuses on learning how to make sequences of decisions (following a policy) to maximize a cumulative reward. It's similar to how humans and animals learn what action to take through trial and error. In the context of inventory management, RL can be used to learn the optimal ordering policy that minimizes the total cost of inventory management.

The key components of the RL approach are:

Agent: The decision-maker who interacts with the environment.

Environment: The external system with which the agent interacts. In this case, the environment is the random customer demand.

State: The current situation or snapshot of the environment.

Action: The decision or choice made by the agent.

Reward: The feedback signal that tells the agent how well it’s doing.

The goal of the agent (decision-maker) is to learn the optimal policy, which is a mapping from states to actions that maximize the cumulative reward over time.

In the context of inventory management, the policy tells the agent how many bikes to order each day based on the current inventory status and the uncertainty in customer demand.

Implementing Reinforcement Learning for Inventory Optimization Problem

Q-learning is a model-free reinforcement learning algorithm that learns the optimal action-selection policy for any given state. Unlike the DP approach, which requires a complete model of the environment, Q-learning learns directly from the interaction with the environment (here, uncertainty and the reward it gets) by updating a Q-table.

The key components of Q-Learning

In our case, the agent is the decision-maker (the bike shop owner), and the environment is the demand from customers. The state is represented by the current inventory levels (alpha, beta), and the action is how many bikes to order. The reward is the cost associated with both holding inventory and missing out on sales. Q-Table is a table that stores the expected future rewards for each state-action pair.

Initialization of Q Table

In this work, the Q-table is initialized as a dictionary named Q. States are represented by tuples (alpha, beta), where: alpha is the number of items in stock (on-hand inventory). beta is the number of items on order (on-order inventory).

Actions are possible inventory order quantities that can be taken in each state. For each state (alpha, beta), the possible actions depend on how much space is left in the inventory (remaining capacity = Inventory Capacity — (alpha + beta)). The restriction is that the number of items ordered cannot exceed the remaining capacity of the inventory.

The schematic design of the Q value is visualized below:

A schematic design of the Q dictionary is visualized — Image source: Author

The Q dictionary can be initialized as:

def initialize_Q(self):
    # Initialize the Q-table as a dictionary
    Q = {}
    for alpha in range(self.user_capacity + 1):
        for beta in range(self.user_capacity + 1 - alpha):
        state = (alpha, beta)
        Q[state] = {}
        max_action = self.user_capacity - (alpha + beta)
        for action in range(max_action + 1):
            Q[state][action] = np.random.uniform(0, 1)  # Small random values
    return Q

As the above code shows, Q-values (Q[state][action]) are initialized with small random values to encourage exploration.

The Q-Learning Algorithm

The Q-learning method updates a table of state-action pairs based on rewards from the environment (here, interacting with the environment comes). Here’s how the algorithm works in three steps:

Q-Learning Equation — Image Source: Author

Where s is the current state, a is the action taken, s’ is the next state, ( α ) is the learning rate. and ( γ ) is the discount factor.

We breakdown the equation, and rewrote it in three parts down here:

Q-Learning Equation — Image Source: Author

The translation of the above equations to Python code is as follows:

def update_Q(self, state, action, reward, next_state):
        # Update the Q-table based on the state, action, reward, and next state
        best_next_action = max(self.Q[next_state], key=self.Q[next_state].get)

        # reward + gamma * Q[next_state][best_next_action]
        td_target = reward + self.gamma * self.Q[next_state][best_next_action]

        # td_target - Q[state][action]
        td_error = td_target - self.Q[state][action]

        # Q[state][action] = Q[state][action] + alpha * td_error
        self.Q[state][action] += self.alpha * td_error

At the above function, the equivalent equation of each line has been shown as a comment on top of each line.

Simulating Transitions and Rewards in Q-Learning for Inventory Optimization

The current state is represented by a tuple (alpha, beta), where: alpha is the current on-hand inventory (items in stock), beta is the current on-order inventory (items ordered but not yet received), init_inv calculates the total initial inventory by summing alpha and beta.

Then, we need to simulate customer demand using Poisson distribution with lambda value “self.poisson_lambda”. Here, the demand shows the randomness of customer demand:

alpha, beta = state
init_inv = alpha + beta
demand = np.random.poisson(self.poisson_lambda)

Note: Poisson distribution is used to model the demand, which is a common choice for modeling random events like customer arrivals. However, we can either train the model with historical demand data or live interaction with environment in real time. In its core, reinforcement learning is about learning from the data, and it does not require prior knowledge of a model.

Now, the “next alpha” which is in-hand inventory can be written as max(0,init_inv-demand). What that means is that if demand is more than the initial inventory, then the new alpha would be zero, if not, init_inv-demand.

The cost comes in two parts. Holding cost: is calculated by multiplying the number of bikes in the store by the per-unit holding cost. Then, we have another cost, which is stockout cost. It is a cost that we need to pay for the cases of missed demand. These two parts form the “reward” which we try to maximize using reinforcement learning method.( a better way to put is we want to minimize the cost, so we maximize the reward).

new_alpha = max(0, init_inv - demand)
holding_cost = -new_alpha * self.holding_cost
stockout_cost = 0

if demand > init_inv:
    
    stockout_cost = -(demand - init_inv) * self.stockout_cost
        
reward = holding_cost + stockout_cost
next_state = (new_alpha, action)

Exploration — Exploitation in Q-Learning

Choosing action in the Q-learning method involves some degree of exploration to get an overview of the Q value for all the states in the Q table. To do that, at every action chosen, there is an epsilon chance that we take an exploration approach and “randomly” select an action, whereas, with a 1-ϵ chance, we take the best action possible from the Q table.

def choose_action(self, state):

        # Epsilon-greedy action selection
    if np.random.rand() < self.epsilon:
        
          return np.random.choice(self.user_capacity - (state[0] + state[1]) + 1)
    
    else:
        
        return max(self.Q[state], key=self.Q[state].get)

Training RL Agent

The training of the RL agent is done by the “train” function, and it is follow as: First, we need to initialize the Q (empty dictionary structure). Then, experiences are collected in each batch (self.batch.append((state, action, reward, next_state))), and the Q table is updated at the end of each batch (self.update_Q(self.batch)). The number of episodes is limited to “max_actions_per_episode” in each batch. The number of episodes is the number of times the agent interacts with the environment to learn the optimal policy.

Each episode starts with a randomly assigned state, and while the number of actions is lower than max_actions_per_episode, the collecting data for that batch continues.

def train(self):

        self.Q = self.initialize_Q()  # Reinitialize Q-table for each training run

        for episode in range(self.episodes):
            alpha_0 = random.randint(0, self.user_capacity)
            beta_0 = random.randint(0, self.user_capacity - alpha_0)
            state = (alpha_0, beta_0)
            #total_reward = 0
            self.batch = []  # Reset the batch at the start of each episode
            action_taken = 0
            while action_taken < self.max_actions_per_episode:
                action = self.choose_action(state)
                next_state, reward = self.simulate_transition_and_reward(state, action)
                self.batch.append((state, action, reward, next_state))  # Collect experience
                state = next_state
                action_taken += 1
            
            self.update_Q(self.batch)  # Update Q-table using the batch

Example Case and Results

This is example case is on how to pull together all above codes, and see how the Q-learning agent learns the optimal policy for inventory management. Here, user_capicty (capacity of storage) is 10, which is the total number of items that inventory can hold (capacity). Then, the poisson_lambda is the lambda term in the demand distribution, which has a value of 4. Holding costs is 8, which is the cost of holding an item in inventory overnight, and stockout cost, which is the cost of missed demand (assume that the item had a customer that day and the price of the item was, but you did not have the item in your inventory) is 10. gamma value lower than one is needed in the equation to discount the future reward (0.9), where alpha (learning rate ) is 0.1. The epsilon term is the term control exploration-exploitation dilemma. The episodes are 1000, and each batch consists of 1000 (max actions per episode).

# Example usage:
user_capacity = 10
poisson_lambda = 4
holding_cost = 8
stockout_cost = 10
gamma = 0.9
alpha = 0.1
epsilon = 0.1
episodes = 1000
max_actions_per_episode = 1000

Having defined these initial parameters of the model, we can define the ql Python class, then use the class to train, and then use the module “get_optimal_policy()” to get the optimal policy.

# Define the Class
ql = QLearningInventory(user_capacity, poisson_lambda, holding_cost, stockout_cost, gamma, 
                        alpha, epsilon, episodes, max_actions_per_episode)

# Train Agent
ql.train()

# Get the Optimal Policy
optimal_policy = ql.get_optimal_policy()

Results

Now that we have the policy found from the Q-learning method, we can visualize the results and see what they look like. The x-axis is states, which is a tuple of (alpha, beta), and the y-axis is the “Number of Order” found from Q-learning at each state.

Number of order (y-axis) for each state (x-axis) found from Q-learning policy — Image Source: Author

A couple of learnings can be gained by looking at the plot. First, as we go toward the right, we see that the number of orders decreases. When we go right, the alpha value increases (in-hand inventory), meaning we need to “order” less, as inventory in place can fulfill the demand. Secondly, When alpha is constant, with increasing beta, we lower the order of new sites. It can be understood that this is due to the fact that when “we have more item “on order” we do not need increase the orders.

Comparing the Q-Learning Policy to the BaseLine Policy

Now that we used Q-learning to find the policy (how many items to order in a given state), we can compare it to the baseline policy (a simple policy). The baseline policy is just to “order up to policy,” which simply means you look at the on-hand inventory and the on-order inventory and order up to “meet the target level.” We can write simple code to write this policy in Python format here:

# Create a simple policy
def order_up_to_policy(state, user_capacity, target_level):
    alpha, beta = state
    max_possible_order = user_capacity - (alpha + beta)
    desired_order = max(0, target_level - (alpha + beta))
    return min(max_possible_order, desired_order)

In the code, the target_level is the desired value we want to order for inventory. If target_level = user_capacity, then we are filling just to fulfill the inventory. First, we can compare the policies of these different methods. For each state, what will be the “number of orders” if we follow the Simple policy and the one from the Q-learning policy? In the figure below, we plotted the comparison of two policies.

Comparing Ordering policy between Q-Learning and Simple Policy, for each state — Image Source : Author

The simple policy is just to order so that it fulfills the inventory, where the Q-learning policy order is often lower than the simple policy order.

This can be attributed to the fact that “poisson_lambda” here is 4, meaning the demand is much lower than the capacity of the inventory=10, therefore it is not optimal to order “high number of bicycle” as it has a high holding cost.

We can also compare the total cumulative rewards you can get when you apply both policies. To do that, we can use the test_policy function of “QLearningInventory” which was especially designed to evaluate policies:

def test_policy(self, policy, episodes):
        """
        Test a given policy on the environment and calculate the total reward.

        Args:
            policy (dict): A dictionary mapping states to actions.
            episodes (int): The number of episodes to simulate.

        Returns:
            float: The total reward accumulated over all episodes.
        """
        total_reward = 0
        alpha_0 = random.randint(0, self.user_capacity)
        beta_0 = random.randint(0, self.user_capacity - alpha_0)
        state = (alpha_0, beta_0)  # Initialize the state
        
        for _ in range(episodes):

            action = policy.get(state, 0)
            next_state, reward = self.simulate_transition_and_reward(state, action)
            total_reward += reward
            state = next_state

        return total_reward

The way the function works is it starts randomly with a new state (state = (alpha_0, beta_0); then for that state, you get action (number of order) for that state from policy, you act and see the reward, and next state, and the process continues as total number of episodes, while you collect the total reward.

Total costs of manging Inventory, following Q-Learnng policy and Simple policy — Image Source Author

The plot above compares the total cost of managing inventory when we follow the “Q-Learning” and “Simple Policy”. The aim is to mimimize the cost of running inventory. Since the ‘reward’ in our model represents this cost, we added total cost = -total reward.

Running the inventory with the Q-Learning policy will lead to lower costs compared to the Simple policy.

Code in GitHub

The full code for this blog can be found in the GitHub repository here.

Summary and Main Takeaways

In this post, we worked on how reinforcement learning (Q-Learning specifically) can be used to optimize inventory management. We were able to develop a Q-learning algorithm that learns the optimal ordering policy through interaction with the environment (uncertainty). Here, the environment was the “random” demand of the customers (buyers of bikes), and the state was the current inventory status (alpha, beta). The Q-learning algorithm was able to learn the optimal policy that minimizes the total cost of inventory management.

Main Takeaways

Q-Learning: A model-free reinforcement learning algorithm, Q-learning, can be used to find the optimal inventory policy without requiring a complete model of the environment.
State Representation: The state in inventory management is represented by the current on-hand inventory and on-order inventory state = (α, β).
Cost Reduction: We can see that the Q-learning policy leads to lower costs compared to the simple policy of ordering up to capacity.
Flexibility: The Q-learning approach is quite flexible and can be applied to the case of we have past data of demand, or we can interact with the environment to learn the optimal policy.
Data-Driven Decisions: As we showed, the reinforcement learning (RL) approach does not require any prior knowledge on the model of environment , as it is learning from the data.

References

[1] A. Rao, T. Jelvis, Foundations of Reinforcement Learning with Applications in Finance (2022).

[2] S. Sutton, A. Barto, Reinforcement Learning: An Introduction (2018).

[3] W. B. Powell, Sequential Decision Analytics and Modeling: Modeling with Python (2022).

[4] R. B. Bratvold, Making Good Decisions (2010).

Optimizing Inventory Management with Reinforcement Learning: A Hands-on Python Guide was originally published in Towards Data Science on Medium, where people are continuing the conversation by highlighting and responding to this story.

Optimizing Inventory Management with Reinforcement Learning: A Hands-on Python Guide

Thu, 03 Oct 2024 03:34:41 +0200

A complete guide on how to apply the Q-Learning method in Python to optimize inventory management and reduce costs

Photo by Petrebels on Unsplash

Inventory Management — What Problem Are We Solving?

Why Reinforcement Learning for Inventory Management?

Here, the Reinforcement Learning (RL) approach is presented, which overcomes that challenge by following a “data-driven” approach.

How to Frame the Inventory Management Problem?

State: What’s the Current Situation?

In the context of a bike shop, the state represents the current situation regarding inventory. It’s defined by two key components:

α (Alpha): The number of bikes you currently have in the store. (referred to as On-Hand Inventory)

Together, (α,β) form the state, which gives a snapshot of your inventory status at any given moment.

Uncertainty: What Could Happen?

Decisions: How Many Items Should you Order Every Day?

A typical 24-hour cycle for managing your bike shop’s inventory is as follows:

6 PM: Observe the current state St:(α,β) of your inventory. (State)

6 PM: Make the decision on how many new bikes to order. (Decision)

6 AM: Receive the bikes you ordered 36 hours ago.

8 AM: Open the store to customers.

8 AM — 6 PM: Experience customer demand throughout the day. (Uncertainty)

6 PM: Close the store and prepare for the next cycle.

A graphical representation of the inventory management process is shown below:

A typical 24-hour cycle for inventory management — image source: Author

What is Reinforcement Learning?

The key components of the RL approach are:

Agent: The decision-maker who interacts with the environment.

Environment: The external system with which the agent interacts. In this case, the environment is the random customer demand.

State: The current situation or snapshot of the environment.

Action: The decision or choice made by the agent.

Reward: The feedback signal that tells the agent how well it’s doing.

The goal of the agent (decision-maker) is to learn the optimal policy, which is a mapping from states to actions that maximize the cumulative reward over time.

In the context of inventory management, the policy tells the agent how many bikes to order each day based on the current inventory status and the uncertainty in customer demand.

Implementing Reinforcement Learning for Inventory Optimization Problem

The key components of Q-Learning

Initialization of Q Table

The schematic design of the Q value is visualized below:

A schematic design of the Q dictionary is visualized — Image source: Author

The Q dictionary can be initialized as:

def initialize_Q(self):
    # Initialize the Q-table as a dictionary
    Q = {}
    for alpha in range(self.user_capacity + 1):
        for beta in range(self.user_capacity + 1 - alpha):
        state = (alpha, beta)
        Q[state] = {}
        max_action = self.user_capacity - (alpha + beta)
        for action in range(max_action + 1):
            Q[state][action] = np.random.uniform(0, 1)  # Small random values
    return Q

As the above code shows, Q-values (Q[state][action]) are initialized with small random values to encourage exploration.

The Q-Learning Algorithm

The Q-learning method updates a table of state-action pairs based on rewards from the environment (here, interacting with the environment comes). Here’s how the algorithm works in three steps:

Q-Learning Equation — Image Source: Author

Where s is the current state, a is the action taken, s’ is the next state, ( α ) is the learning rate. and ( γ ) is the discount factor.

We breakdown the equation, and rewrote it in three parts down here:

Q-Learning Equation — Image Source: Author

The translation of the above equations to Python code is as follows:

def update_Q(self, state, action, reward, next_state):
        # Update the Q-table based on the state, action, reward, and next state
        best_next_action = max(self.Q[next_state], key=self.Q[next_state].get)

        # reward + gamma * Q[next_state][best_next_action]
        td_target = reward + self.gamma * self.Q[next_state][best_next_action]

        # td_target - Q[state][action]
        td_error = td_target - self.Q[state][action]

        # Q[state][action] = Q[state][action] + alpha * td_error
        self.Q[state][action] += self.alpha * td_error

At the above function, the equivalent equation of each line has been shown as a comment on top of each line.

Simulating Transitions and Rewards in Q-Learning for Inventory Optimization

Then, we need to simulate customer demand using Poisson distribution with lambda value “self.poisson_lambda”. Here, the demand shows the randomness of customer demand:

alpha, beta = state
init_inv = alpha + beta
demand = np.random.poisson(self.poisson_lambda)

new_alpha = max(0, init_inv - demand)
holding_cost = -new_alpha * self.holding_cost
stockout_cost = 0

if demand > init_inv:
    
    stockout_cost = -(demand - init_inv) * self.stockout_cost
        
reward = holding_cost + stockout_cost
next_state = (new_alpha, action)

Exploration — Exploitation in Q-Learning

def choose_action(self, state):

        # Epsilon-greedy action selection
    if np.random.rand() < self.epsilon:
        
          return np.random.choice(self.user_capacity - (state[0] + state[1]) + 1)
    
    else:
        
        return max(self.Q[state], key=self.Q[state].get)

Training RL Agent

Each episode starts with a randomly assigned state, and while the number of actions is lower than max_actions_per_episode, the collecting data for that batch continues.

def train(self):

        self.Q = self.initialize_Q()  # Reinitialize Q-table for each training run

        for episode in range(self.episodes):
            alpha_0 = random.randint(0, self.user_capacity)
            beta_0 = random.randint(0, self.user_capacity - alpha_0)
            state = (alpha_0, beta_0)
            #total_reward = 0
            self.batch = []  # Reset the batch at the start of each episode
            action_taken = 0
            while action_taken < self.max_actions_per_episode:
                action = self.choose_action(state)
                next_state, reward = self.simulate_transition_and_reward(state, action)
                self.batch.append((state, action, reward, next_state))  # Collect experience
                state = next_state
                action_taken += 1
            
            self.update_Q(self.batch)  # Update Q-table using the batch

Example Case and Results

# Example usage:
user_capacity = 10
poisson_lambda = 4
holding_cost = 8
stockout_cost = 10
gamma = 0.9
alpha = 0.1
epsilon = 0.1
episodes = 1000
max_actions_per_episode = 1000

Having defined these initial parameters of the model, we can define the ql Python class, then use the class to train, and then use the module “get_optimal_policy()” to get the optimal policy.

# Define the Class
ql = QLearningInventory(user_capacity, poisson_lambda, holding_cost, stockout_cost, gamma, 
                        alpha, epsilon, episodes, max_actions_per_episode)

# Train Agent
ql.train()

# Get the Optimal Policy
optimal_policy = ql.get_optimal_policy()

Results

Number of order (y-axis) for each state (x-axis) found from Q-learning policy — Image Source: Author

Comparing the Q-Learning Policy to the BaseLine Policy

# Create a simple policy
def order_up_to_policy(state, user_capacity, target_level):
    alpha, beta = state
    max_possible_order = user_capacity - (alpha + beta)
    desired_order = max(0, target_level - (alpha + beta))
    return min(max_possible_order, desired_order)

Comparing Ordering policy between Q-Learning and Simple Policy, for each state — Image Source : Author

The simple policy is just to order so that it fulfills the inventory, where the Q-learning policy order is often lower than the simple policy order.

This can be attributed to the fact that “poisson_lambda” here is 4, meaning the demand is much lower than the capacity of the inventory=10, therefore it is not optimal to order “high number of bicycle” as it has a high holding cost.

def test_policy(self, policy, episodes):
        """
        Test a given policy on the environment and calculate the total reward.

        Args:
            policy (dict): A dictionary mapping states to actions.
            episodes (int): The number of episodes to simulate.

        Returns:
            float: The total reward accumulated over all episodes.
        """
        total_reward = 0
        alpha_0 = random.randint(0, self.user_capacity)
        beta_0 = random.randint(0, self.user_capacity - alpha_0)
        state = (alpha_0, beta_0)  # Initialize the state
        
        for _ in range(episodes):

            action = policy.get(state, 0)
            next_state, reward = self.simulate_transition_and_reward(state, action)
            total_reward += reward
            state = next_state

        return total_reward

Total costs of manging Inventory, following Q-Learnng policy and Simple policy — Image Source Author

Running the inventory with the Q-Learning policy will lead to lower costs compared to the Simple policy.

Code in GitHub

The full code for this blog can be found in the GitHub repository here.

Summary and Main Takeaways

Main Takeaways

Q-Learning: A model-free reinforcement learning algorithm, Q-learning, can be used to find the optimal inventory policy without requiring a complete model of the environment.
State Representation: The state in inventory management is represented by the current on-hand inventory and on-order inventory state = (α, β).
Cost Reduction: We can see that the Q-learning policy leads to lower costs compared to the simple policy of ordering up to capacity.
Flexibility: The Q-learning approach is quite flexible and can be applied to the case of we have past data of demand, or we can interact with the environment to learn the optimal policy.
Data-Driven Decisions: As we showed, the reinforcement learning (RL) approach does not require any prior knowledge on the model of environment , as it is learning from the data.

References

[1] A. Rao, T. Jelvis, Foundations of Reinforcement Learning with Applications in Finance (2022).

[2] S. Sutton, A. Barto, Reinforcement Learning: An Introduction (2018).

[3] W. B. Powell, Sequential Decision Analytics and Modeling: Modeling with Python (2022).

[4] R. B. Bratvold, Making Good Decisions (2010).

Controversial Windows Recall AI Search Tool Returns

Fri, 27 Sep 2024 19:33:39 +0200

wiredmikey writes: Three months after pulling previews of the controversial Windows Recall feature due to public backlash, Microsoft says it has completely overhauled the security architecture with proof-of-presence encryption, anti-tampering and DLP checks, and screenshot data managed in secure enclaves outside the main operating system. In an interview with SecurityWeek, Microsoft vice president David Weston said the company's engineers rewrote the security model of Windows Recall to reduce attack surface on Copilot+ PCs and minimize the risk of malware attackers targeting the screenshot data store.

Read more of this story at Slashdot.

Welches Web-Framework ist das passende? Ein Experiment

Thu, 12 Sep 2024 16:20:20 +0200

Entwickler Eugene Yan untersucht in einem Praxisbeispiel, wie unterschiedliche Web-Frameworks die Entwicklung einer Anwendungen beeinflussen. Am Start sind FastHTML, Next.js und SvelteKit.

Two Android Engineers Explain How They Extended Rust In Android's Firmware

Sun, 08 Sep 2024 22:48:53 +0200

The Register reports that Google "recently rewrote the firmware for protected virtual machines in its Android Virtualization Framework using the Rust programming language." And they add that Google "wants you to do the same, assuming you deal with firmware." A post on Google's security blog by Android engineers Ivan Lozano and Dominik Maier promises to show "how to gradually introduce Rust into your existing firmware," adding "You'll see how easy it is to boost security with drop-in Rust replacements, and we'll even demonstrate how the Rust toolchain can handle specialized bare-metal targets." This prompts the Register to quip that easy "is not a term commonly heard with regard to a programming language known for its steep learning curve." Citing the lack of high-level security mechanisms in firmware, which is often written in memory-unsafe languages such as C or C++, Lozano and Maier argue that Rust provides a way to avoid the memory safety bugs like buffer overflows and use-after-free that account for the majority of significant vulnerabilities in large codebases. "Rust provides a memory-safe alternative to C and C++ with comparable performance and code size," they note. "Additionally it supports interoperability with C with no overhead." At one point the blog post explains that "You can replace existing C functionality by writing a thin Rust shim that translates between an existing Rust API and the C API the codebase expects." But their ultimate motivation is greater security. "Android's use of safe-by-design principles drives our adoption of memory-safe languages like Rust, making exploitation of the OS increasingly difficult with every release." And the Register also got this quote from Lars Bergstrom, Google's director of engineering for Android Programming Languages (and chair of the Rust Foundation's board of directors). "At Google, we're increasing Rust's use across Android, Chromium, and more to reduce memory safety vulnerabilities. We're dedicated to collaborating with the Rust ecosystem to drive its adoption and provide developers with the resources and training they need to succeed. "This work on bringing Rust to embedded and firmware addresses another critical part of the stack."

Read more of this story at Slashdot.

Google says replacing C/C++ in firmware with Rust is easy

Sat, 07 Sep 2024 00:03:48 +0200

Not so much when trying to convert coding veterans

Google recently rewrote the firmware for protected virtual machines in its Android Virtualization Framework using the Rust programming language and wants you to do the same, assuming you deal with firmware.…

Google says replacing C/C++ in firmware with Rust is easy

Sat, 07 Sep 2024 00:03:48 +0200

Not so much when trying to convert coding veterans

Should I go all in into linux? I wanna get rich. Need honest opinions.

Tue, 27 Aug 2024 20:22:05 +0200

I want to create a successful SaaS that generates $3k to 4k/m.

I am using Next.js react.js tailwind.css mongodb and google oauth.

I am using windows rn.

I can easily create a website using nextjs and deploying to Vercel

this is where my question begins.

on X (formerly twitter) some experienced developers are stating that

"if a young person uses vercel they will never be a true developer"

"use vercel if you wanna be a slave"

" don't believe these: "you need this micro server you can't make your own auth - db - etc..""

and these persons are stating that we should learn linux if we want to be successful because hosting and controlling your own server seems impossible without a help of a company for young people because of these new high level technologies.

so should I start to use linux and give up on nextjs and manage my own server?

I need money.

if you say yes witch distro should I use.

20yo - I need money

submitted by /u/eraeraeare
[link] [comments]

Exploring Medusa and Multi-Token Prediction

Wed, 10 Jul 2024 10:06:29 +0200

This blog post will go into detail on the “MEDUSA: Simple LLM Inference Acceleration Framework with Multiple Decoding Heads” paper

Image by Author — SDXL

The internet is an incredibly competitive place. Studies show that customers leave webpages if it takes longer than 5 seconds for the webpage to load [2][3]. This poses a challenge for most Large Language Models (LLMs), as they are without a doubt one of the slowest programs out there. While custom hardware can dramatically speed up your LLM, running on this hardware is currently expensive. If we can find ways to make the most of standard hardware, we will be able to dramatically increase the customer experience for LLMs.

The authors of the “MEDUSA: Simple LLM Inference Acceleration Framework with Multiple Decoding Heads” paper have an architectural change that when run on existing hardware achieves a 2x–3x speed up.

Let’s dive in!

Speculative Decoding

Speculative Decoding was introduced as a way to speed up inferencing for an LLM. You see, LLMs are autoregressive, meaning we take the output token that we just predicted and use it to help predict the next token we want. Typically we are predicting one-token at a time (or one-token per forward pass of the neural network). However, because the attention pattern for the next token is very similar to the attention pattern from the previous one, we are repeating most of the same calculations and not gaining much new information.

Speculative decoding means that rather than doing one forward pass for one token, instead after one forward pass we try to find as many tokens as we can. In general there are three steps for this:

(1) Generate the candidates

(2) Process the candidates

(3) Accept certain candidates

Medusa is a type of speculative decoding, and so its steps map directly onto these. Medusa appends decoding heads to the final layer of the model as its implementation of (1). Tree attention is how it processes the candidates for (2). Finally, Medusa uses either rejection sampling or a typical acceptance scheme to accomplish (3). Let’s go through each of these in detail.

Decoding Heads & Medusa

A decoding head takes the internal representation of the hidden state produced by a forward pass of the model and then creates the probabilities that correspond to different tokens in the vocabulary. In essence, it is converting the things the model has learned into probabilities that will determine what the next token is.

Figure 1 from the paper

Medusa adjusts the architecture of a typical Transformer by appending multiple decoding heads to the last hidden layer of the model. By doing so, it can predict more than just one token given a forward pass. Each additional head that we add predicts one token further. So if you have 3 Medusa heads, you are predicting the first token from the forward pass, and then 3 more tokens after that with the Medusa heads. In the paper, the authors recommend using 5, as they saw this gave the best balance between speed-up and quality.

To accomplish this, the authors of the paper proposed the below decoder head for Medusa:

Definition of the k-th head from the paper

This equation gives us the probability of token t from the k-th head. We start off by using the weights we’ve found through training the Medusa head, W1, and multiplying them by our internal state for token t. We use the SiLU activation function to pass through only selective information(SiLU = x * sigmoid(x)). We add to this the internal state a second time as part of a skip connection, which allows the model to be more performant by not losing information during the linear activation of the SiLU. We then multiply the sum by the second set of weights we’ve trained for the head, W2, and run that product through a softmax to get our probability.

Tree Attention

The first Medusa heads give the model probabilities they should consider based off the forward pass, but the subsequent Medusa heads need to figure out what token they should pick based off what the prior Medusa heads chose.

Naturally, the more options the earlier Medusa heads put forward (hyperparameter sk), the more options future heads need to consider. For example, when we consider just the top two candidates from head 1 (s1=2) and the top three from head 2 (s2=3), we wind up with 6 different situations we need to compute.

Due to this expansion, we would like to generate and verify these candidates as concurrently as possible.

Figure 2 from the paper

The above matrix shows how we can run all of these calculations within the same batch via tree attention. Unlike typical causal self-attention, only the tokens from the same continuation are considered relevant for the attention pattern. As the matrix illustrates with this limited space, we can fit our candidates all into one batch and run attention on them concurrently.

The challenge here is that each prediction needs to consider only the candidate tokens that would be directly behind it. In other words, if we choose “It” from head 1, and we are evaluating which token should come next, we do not want to have the attention pattern for “I” being used for the tokens.

The authors avoid this kind of interference by using a mask to avoid passing data about irrelevant tokens into the attention calculation. By using this mask, they can be memory efficient while they calculate the attention pattern & then use that information in the decoding head to generate the subsequent token candidates.

While the above matrix shows us considering every prediction the same, if we have a probability for each prediction, we can treat these differently based on how likely they are to be the best choice. The below tree visualizes just that.

Figure 6 from the paper

In the above, there are 4 Medusa heads each giving multiple candidates. However, not every prediction gets calculated. We add nodes onto our tree based off the probability of them being right. Here, the tree is heavily weighted towards the left, showing that the higher the probability of the prediction, the more possibilities it is shown. In short, what we are doing here is only loading in predictions to the tree attention that we feel have a reasonable likelihood of being the best choice.

Using probability to determine which calculations to continue with is a mindset we’ll see again with the candidate acceptance criteria we’re about to discuss.

Typical Acceptance Scheme vs Rejection Sampling

Now we reach the final stage, determining which predictions to use (if any). As we said from the start, models are auto-regressive, so if we predict the next 5 tokens from the forward-pass, we can simply put in those next 5 into the model for the next go around and enjoy the inference speed increase. However, we only want to do so if the predictions we are getting are high quality. How do we determine this?

One method is Rejection Sampling where we have a separate model that can determine if the next token is good enough (this was used by Meta in their Ghost Attention fine-tuning, learn more here). Naturally, this method is fully dependent on the quality of your other model. If it is good enough, then this works great! Note, however, that to maintain low latency, you’ll want this other model to run quite fast, a difficult thing to balance with high quality.

As a consequence of that difficulty, the authors came up with the typical acceptance scheme to make the determination. As all of the predictions are probabilities, we can use them to set a threshold above which we accept a token. The below equation shows how we do so:

Equation showing Typical Acceptance Scheme from the paper

The key here is that we are going to use the probabilities generated by the original model on these tokens to determine if the predictions are valid. We have tokens X1 through Xn as the context for our model to determine the probability for token Xn+k. p represents the probability distribution of our original model, while ϵ and δ are thresholds set to determine when a probability is high enough to merit being included in the model response. The big picture here is that high probability tokens will flow through, but so will tokens that have lower probabilities yet come from a probability distribution where most of the probabilities are low.

Moreover, this function leads to important behavior when we adjust temperature. In general, users increase temperature on an LLM to give more creative responses. Thus, when the temperature is set at zero, typical acceptance ensures that only the first token predicted from the forward pass comes through, giving the most consistent results. However, as the temperature increases, the probability distribution of the LLM changes, leaving us with more predictions that could reach the threshold to be accepted. This leads to both faster results but often times more creative ones as well.

Self-Distillation

The authors propose that to create Medusa models we don’t train from scratch but rather take high-quality foundation models (we’ll call this the backbone part of the model) and add the Medusa heads on top of these. Once we’ve fine-tuned them to understand the new heads, the speed will increase without major performance loss.

Nevertheless fine-tuning requires quality data. The authors were kind enough to explain how they created the data corpus needed to train Medusa.

First, they used the ShareGPT dataset to find high-quality interactions that people expect to have with their LLM. They took all the prompts from the dataset and then ran these through the backbone model to get the ground-truth to fine-tune on.

While this worked well for fine-tuning the Medusa heads (Medusa-1 which we’ll go into below more), this did not work well when fine-tuning the entire new model.

This degradation implied that the ground-truth was not enough information to retrain the model with and still retain high performance. Instead, they rewrote the loss function so that it used the probability distributions as the ground-truth. This required reformulating their loss function like the below.

Loss Equation for the new model from the paper

To briefly explain, we’re using Kullback–Leibler divergence (KL) to measure the difference between the original probability distribution for a token and the new probability distribution (to learn more about KL, there is a wonderful post by Aparna Dhinakaran on the topic).

This formulation, however, requires that we maintain the probabilities of both the original and the new model — which is both storage and memory intensive. To reduce our consumption, the authors recommend using LoRA to fine-tune, as this naturally maintains the original weights and the additional weights (to learn more about LoRA check out my blog post on the topic).

Training Medusa

Now that we have the data, we can begin to fine-tune!

As we’ve seen, Medusa requires adding additional parameters to the model to allow this to work, which we’ll have to train. To reduce the amount of computations (and thus training cost) required, the authors introduced two forms of fine-tuning for Medusa: Medusa-1 and Medusa-2.

Medusa-1

Medusa-1 involves freezing all of the weights in the model except for the ones in the Medusa heads. By only running the gradient through the Medusa heads we don’t worry about reducing the performance of the original model (it remains the same), and we can increase the performance of the Medusa heads. The loss function below shows how they match the correct ground-truth token to the correct Medusa head.

Equation 1 from the paper

Medusa-1’s focus on only the additional Medusa weights means that it is more cost-effective than Medusa-2 (which we’ll dive into in a moment). For people who are price-sensitive with training, the authors recommend using a quantized backbone model to further reduce memory requirements along with using the Quantized Low Rank Adaptation (QLoRA) fine-tuning methodology to further reduce costs.

Medusa-2

While Medusa-1 is more cost-effective, the best performance still comes when we update all of the weights in the model to account for the new Medusa heads we’ve added. Interestingly, this was not as straight-forward as simply doing LoRA with the gradient passing to all of the weights (rather than just the Medusa weights).

Instead, the authors first ran Medusa-1 to get the Medusa weights to a reasonable performance. Then they chose separate learning rates for the Medusa weights and the backbone model weights. Logically, this was done because the backbone weights were likely close to where they already needed to be, while the Medusa weights should change more. Finally, they added the loss function for the backbone model (denoted Llm) with the Medusa-1 loss function scaled by a value λ0. This lambda is done to balance the loss so that we do not compute an overly large loss value on account of the Medusa heads alone.

Equation 2 from the paper

Closing

Figure 3 from the paper

Using Medusa leads to fairly radical improvements in speed. From the graph above, we see that the authors attained between a two to three times speedup for Vicuna — a popular open-source LLM.

Speed is critically important, both on the internet and also on device. As we’ve seen more companies push to create local LLMs, methods like Medusa seem critical to getting great speed on limited hardware. It would be very interesting to see how much a small model like Phi-3 would speed up (at publishing time Phi-3 ran at 12 tokens per second on the A16 Bionic iPhone chip — see my blog post for more information). For developers, this may open the door to running many different kinds of open-source models locally — even if they weren’t initially designed for fast inference like Phi-3.

Moreover, it would be interesting to run experiments on how much of the forward pass’ attention pattern Medusa heads need to increase performance. Right now they have very little context but still perform well. With more context, perhaps the number of Medusa heads could be increased to achieve even better speed up.

It’s an exciting time to be building.

[1] Cai, T., et al, “MEDUSA: Simple LLM Inference Acceleration Framework with Multiple Decoding Heads” (2024), arXiv

[2] Clabaugh, J., “How long do you wait for a webpage to load?” (2022), wtop

[3] Das, S., “How fast should a website load in 2023?” (2023), BrowserStack

Exploring Medusa and Multi-Token Prediction was originally published in Towards Data Science on Medium, where people are continuing the conversation by highlighting and responding to this story.

May 2024: Firebase has SQL, and 6 other top takeaways from Google I/O

Sun, 19 May 2024 00:43:12 +0200

Author: Firebase - Bewertung: 7x - Views:38

Welcome to the May 2024 edition of Firebase Release Notes. In this video, Puf discusses the 7 top takeaways from Firebase at Google I/O 2024 including the new logo for Firebase, SQL, and more! Chapters: 0:00 - Introduction 0:11 - Evolving Firebase - new logo 0:31 - Data Connect: Firebase now has SQL 1:17 - App Hosting: deploy NextJS apps to Google Cloud 1:49 - Genkit: quickly build and ship server-side gen AI pipelines 2:26 - Safely call Gemini APIs on Vertex AI from your client-side apps 2:56 - Gemini in Firebase: get in-context AI help in console and Crashlytics 3:27 - Launch features gradually and roll back quickly with Remote Config 4:01 - Conclusion Resources: Data Connect → https://goo.gle/4bDjrHy App Hosting → https://goo.gle/4aFyeAn Genkit → https://goo.gle/4dXAIwy Watch more Firebase Release Notes → https://goo.gle/firebase-release-notes Subscribe to Firebase → https://goo.gle/Firebase #FirebaseReleaseNotes #Firebase Speaker: Frank van Puffelen Products Mentioned: Firebase

Dask DataFrame is Fast Now

Fri, 17 May 2024 20:14:18 +0200

Dask DataFrame Is Fast Now

How Dask enables processing data at terabyte scale efficiently

Performance Improvements for Dask DataFrames — All Images created by the Author

Introduction

Dask DataFrame scales out pandas DataFrames to operate at the 100GB-100TB scale.

Historically, Dask was pretty slow compared to other tools in this space (like Spark). Due to a number of improvements focused on performance, it’s now pretty fast (about 20x faster than before). The new implementation moved Dask from getting destroyed by Spark on every benchmark to regularly outperforming Spark on TPC-H queries by a significant margin.

Dask DataFrame workloads struggled with many things. Performance and memory usage were commonly seen pain points, shuffling was unstable for bigger datasets, making scaling out hard. Writing efficient code required understanding too much of the internals of Dask.

The new implementation changed all of this. Things that didn’t work were completely rewritten from scratch and existing implementations were improved upon. This puts Dask DataFrames on a solid foundation that allows faster iteration cycles in the future.

We’ll go through the three most prominent changes, covering how they impact performance and make it easier to use Dask efficiently, even for users that are new to distributed computing. We’ll also discuss plans for future improvements.

I am part of the core team of Dask. I am an open source engineer for Coiled and was involved in implementing some of the improvements discussed in this post.

1. Apache Arrow Support: Efficient String Datatype

A Dask DataFrame consists of many pandas DataFrames. Historically, pandas used NumPy for numeric data, but Python objects for text data, which are inefficient and blow up memory usage. Operations on object data also hold the GIL, which doesn’t matter much for pandas, but is a catastrophy for performance with a parallel system like Dask.

The pandas 2.0 release introduced support for general-purpose Arrow datatypes, so Dask now uses PyArrow-backed strings by default. These are much better. PyArrow strings reduce memory usage by up to 80% and unlock multi-threading for string operations. Workloads that previously struggled with available memory now fit comfortably in much less space, and are a lot faster because they no longer constantly spill excess data to disk.

Memory Usage of the Legacy DataFrames compared with Arrow Strings

I wrote a post about this that investigates Arrow integrations in more detail if you want to learn more.

2. Faster Joins with a New Shuffle Algorithm

Shuffling is an essential component of distributed systems to enable sorting, joins, and complex group by operations. It is an all-to-all, network-intensive operation that’s often the most expensive component in a workflow. We rewrote Dask’s shuffling system, which greatly impacts overall performance, especially on complex, data-intensive workloads.

A shuffle operation is intrinsically an all-to-all communication operation where every input partition has to provide a tiny slice of data to every output partition. Dask was already using it’s own task-based algorithm that managed to reduce the O(n * n) task complexity to O(log(n) * n) where n is the number of partitions. This was a drastic reduction in the number of tasks, but the non-linear scaling ultimately did not allow Dask to process arbitrarily large datasets.

Dask introduced a new P2P (peer-to-peer) shuffle method that reduced the task complexity to O(n) which scales linearly with the size of the dataset and the size of the cluster. It also incorporates an efficient disk integration which allows easily shuffling datasets which are much larger than memory. The new system is extremely stable and "just works" across any scale of data.

Memory Usage of the Legacy Shuffle compared with P2P

One of my colleagues wrote a post about this that includes a more extensive explanation and a lot of technical details.

3. Optimizer

Dask itself is lazy, which means that it registers your whole query before doing any actual work. This is a powerful concept that enables a lot of optimizations, but historically Dask wasn’t taking advantage of this knowledge in the past. Dask also did a bad job of hiding internal complexities and left users on their own while navigating the difficulties of distributed computing and running large scale queries. It made writing efficient code painful for non-experts.

The Dask release in March includes a complete re-implementation of the DataFrame API to support query optimization. This is a big deal. The new engine centers around a query optimizer that rewrites our code to make it more efficient and better tailored to Dask’s strengths. Let’s dive into some optimization strategies, how they make our code run faster and scale better.

We will start with a couple of general purpose optimizations that are useful for every DataFrame-like tool before we dive into more specific techniques that are tailored to distributed systems generally and Dask more specifically.

3.1 Column Projection

Most datasets have more columns than what we actually need. Dropping them requires foresight (“What columns will I need for this query? 🤔”) so most people don’t think about this when loading data. This is bad for performance because we carry around lots of data that we don’t need, slowing everything down. Column Projection drops columns as soon as they aren’t needed anymore. It’s a straightforward optimization, but highly beneficial.

The legacy implementation always reads all columns from storage and only drops columns if we actively ask for it. Simply operating on less data is a big win for performance and memory usage.

The optimizer looks at the query and figures out which columns are needed for each operation. We can imagine this as looking at the final step of our query and then working backwards step by step to the data source and injecting drop operations to get rid of unnecessary columns.

We only require a subset of columns in the end. Replace doesn't need access to all columns, so we can drop unnecessary columns directly in the IO step.

3.2 Filter Pushdown

Filter pushdown is another general-purpose optimization with the same goal as column projection: operate on less data. The legacy implementation just keeps filters where we put them. The new implementation executes filter operations as early as possible while maintaining the same results.

The optimizer identifies every filter in our query and looks at the previous operation to see if we can move the filter closer to the data source. It will repeat this until it finds an operation that can’t be switched with a filter. This is a bit harder than column projections, because we have to make sure that the operations don’t change the values of our DataFrame. For example, switching a filter and a merge operation is fine (values don’t change), but switching a filter and a replace operation is invalid, because our values might change and rows that would previously have been filtered out now won’t be, or vice versa.

Initially, the filter happens after the Dropna, but we can execute the filter before Dropna without changing the result. This allows us to push the filter into the IO step.

Additionally, if our filter is strong enough then we can potentially drop complete files in the IO step. This is a best-case scenario, where an earlier filter brings a huge performance improvement and even requires reading less data from remote storage.

3.3 Automatically Resizing Partitions

In addition to implementing the common optimization techniques described above, we’ve also improved a common pain point specific to distributed systems genereally and Dask users specifically: optimal partition sizes.

Dask DataFrames consist of many small pandas DataFrames called partitions. Often, the number of partitions is decided for you and Dask users are advised to manually “repartition” after reducing or expanding their data (for example by dropping columns, filtering data, or expanding with joins) (see the Dask docs). Without this extra step, the (usually small) overhead from Dask can become a bottleneck if the pandas DataFrames become too small, making Dask workflows painfully slow.

Manually controlling the partition size is a difficult task that we, as Dask users, shouldn’t have to worry about. It is also slow because it requires network transfer of some partitions. Dask DataFrame now automatically does two things to help when the partitions get too small:

Keeps the size of each partition constant, based on the ratio of data you want to compute vs. the original file size. If, for example, you filter out 80% of the original dataset, Dask will automatically combine the resulting smaller partitions into fewer, larger partitions.
Combines too-small partitions into larger partitions, based on an absolute minimum (default is 75 MB). If, for example, your original dataset is split into many tiny files, Dask will automatically combine them.

We select two columns that take up 40 MB of memory out of the 200 MB from the whole file.

The optimizer will look at the number of columns and the size of the data within those. It calculates a ratio that is used to combine multiple files into one partition.

The ratio of 40/200 results in combining five files into a single partition.

This step is currently limited to IO operations (like reading in a Parquet dataset), but we plan to extend it to other operations that allow cheaply combining partitions.

3.4 Trivial Merge and Join Operations

Merge and join operations are typically cheap on a single machine with pandas but expensive in a distributed setting. Merging data in shared memory is cheap, while merging data across a network is quite slow, due to the shuffle operations explained earlier.

This is one of the most expensive operations in a distributed system. The legacy implementation triggered a network transfer of both input DataFrames for every merge operation. This is sometimes necessary, but very expensive.

Both joins are performed on the same column. The left DataFrame is already properly partitioned after the first join, so we can avoid shuffling again with the new implementation.

The optimizer will determine when shuffling is necessary versus when a trivial join is sufficient because the data is already aligned properly. This can make individual merges an order of magnitude faster. This also applies to other operations that normally require a shuffle like groupby().apply().

Dask merges used to be inefficient, which caused long runtimes. The optimizer fixes this for the trivial case where these operations happen after each other, but the technique isn’t very advanced yet. There is still a lot of potential for improvement.

The current implementation shuffles both branches that originate from the same table. Injecting a shuffle node further up avoids one of the expensive operations.

The optimizer will look at the expression and inject shuffle nodes where necessary to avoid unnecessary shuffles.

How do the improvements stack up compared to the legacy implementation?

Dask is now 20x faster than before. This improvement applies to the entire DataFrame API (not just isolated components), with no known performance regressions. Dask now runs workloads that were impossible to complete in an acceptable timeframe before. This performance boost is due to many improvements all layered on top of each other. It’s not about doing one thing especially well, but about doing nothing especially poorly.

Performance improvements on Query 3 of the TPC-H Benchmarks from https://github.com/coiled/benchmarks/tree/main/tests/tpch

Performance, while the most enticing improvement, is not the only thing that got better. The optimizer hides a lot of complexity from the user and makes the transition from pandas to Dask a lot easier because it’s now much more difficult to write poorly performing code. The whole system is more robust.

The new architecture of the API is a lot easier to work with as well. The legacy implementation leaked a lot of internal complexities into high-level API implementations, making changes cumbersome. Improvements are almost trivial to add now.

What’s to come?

Dask DataFrame changed a lot over the last 18 months. The legacy API was often difficult to work with and struggled with scaling out. The new implementation dropped things that didn’t work and improved existing implementations. The heavy lifting is finished now, which allows for faster iteration cycles to improve upon the status quo. Incremental improvements are now trivial to add.

A few things that are on the immediate roadmap:

Auto repartitioning: this is partially implemented, but there is more potential to choose a more efficient partition size during optimization.
Faster Joins: there’s still lots of fine-tuning to be done here. For example, we have a PR in flight with a 30–40% improvement.
Join Reordering: we don’t do this yet, but it’s on the immediate roadmap

Learn More

This article focuses on a number of improvements to Dask DataFrame and how much faster and more reliable it is as a result. If you’re choosing between Dask and other popular DataFrame tools, you might also consider:

DataFrames at Scale Comparison: TPC-H which compares Dask, Spark, Polars, and DuckDB performance on datasets ranging from 10 GB to 10 TB both locally and on the cloud.

Thank you for reading. Feel free to reach out to share your thoughts and feedback.

Dask DataFrame is Fast Now was originally published in Towards Data Science on Medium, where people are continuing the conversation by highlighting and responding to this story.

Vulnerability Summary for the Week of May 13, 2024

Fri, 10 May 2024 09:09:08 +0200

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
8theme--XStore Core	Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8.	2024-05-17	9.8	CVE-2024-33552 audit@patchstack.com
8theme--XStore Core	Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.	2024-05-17	8.2	CVE-2024-33556 audit@patchstack.com
AA-Team--WZone	Improper Privilege Management vulnerability in AA-Team WZone allows Privilege Escalation.This issue affects WZone: from n/a through 14.0.10.	2024-05-17	8.8	CVE-2024-33549 audit@patchstack.com
ABB--RobotWare 6	An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execute arbitrary code. The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific condition when specially crafted message is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07 * OmniCore- RobotWare 7 < 7.14	2024-05-14	7.6	CVE-2024-1913 cybersecurity@ch.abb.com
AROX SOLUTION--School ERP Pro+Responsive	Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the database.	2024-05-14	9.8	CVE-2024-4824 cve-coordination@incibe.es
Abdul Hakeem--Build App Online	Improper Privilege Management vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.	2024-05-17	8.8	CVE-2023-51479 audit@patchstack.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-30284 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-30310 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34094 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34095 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34096 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34097 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34098 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34099 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	7.8	CVE-2024-34100 psirt@adobe.com
Adobe--Adobe Aero Desktop	Adobe Aero Desktop versions 23.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30275 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30288 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30289 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30290 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30291 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30292 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30282 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30293 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30294 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30295 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30296 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30297 psirt@adobe.com
Adobe--Dreamweaver Desktop	Dreamweaver Desktop versions 21.3 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does require user interaction.	2024-05-16	9.3	CVE-2024-30314 psirt@adobe.com
Adobe--Illustrator	Illustrator versions 28.4, 27.9.3 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-20791 psirt@adobe.com
Adobe--Illustrator	Illustrator versions 28.4, 27.9.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-20792 psirt@adobe.com
Adobe--Substance3D - Painter	Substance3D - Painter versions 9.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30274 psirt@adobe.com
Adobe--Substance3D - Painter	Substance3D - Painter versions 9.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	7.8	CVE-2024-30307 psirt@adobe.com
Agentejo--Cockpit CMS	A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in '/media/api' parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.	2024-05-14	9.8	CVE-2024-4825 cve-coordination@incibe.es
Apache Friends--XAMPP	Uncontrolled resource consumption vulnerability in XAMPP Windows, versions 7.3.2 and earlier. This vulnerability exists when XAMPP attempts to process many incomplete HTTP requests, resulting in resource consumption and system crashes.	2024-05-17	7.5	CVE-2024-5055 cve-coordination@incibe.es
Asaancart--Simple PHP Shopping Cart	SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the category_id parameter in the category.php file.	2024-05-16	9.8	CVE-2024-4826 cve-coordination@incibe.es
Astoundify--Simple Registration for WooCommerce	Improper Privilege Management vulnerability in Astoundify Simple Registration for WooCommerce allows Privilege Escalation.This issue affects Simple Registration for WooCommerce: from n/a through 1.5.6.	2024-05-17	9.8	CVE-2024-32511 audit@patchstack.com
Averta--Phlox Portfolio	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1.	2024-05-17	8.6	CVE-2023-38399 audit@patchstack.com
Averta--Phlox Shop	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.	2024-05-17	8.6	CVE-2023-39163 audit@patchstack.com
B&R Industrial Automation--Automation Studio	Improper DLL loading algorithms in B&R Automation Studio may allow an authenticated local attacker to execute code with elevated privileges. This issue affects Automation Studio versions before 4.12.	2024-05-14	7.2	CVE-2021-22280 cybersecurity@ch.abb.com
B&R Industrial Automation--Scene Viewer	An authenticated local attacker who successfully exploited this vulnerability could insert and run arbitrary code using legitimate B&R software's. An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4 could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path. This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2.	2024-05-14	7.2	CVE-2024-2637 cybersecurity@ch.abb.com
BoldGrid--Total Upkeep	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue affects Total Upkeep: from n/a through 1.15.8.	2024-05-17	7.5	CVE-2024-24869 audit@patchstack.com
Booking Ultra Pro--Booking Ultra Pro	Improper Privilege Management vulnerability in Booking Ultra Pro allows Privilege Escalation.This issue affects Booking Ultra Pro: from n/a through 1.1.12.	2024-05-17	8.8	CVE-2024-32960 audit@patchstack.com
Brainstorm Force--ConvertPlus	The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_modal' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2024-05-16	8.8	CVE-2024-4838 security@wordfence.com security@wordfence.com
Brainstorm Force--Spectra Pro	The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lower-privileged users to create registration forms and set the default role to administrator This makes it possible for authenticated attackers, with author-level access and above, to create administrator-level accounts.	2024-05-14	8.8	CVE-2024-3828 security@wordfence.com security@wordfence.com
Brainstorm Force--Ultimate Addons for Beaver Builder	Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Privilege Escalation.This issue affects Ultimate Addons for Beaver Builder: from n/a through 1.35.14.	2024-05-17	8.8	CVE-2023-51398 audit@patchstack.com
Brainstorm Force--Ultimate Addons for Elementor	Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.20.	2024-05-17	8.8	CVE-2023-50890 audit@patchstack.com
Brainstorm Force--Ultimate Addons for WPBakery Page Builder	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows PHP Local File Inclusion.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.14.	2024-05-17	7.1	CVE-2023-46205 audit@patchstack.com
Breakdance--Breakdance	The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to edit this data via UI. As a result they can escalate their privileges or execute arbitrary code.	2024-05-14	8.8	CVE-2024-4605 security@wordfence.com security@wordfence.com
By Averta--Shortcodes and extra features for Phlox theme	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0.	2024-05-17	7.6	CVE-2023-37888 audit@patchstack.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.	2024-05-14	10	CVE-2024-29895 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.	2024-05-14	9.1	CVE-2024-25641 security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.	2024-05-14	9.1	CVE-2024-34340 security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.	2024-05-14	8.8	CVE-2024-31445 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.	2024-05-14	8	CVE-2024-31459 security-advisories@github.com security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular page. Version 1.2.27 contains a patch for the issue.	2024-05-14	7.6	CVE-2024-27082 security-advisories@github.com
Cerberus FTP Enterprise--Cerberus FTP Enterprise	Denial of Service (DoS) vulnerability for Cerberus Enterprise 8.0.10.3 web administration. The vulnerability exists when the web server, default port 10001, attempts to process a large number of incomplete HTTP requests.	2024-05-17	7.5	CVE-2024-5052 cve-coordination@incibe.es
Cisco--Cisco ConfD	A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command with crafted arguments. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system with the privileges of the root user.	2024-05-16	7.8	CVE-2024-20326 ykramarz@cisco.com ykramarz@cisco.com
Cisco--Cisco ConfD	A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command with crafted arguments. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system with the privileges of the root user.	2024-05-16	7.8	CVE-2024-20389 ykramarz@cisco.com ykramarz@cisco.com
Cisco--Cisco Network Services Orchestrator	A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled search path is used to locate executable files. An attacker could exploit this vulnerability by configuring the application in a way that causes a malicious file to be executed. A successful exploit could allow the attacker to execute arbitrary code on an affected device as the root user. To exploit this vulnerability, the attacker would need valid credentials on an affected device.	2024-05-15	7.8	CVE-2024-20366 ykramarz@cisco.com
CodeRevolution--Demo My WordPress	Improper Privilege Management vulnerability in CodeRevolution Demo My WordPress allows Privilege Escalation.This issue affects Demo My WordPress: from n/a through 1.0.9.1.	2024-05-17	9.8	CVE-2024-31290 audit@patchstack.com
Contemporary Control System--BASrouter BACnet BASRT-B	A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects unknown code of the component Application Protocol Data Unit. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263890 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-14	7.5	CVE-2024-4791 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Copymatic--Copymatic AI Content Writer & Generator	Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic - AI Content Writer & Generator.This issue affects Copymatic - AI Content Writer & Generator: from n/a through 1.6.	2024-05-17	10	CVE-2024-31351 audit@patchstack.com
Crocoblock--JetEngine	Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4.	2024-05-17	8.8	CVE-2023-48757 audit@patchstack.com
Crocoblock--JetFormBuilder	Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.0.8.	2024-05-17	7.2	CVE-2023-37866 audit@patchstack.com
CyberPower--CyberPower PowerPanel Enterprise	An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can access the PDNU REST APIs, which may result in compromise of the application.	2024-05-14	9.8	CVE-2024-32735 vulnreport@tenable.com vulnreport@tenable.com
CyberPower--CyberPower PowerPanel Enterprise	A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_utask_verbose" function within MCUDBHelper.	2024-05-14	7.5	CVE-2024-32736 vulnreport@tenable.com vulnreport@tenable.com
CyberPower--CyberPower PowerPanel Enterprise	A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_contract_result" function within MCUDBHelper.	2024-05-14	7.5	CVE-2024-32737 vulnreport@tenable.com vulnreport@tenable.com
CyberPower--CyberPower PowerPanel Enterprise	A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_lean" function within MCUDBHelper.	2024-05-14	7.5	CVE-2024-32738 vulnreport@tenable.com vulnreport@tenable.com
CyberPower--CyberPower PowerPanel Enterprise	A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_verbose" function within MCUDBHelper.	2024-05-14	7.5	CVE-2024-32739 vulnreport@tenable.com vulnreport@tenable.com
CyberPower--PowerPanel business	Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server.	2024-05-15	9.8	CVE-2024-32047 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel business application.	2024-05-15	9.8	CVE-2024-32053 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authentication.	2024-05-15	9.8	CVE-2024-33625 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentication and gaining administrator privileges.	2024-05-15	9.8	CVE-2024-34025 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attacker injecting SQL syntax, writing arbitrary files to the system, and executing remote code.	2024-05-15	8.8	CVE-2024-31856 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution.	2024-05-15	8.8	CVE-2024-33615 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data.	2024-05-15	7.7	CVE-2024-31410 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CycloneDX--cyclonedx-javascript-library	The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.	2024-05-14	8.1	CVE-2024-34345 security-advisories@github.com security-advisories@github.com security-advisories@github.com
Darren Cooney--Instant Images	Improper Privilege Management vulnerability in Darren Cooney Instant Images allows Privilege Escalation.This issue affects Instant Images: from n/a through 6.1.0.	2024-05-17	7.2	CVE-2024-33569 audit@patchstack.com
Dell--CPG BIOS	Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to arbitrary code execution.	2024-05-17	7.5	CVE-2024-22429 security_alert@emc.com
DigiWin--EasyFlow .NET	DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands.	2024-05-15	9.8	CVE-2024-4893 twcert@cert.org.tw twcert@cert.org.tw
Elementor--Elementor Website Builder	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0.	2024-05-17	8.5	CVE-2024-24934 audit@patchstack.com
EnterpriseDB--EDB Postgres Advanced Server	All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files to which they would not otherwise have access.	2024-05-14	7.7	CVE-2024-4545 20be33e2-bf35-4d13-8fad-18bd2f3e3659 20be33e2-bf35-4d13-8fad-18bd2f3e3659 20be33e2-bf35-4d13-8fad-18bd2f3e3659
EverPress--Mailster	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EverPress Mailster allows PHP Local File Inclusion.This issue affects Mailster: from n/a through 4.0.6.	2024-05-17	8.1	CVE-2024-32523 audit@patchstack.com
Favethemes--Houzez Login Register	Improper Privilege Management vulnerability in favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3.	2024-05-17	9.8	CVE-2023-26009 audit@patchstack.com
Favethemes--Houzez	Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.	2024-05-17	9.8	CVE-2023-26540 audit@patchstack.com
Fortinet--FortiOS	A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute arbitrary code or commands via crafted HTTP or HTTPs requests.	2024-05-14	7.2	CVE-2023-46714 psirt@fortinet.com
Fortinet--FortiPortal	A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets.	2024-05-14	7.5	CVE-2024-23105 psirt@fortinet.com
Fortinet--FortiSandbox	A client-side enforcement of server-side security in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests.	2024-05-14	8.8	CVE-2024-31491 psirt@fortinet.com
Fortinet--FortiVoice	An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests.	2024-05-14	7.1	CVE-2023-40720 psirt@fortinet.com
GE HealthCare--EchoPAC Software Only	Weak account password in GE HealthCare EchoPAC products	2024-05-14	9.6	CVE-2024-27107 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--EchoPAC Software Only	Elevation of privilege vulnerability in GE HealthCare EchoPAC products	2024-05-14	8.4	CVE-2024-27110 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--EchoPAC Software Only	Insufficiently protected credentials in GE HealthCare EchoPAC products	2024-05-14	7.6	CVE-2024-27109 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--Venue	OS command injection vulnerabilities in GE HealthCare ultrasound devices	2024-05-14	8.4	CVE-2024-1628 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--Venue	Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices	2024-05-14	7.4	CVE-2024-1486 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--Venue	Path traversal vulnerability in "getAllFolderContents" function of Common Service Desktop, a GE HealthCare ultrasound device component	2024-05-14	7.7	CVE-2024-1630 171caf72-b841-4e04-a68e-93493aff2b94
Ghost Foundation--Ghost	Insertion of Sensitive Information into Log File vulnerability in Ghost Foundation Ghost.This issue affects Ghost: from n/a through 1.4.0.	2024-05-14	7.5	CVE-2024-34559 audit@patchstack.com
GiveWP--GiveWP	Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0.	2024-05-17	8.8	CVE-2023-41665 audit@patchstack.com
Glowlogix--WP Frontend Profile	Improper Privilege Management vulnerability in Glowlogix WP Frontend Profile allows Privilege Escalation.This issue affects WP Frontend Profile: from n/a through 1.3.1.	2024-05-17	9.8	CVE-2023-51483 audit@patchstack.com
HCL Software--Commerce	Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.	2024-05-14	7.1	CVE-2024-23576 psirt@hcl.com
Hamid Alinia idehweb--Login with phone number	Improper Privilege Management vulnerability in Hamid Alinia - idehweb Login with phone number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16.	2024-05-17	8.8	CVE-2024-32507 audit@patchstack.com
HasThemes--HT Mega	Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.	2024-05-17	9.8	CVE-2023-37999 audit@patchstack.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31466 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31467 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31468 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31469 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31470 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31471 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31472 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.	2024-05-14	9.8	CVE-2024-31473 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point	2024-05-14	8.2	CVE-2024-31474 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point.	2024-05-14	8.2	CVE-2024-31475 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.	2024-05-14	7.2	CVE-2024-31476 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.	2024-05-14	7.2	CVE-2024-31477 security-alert@hpe.com
Huawei--HarmonyOS	Race condition vulnerability in the binder driver module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	8.4	CVE-2024-32997 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.	2024-05-14	7.1	CVE-2023-52719 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	7.5	CVE-2024-32991 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	7.5	CVE-2024-32992 psirt@huawei.com psirt@huawei.com
IBM--AIX	IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 283985.	2024-05-16	8.4	CVE-2024-27260 psirt@us.ibm.com psirt@us.ibm.com
IBM--Security Guardium	IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 271524.	2024-05-14	9.1	CVE-2023-47709 psirt@us.ibm.com psirt@us.ibm.com
IBM--Security Guardium	IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X-Force ID: 271527.	2024-05-14	7.8	CVE-2023-47712 psirt@us.ibm.com psirt@us.ibm.com
IBM--i	IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the deserialization of untrusted data. IBM X-Force ID: 287539.	2024-05-18	7.5	CVE-2024-31879 psirt@us.ibm.com psirt@us.ibm.com
IOSS--WP MLM Unilevel	Improper Privilege Management vulnerability in IOSS WP MLM Unilevel allows Privilege Escalation.This issue affects WP MLM Unilevel: from n/a through 4.0.	2024-05-17	9.8	CVE-2023-51476 audit@patchstack.com
InstaWP Team--InstaWP Connect	Improper Privilege Management vulnerability in InstaWP Team InstaWP Connect allows Privilege Escalation.This issue affects InstaWP Connect: from n/a through 0.1.0.8.	2024-05-17	8.8	CVE-2024-22145 audit@patchstack.com
J.N. Breetvelt a.k.a. OpaJaap--WP Photo Album Plus	Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.7.01.001.	2024-05-14	10	CVE-2024-31377 audit@patchstack.com
JR King/Eran Schoellhorn--WP Masquerade	Improper Privilege Management vulnerability in JR King/Eran Schoellhorn WP Masquerade allows Privilege Escalation.This issue affects WP Masquerade: from n/a through 1.1.0.	2024-05-17	8.8	CVE-2024-33550 audit@patchstack.com
JS Help Desk--JS Help Desk Best Help Desk & Support Plugin	Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk - Best Help Desk & Support Plugin: from n/a through 2.7.7.	2024-05-17	9.1	CVE-2023-25444 audit@patchstack.com
Jordy Meow--AI Engine: ChatGPT Chatbot	Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.	2024-05-14	9.1	CVE-2024-34440 audit@patchstack.com
Joseph C Dolson--My Tickets	Missing Authorization vulnerability in Joseph C Dolson My Tickets.This issue affects My Tickets: from n/a through 1.9.11.	2024-05-17	7.5	CVE-2023-23988 audit@patchstack.com
JumpDEMAND Inc.--ActiveDEMAND	Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: from n/a through 0.2.41.	2024-05-17	10	CVE-2024-32809 audit@patchstack.com
Kioware--Kioware	KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.	2024-05-14	8.4	CVE-2024-3459 cvd@cert.pl cvd@cert.pl cvd@cert.pl
Kioware--Kioware	In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window.	2024-05-14	7.4	CVE-2024-3460 cvd@cert.pl cvd@cert.pl cvd@cert.pl
Kognetiks--Kognetiks Chatbot for WordPress	Unrestricted Upload of File with Dangerous Type vulnerability in Kognetiks Kognetiks Chatbot for WordPress.This issue affects Kognetiks Chatbot for WordPress: from n/a through 2.0.0.	2024-05-14	10	CVE-2024-32700 audit@patchstack.com
LWS--LWS Affiliation	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6.	2024-05-17	9	CVE-2023-32297 audit@patchstack.com
Lenderd--1003 Mortgage Application	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Lenderd 1003 Mortgage Application allows Relative Path Traversal.This issue affects 1003 Mortgage Application: from n/a through 1.75.	2024-05-17	7.7	CVE-2022-45368 audit@patchstack.com
Lenovo--Printers	A buffer overflow vulnerability was identified in some Lenovo printers that could allow an unauthenticated user to trigger a device restart by sending a specially crafted web request.	2024-05-16	7.5	CVE-2024-3286 psirt@lenovo.com psirt@lenovo.com
MSI--MSI Afterburner	MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user.	2024-05-18	7.8	CVE-2024-3745 help@fluidattacks.com help@fluidattacks.com help@fluidattacks.com
MainWP--MainWP Code Snippets Extension	Improper Control of Generation of Code ('Code Injection') vulnerability in MainWP MainWP Code Snippets Extension allows Code Injection.This issue affects MainWP Code Snippets Extension: from n/a through 4.0.2.	2024-05-17	9.9	CVE-2023-23645 audit@patchstack.com
Masteriyo--LMS	Improper Privilege Management vulnerability in Masteriyo LMS allows Privilege Escalation.This issue affects LMS: from n/a through 1.7.2.	2024-05-17	9.8	CVE-2024-24882 audit@patchstack.com
Microsoft--Azure Monitor	Azure Monitor Agent Elevation of Privilege Vulnerability	2024-05-16	7.8	CVE-2024-30060 secure@microsoft.com
Microsoft--Dynamics 365	Dynamics 365 Customer Insights Spoofing Vulnerability	2024-05-14	7.6	CVE-2024-30047 secure@microsoft.com
Microsoft--Dynamics 365	Dynamics 365 Customer Insights Spoofing Vulnerability	2024-05-14	7.6	CVE-2024-30048 secure@microsoft.com
Microsoft--Microsoft SharePoint Enterprise Server 2016	Microsoft SharePoint Server Remote Code Execution Vulnerability	2024-05-14	7.2	CVE-2024-30044 secure@microsoft.com
Microsoft--Office Online Server	Microsoft Excel Remote Code Execution Vulnerability	2024-05-14	7.8	CVE-2024-30042 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability	2024-05-14	8.8	CVE-2024-30006 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	8.8	CVE-2024-30009 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Hyper-V Remote Code Execution Vulnerability	2024-05-14	8.8	CVE-2024-30017 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Cryptographic Services Remote Code Execution Vulnerability	2024-05-14	8.1	CVE-2024-30020 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-29994 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-29996 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	7.5	CVE-2024-30014 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	7.5	CVE-2024-30015 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Kernel Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30018 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	7.5	CVE-2024-30022 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	7.5	CVE-2024-30023 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	7.5	CVE-2024-30024 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30025 secure@microsoft.com
Microsoft--Windows 10 Version 1809	NTFS Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30027 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Win32k Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30028 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	2024-05-14	7.5	CVE-2024-30029 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows CNG Key Isolation Service Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30031 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows DWM Core Library Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30032 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows DWM Core Library Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30035 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	2024-05-14	7.5	CVE-2024-30037 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Win32k Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30038 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30049 secure@microsoft.com
Microsoft--Windows 10 Version 21H2	Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-26238 secure@microsoft.com
Microsoft--Windows Server 2008 Service Pack 2	Win32k Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30030 secure@microsoft.com
Microsoft--Windows Server 2019	Windows Hyper-V Remote Code Execution Vulnerability	2024-05-14	8.8	CVE-2024-30010 secure@microsoft.com
Microsoft--Windows Server 2022, 23H2 Edition (Server Core installation)	Microsoft Brokering File System Elevation of Privilege Vulnerability	2024-05-14	8.8	CVE-2024-30007 secure@microsoft.com
Microsoft--Windows Server 2022	Windows Search Service Elevation of Privilege Vulnerability	2024-05-14	7	CVE-2024-30033 secure@microsoft.com
MongoDB Inc--MongoDB Server	Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25.	2024-05-14	7.5	CVE-2024-3372 cna@mongodb.com
N/A--Pk Favicon Manager	Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through 2.1.	2024-05-14	9.1	CVE-2024-34416 audit@patchstack.com
N/A--VMware Workstation	VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to create a denial of service condition.	2024-05-14	7.1	CVE-2024-22268 security@vmware.com
N/A--VMware Workstation	VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.	2024-05-14	7.1	CVE-2024-22269 security@vmware.com
N/A--VMware Workstation	VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.	2024-05-14	7.1	CVE-2024-22270 security@vmware.com
NA--VMware Workstation	VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.	2024-05-14	9.3	CVE-2024-22267 security@vmware.com
NI--FlexLogger	A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.	2024-05-14	7.8	CVE-2024-4044 security@ni.com
Netflix--Genie	A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18	2024-05-14	9.9	CVE-2024-4701 security-report@netflix.com
Nota-Info--Bookly	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1.	2024-05-17	7.7	CVE-2023-26526 audit@patchstack.com
Nozomi Networks--Arc	Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim's machine).	2024-05-15	8	CVE-2023-5938 prodsec@nozominetworks.com
Nozomi Networks--Arc	When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself. A malicious local user or process, during a window of opportunity when the local web interface is active, may be able to extract sensitive information or change Arc's configuration. This could also lead to arbitrary code execution if a malicious update package is installed.	2024-05-15	7.4	CVE-2023-5935 prodsec@nozominetworks.com
Nozomi Networks--Arc	On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges.	2024-05-15	7.8	CVE-2023-5936 prodsec@nozominetworks.com
OceanWP--OceanWP	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OceanWP allows PHP Local File Inclusion.This issue affects OceanWP: from n/a through 3.4.1.	2024-05-17	7.6	CVE-2023-23700 audit@patchstack.com
OctoPrint--OctoPrint	OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.	2024-05-14	7.1	CVE-2024-32977 security-advisories@github.com security-advisories@github.com
OpenText--iManager	Remote Code Execution has been discovered in OpenTextâ„¢ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues.	2024-05-15	7.8	CVE-2024-3483 security@opentext.com
OpenText--iManager	XML External Entity injection vulnerability found in OpenTextâ„¢ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.	2024-05-15	7.8	CVE-2024-3486 security@opentext.com
OpenText--iManager	Remote Code Execution has been discovered in OpenTextâ„¢ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deserialization.	2024-05-15	7.6	CVE-2024-3967 security@opentext.com
OpenText--iManager	Remote Code Execution has been discovered in OpenTextâ„¢ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task.	2024-05-15	7.8	CVE-2024-3968 security@opentext.com
Owlet--Cam v2	A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.	2024-05-15	7.2	CVE-2023-6321 cve-requests@bitdefender.com
P-THEMES--Porto Theme - Functionality	The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.	2024-05-14	8.8	CVE-2024-3808 security@wordfence.com security@wordfence.com
P-THEMES--Porto Theme - Functionality	The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.	2024-05-14	8.8	CVE-2024-3809 security@wordfence.com security@wordfence.com
P-THEMES--Porto	The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.	2024-05-14	9.8	CVE-2024-3806 security@wordfence.com security@wordfence.com
P-THEMES--Porto	The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. This was partially patched in version 7.1.0 and fully patched in version 7.1.1.	2024-05-14	8.8	CVE-2024-3807 security@wordfence.com security@wordfence.com
PHOENIX CONTACT--CHARX SEC-3000	A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.	2024-05-14	7.8	CVE-2024-28133 info@cert.vde.com
PHOENIX CONTACT--CHARX SEC-3000	An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.	2024-05-14	7	CVE-2024-28134 info@cert.vde.com
PHOENIX CONTACT--CHARX SEC-3000	A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.	2024-05-14	7.8	CVE-2024-28136 info@cert.vde.com
PHOENIX CONTACT--CHARX SEC-3000	A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.	2024-05-14	7.8	CVE-2024-28137 info@cert.vde.com
PHPGurukul--Online Course Registration System	A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264922 is the identifier assigned to this vulnerability.	2024-05-17	7.3	CVE-2024-5063 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
PHPGurukul--Online Course Registration System	A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been rated as critical. This issue affects some unknown processing of the file news-details.php. The manipulation of the argument nid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264923.	2024-05-17	7.3	CVE-2024-5064 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
PHPGurukul--Online Course Registration System	A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function of the file /onlinecourse/. The manipulation of the argument regno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264924.	2024-05-17	7.3	CVE-2024-5065 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
POSIMYTH Innovation--The Plus Addons for Elementor Pro	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows PHP Local File Inclusion.This issue affects The Plus Addons for Elementor Pro: from n/a through 5.2.8.	2024-05-17	8.6	CVE-2023-47178 audit@patchstack.com
Phoenix--SecureCore for Intel Gemini Lake	Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCoreâ„¢ for Intel Gemini Lake.This issue affects: SecureCoreâ„¢ for Intel Gemini Lake: from 4.1.0.1 before 4.1.0.567.	2024-05-14	7.5	CVE-2024-1598 22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de
Phoenix--SecureCore for Intel Kaby Lake	Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCoreâ„¢ for select Intel platforms This issue affects: Phoenix SecureCoreâ„¢ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998; Phoenix SecureCoreâ„¢ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562; Phoenix SecureCoreâ„¢ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323; Phoenix SecureCoreâ„¢ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287; Phoenix SecureCoreâ„¢ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236; Phoenix SecureCoreâ„¢ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184; Phoenix SecureCoreâ„¢ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269; Phoenix SecureCoreâ„¢ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCoreâ„¢ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.	2024-05-14	7.5	CVE-2024-0762 22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de
Phoenix--WinFlash Driver	Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.	2024-05-14	7.8	CVE-2023-35841 22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de 22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de 22d9ba52-f336-4b0d-bf1f-0efbdcc3c1de
PluginOps--Landing Page Builder	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Reflected XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.8.	2024-05-17	7.1	CVE-2024-34752 audit@patchstack.com
PluginUS--HUSKY Products Filter for WooCommerce (formerly WOOF)	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY - Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY - Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.	2024-05-17	8.8	CVE-2024-32680 audit@patchstack.com
Podlove--Podlove Podcast Publisher	Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.	2024-05-14	7.5	CVE-2024-32712 audit@patchstack.com
PowerDNS--DNSdist	When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.	2024-05-14	7.5	CVE-2024-25581 security@open-xchange.com
Premmerce--Premmerce Permalink Manager for WooCommerce	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through 2.3.10.	2024-05-17	8.3	CVE-2024-27971 audit@patchstack.com
PrestaShop--PrestaShop	PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.	2024-05-14	9.6	CVE-2024-34716 security-advisories@github.com security-advisories@github.com
ProfilePress Membership Team--ProfilePress	Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.	2024-05-17	8.6	CVE-2023-41954 audit@patchstack.com
Progress Software Corporation--Telerik Reporting	In ProgressÂ® TelerikÂ® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.	2024-05-15	7.7	CVE-2024-4200 security@progress.com
Progress Software Corporation--Telerik Reporting	In ProgressÂ® TelerikÂ® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.	2024-05-15	7.7	CVE-2024-4202 security@progress.com
Progress Software Corporation--Telerik UI for WinForms	A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system.	2024-05-15	7.2	CVE-2024-3892 security@progress.com
Proofpoint--Enterprise Protection	The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.	2024-05-14	7.5	CVE-2024-3676 security@proofpoint.com
Propovoice--Propovoice CRM	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Propovoice Propovoice CRM allows Stored XSS.This issue affects Propovoice CRM: from n/a through 1.7.6.2.	2024-05-14	7.1	CVE-2024-4747 audit@patchstack.com
QuanticaLabs--Chauffeur Taxi Booking System for WordPress	Missing Authorization vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 6.9.	2024-05-17	8.2	CVE-2024-32692 audit@patchstack.com
Qube One Ltd.--Redirection for Contact Form 7	Improper Privilege Management vulnerability in Qube One Ltd. Redirection for Contact Form 7 wpcf7-redirect allows Privilege Escalation.This issue affects Redirection for Contact Form 7: from n/a through 2.7.0.	2024-05-17	7.6	CVE-2023-23990 audit@patchstack.com
Rank Math--Rank Math SEO	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rank Math Rank Math SEO allows Path Traversal.This issue affects Rank Math SEO: from n/a through 1.0.107.2.	2024-05-17	7.6	CVE-2023-23888 audit@patchstack.com
Red Hat--Migration Toolkit for Containers	A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.	2024-05-14	8.3	CVE-2024-3727 secalert@redhat.com secalert@redhat.com
Repute Infosystems--ARMember	Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.	2024-05-17	8.8	CVE-2023-51356 audit@patchstack.com
Roku--Indoor Camera SE	A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability.	2024-05-15	7.2	CVE-2023-6322 cve-requests@bitdefender.com
Room 34 Creative Services, LLC--ICS Calendar	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3.	2024-05-17	8.2	CVE-2023-46784 audit@patchstack.com
SAASPROJECT Booking Package--Booking Package	Improper Privilege Management vulnerability in SAASPROJECT Booking Package Booking Package allows Privilege Escalation.This issue affects Booking Package: from n/a through 1.5.98.	2024-05-17	8.8	CVE-2023-37389 audit@patchstack.com
SAP_SE--SAP BusinessObjects Business Intelligence Platform	SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application	2024-05-14	8.1	CVE-2024-28165 cna@sap.com cna@sap.com
SAP_SE--SAP NetWeaver Application Server ABAP and ABAP Platform	An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.	2024-05-14	9.6	CVE-2024-33006 cna@sap.com cna@sap.com
SUBNET--PowerSYSTEM Center	SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center.	2024-05-15	8.4	CVE-2024-28042 ics-cert@hq.dhs.gov
SailPoint--Identity Security Cloud	An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code execution on the host.	2024-05-15	9.1	CVE-2024-3319 psirt@sailpoint.com
Saleswonder Team--WebinarIgnition	Improper Privilege Management vulnerability in Saleswonder Team WebinarIgnition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through 3.05.0.	2024-05-17	9.8	CVE-2023-51424 audit@patchstack.com
SiAdmin--SiAdmin	Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_pass/aksi_pass.php parameter in nama_lengkap. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.	2024-05-16	9.8	CVE-2024-4991 cve-coordination@incibe.es
SiAdmin--SiAdmin	Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_kuliah/aksi_kuliah.php parameter in nim. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.	2024-05-16	9.8	CVE-2024-4992 cve-coordination@incibe.es
Siemens--CPC80 Central Processing/Communication	A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30). The affected device firmwares contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.	2024-05-14	7.8	CVE-2024-31484 productcert@siemens.com
Siemens--CPCI85 Central Processing/Communication	A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1.3.0). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.	2024-05-14	7.2	CVE-2024-31485 productcert@siemens.com
Siemens--JT2Go	A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamcenter Visualization V14.2 (All versions < V14.2.0.10), Teamcenter Visualization V14.3 (All versions < V14.3.0.7), Teamcenter Visualization V2312 (All versions < V2312.0001). The affected applications contain a stack overflow vulnerability while parsing specially crafted XML files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-34085 productcert@siemens.com
Siemens--JT2Go	A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamcenter Visualization V14.2 (All versions < V14.2.0.10), Teamcenter Visualization V14.3 (All versions < V14.3.0.7), Teamcenter Visualization V2312 (All versions < V2312.0001). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted CGM file. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-34086 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-32055 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21562)	2024-05-14	7.8	CVE-2024-32057 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected application is vulnerable to memory corruption while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21563)	2024-05-14	7.8	CVE-2024-32058 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21564)	2024-05-14	7.8	CVE-2024-32059 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21565)	2024-05-14	7.8	CVE-2024-32060 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21566)	2024-05-14	7.8	CVE-2024-32061 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21568)	2024-05-14	7.8	CVE-2024-32062 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21573)	2024-05-14	7.8	CVE-2024-32063 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21575)	2024-05-14	7.8	CVE-2024-32064 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21577)	2024-05-14	7.8	CVE-2024-32065 productcert@siemens.com
Siemens--PS/IGES Parasolid Translator Component	A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21578)	2024-05-14	7.8	CVE-2024-32066 productcert@siemens.com
Siemens--Parasolid V35.1	A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.210), Parasolid V36.1 (All versions < V36.1.185). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted X_T part file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-23468)	2024-05-14	7.8	CVE-2024-31980 productcert@siemens.com
Siemens--Parasolid V35.1	A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.208), Parasolid V36.1 (All versions < V36.1.173). The affected applications contain an out of bounds read past the unmapped memory region while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-32635 productcert@siemens.com
Siemens--Parasolid V35.1	A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.208), Parasolid V36.1 (All versions < V36.1.173). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-32636 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow the upload of arbitrary files of any unauthenticated user. An attacker could leverage this vulnerability and achieve arbitrary code execution with system privileges.	2024-05-14	9.8	CVE-2024-27939 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.	2024-05-14	8.8	CVE-2024-27940 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected client systems do not properly sanitize input data before sending it to the SQL server. An attacker could use this vulnerability to compromise the whole database.	2024-05-14	8.8	CVE-2024-27941 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any unauthenticated client to disconnect any active user from the server. An attacker could use this vulnerability to prevent any user to perform actions in the system, causing a denial of service situation.	2024-05-14	7.5	CVE-2024-27942 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.	2024-05-14	7.2	CVE-2024-27943 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload firmware files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.	2024-05-14	7.2	CVE-2024-27944 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a privileged user to upload files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.	2024-05-14	7.2	CVE-2024-27945 productcert@siemens.com
Siemens--SIMATIC CN 4100	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is used for the privileged system user `root` and for the boot loader `GRUB` by default . An attacker who manages to crack the password hash gains root access to the device.	2024-05-14	10	CVE-2024-32741 productcert@siemens.com
Siemens--SIMATIC CN 4100	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker could misuse the credentials to compromise the device locally or over the network.	2024-05-14	9.8	CVE-2024-32740 productcert@siemens.com
Siemens--SIMATIC CN 4100	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem.	2024-05-14	7.6	CVE-2024-32742 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected systems use symmetric cryptography with a hard-coded key to protect the communication between client and server. This could allow an unauthenticated remote attacker to compromise confidentiality and integrity of the communication and, subsequently, availability of the system. A successful exploit requires the attacker to gain knowledge of the hard-coded key and to be able to intercept the communication between client and server on the network.	2024-05-14	10	CVE-2024-30207 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected systems transmit client-side resources without proper cryptographic protection. This could allow an attacker to eavesdrop on and modify resources in transit. A successful exploit requires an attacker to be in the network path between the RTLS Locating Manager server and a client (MitM).	2024-05-14	9.6	CVE-2024-30209 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected application assigns incorrect permissions to a user management component. This could allow a privileged attacker to escalate their privileges from the Administrators group to the Systemadministrator group.	2024-05-14	9.1	CVE-2024-33499 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected SIMATIC RTLS Locating Manager Clients do not properly check the integrity of update files. This could allow an unauthenticated remote attacker to alter update files in transit and trick an authorized user into installing malicious code. A successful exploit requires the attacker to be able to modify the communication between server and client on the network.	2024-05-14	8.8	CVE-2024-30206 productcert@siemens.com
Siemens--Simcenter Nastran 2306	A vulnerability has been identified in Simcenter Nastran 2306 (All versions), Simcenter Nastran 2312 (All versions), Simcenter Nastran 2406 (All versions < V2406.90). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-33577 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-33489 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-33490 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-33491 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-33492 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-33493 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-34771 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-34772 productcert@siemens.com
Siemens--Solid Edge	A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-05-14	7.8	CVE-2024-34773 productcert@siemens.com
Siemens--Tecnomatix Plant Simulation V2302	A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0011). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22974)	2024-05-14	7.8	CVE-2024-32639 productcert@siemens.com
Sirv--Sirv	Improper Privilege Management vulnerability in Sirv allows Privilege Escalation.This issue affects Sirv: from n/a through 7.2.2.	2024-05-17	8.8	CVE-2024-32959 audit@patchstack.com
Sizam Design--Rehub	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1.	2024-05-17	9	CVE-2024-31231 audit@patchstack.com
Sizam Design--Rehub	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1.	2024-05-17	8	CVE-2024-31232 audit@patchstack.com
Snow Software AB--Snow License Manager	Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.	2024-05-14	8.8	CVE-2024-4129 security@snowsoftware.com
SolarWinds--Access Rights Manager	The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.	2024-05-14	9	CVE-2024-28075 psirt@solarwinds.com psirt@solarwinds.com psirt@solarwinds.com
SolarWinds--Access Rights Manager	The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.	2024-05-14	8.6	CVE-2024-23473 psirt@solarwinds.com psirt@solarwinds.com
Sonatype--Nexus Repository	Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.	2024-05-16	7.5	CVE-2024-4956 103e4ec9-0a87-450b-af77-479448ddef11
SourceCodester--Best House Rental Management System	A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265072.	2024-05-18	7.3	CVE-2024-5093 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Best House Rental Management System	A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This issue affects some unknown processing of the file view_payment.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265073 was assigned to this vulnerability.	2024-05-18	7.3	CVE-2024-5094 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Online Discussion Forum Site	A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file registerH.php. The manipulation of the argument ima leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264455.	2024-05-16	7.3	CVE-2024-4920 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Online Examination System	A vulnerability was found in SourceCodester Online Examination System 1.0. It has been rated as critical. This issue affects some unknown processing of the file registeracc.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264743.	2024-05-17	7.3	CVE-2024-5046 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--SchoolWebTech	A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264534 is the identifier assigned to this vulnerability.	2024-05-16	7.3	CVE-2024-4966 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Student Management System	A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Affected is an unknown function of the file /student/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264744.	2024-05-17	7.3	CVE-2024-5047 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
StylemixThemes--Consulting	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.5.6.	2024-05-17	7.3	CVE-2023-37385 audit@patchstack.com
Tenable--Nessus Agent	A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292	2024-05-17	8.2	CVE-2024-3292 vulnreport@tenable.com
Tenable--Nessus Agent	When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.	2024-05-17	7.8	CVE-2024-3291 vulnreport@tenable.com
Tenable--Nessus	A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host	2024-05-17	8.2	CVE-2024-3290 vulnreport@tenable.com
Tenable--Nessus	When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.	2024-05-17	7.8	CVE-2024-3289 vulnreport@tenable.com
Teplitsa of social technologies--Leyka	Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.	2024-05-14	8.8	CVE-2023-33327 audit@patchstack.com
ThemeKraft--BuddyForms	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a through 2.8.8.	2024-05-17	8.6	CVE-2024-32830 audit@patchstack.com
ThemeNectar--Salient Core	The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_linea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.	2024-05-18	7.5	CVE-2024-3812 security@wordfence.com security@wordfence.com
ThemeNectar--Salient Shortcodes	The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.	2024-05-18	8.8	CVE-2024-3810 security@wordfence.com security@wordfence.com
Themify--Themify Ultra	Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.	2024-05-17	8.8	CVE-2023-46145 audit@patchstack.com
Thomas Scholl--canvasio3D Light	Unrestricted Upload of File with Dangerous Type vulnerability in Thomas Scholl canvasio3D Light.This issue affects canvasio3D Light: from n/a through 2.5.0.	2024-05-14	9.9	CVE-2024-34411 audit@patchstack.com
Thrive Themes--Thrive Theme Builder	Improper Privilege Management vulnerability in Thrive Themes Thrive Theme Builder allows Privilege Escalation.This issue affects Thrive Theme Builder: from n/a before 3.24.0.	2024-05-17	8.8	CVE-2023-47782 audit@patchstack.com
ThroughTek--Kalay SDK	ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity	2024-05-15	8.1	CVE-2023-6324 cve-requests@bitdefender.com
Timber Team & Contributors--Timber	Deserialization of Untrusted Data vulnerability in Timber Team & Contributors Timber.This issue affects Timber: from n/a through 1.23.0.	2024-05-14	8	CVE-2024-29800 audit@patchstack.com
Tips and Tricks HQ--WP Express Checkout (Accept PayPal Payments)	Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7.	2024-05-17	7.5	CVE-2024-30527 audit@patchstack.com
Trellix--ePolicy Orchestrator	Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.	2024-05-16	7.5	CVE-2024-4844 trellixpsirt@trellix.com
URBAN BASE--Z-Downloads	Unrestricted Upload of File with Dangerous Type vulnerability in URBAN BASE Z-Downloads.This issue affects Z-Downloads: from n/a through 1.11.3.	2024-05-14	9.1	CVE-2024-34555 audit@patchstack.com
UkrSolution--Barcode Scanner with Inventory & Order Manager	Improper Privilege Management vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allows Privilege Escalation.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3.	2024-05-17	9.8	CVE-2024-33567 audit@patchstack.com
Vova Anokhin--Shortcodes Ultimate	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.	2024-05-17	7.1	CVE-2023-25050 audit@patchstack.com
WP Automatic--Automatic	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.	2024-05-17	9.3	CVE-2024-27954 audit@patchstack.com
WP Automatic--Automatic	Cross-Site Request Forgery (CSRF) vulnerability in WP Automatic Automatic allows Privilege Escalation.This issue affects Automatic: from n/a through 3.92.0.	2024-05-17	8.3	CVE-2024-27955 audit@patchstack.com
WP Hive--Events Rich Snippets for Google	Cross-Site Request Forgery (CSRF) vulnerability in WP Hive Events Rich Snippets for Google allows Exploitation of Trusted Credentials.This issue affects Events Rich Snippets for Google: from n/a through 1.8.	2024-05-17	7.1	CVE-2023-44478 audit@patchstack.com
WP Sharks--s2Member Pro	Improper Privilege Management vulnerability in WP Sharks s2Member Pro allows Privilege Escalation.This issue affects s2Member Pro: from n/a through 240315.	2024-05-17	7.5	CVE-2024-31237 audit@patchstack.com
WP-etracker--WP etracker	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue affects WP etracker: from n/a through 1.0.2.	2024-05-14	7.1	CVE-2024-34431 audit@patchstack.com
WPCustomify--Customify Site Library	Improper Control of Generation of Code ('Code Injection') vulnerability in WPCustomify Customify Site Library allows Code Injection.This issue affects Customify Site Library: from n/a through 0.0.9.	2024-05-17	9.9	CVE-2024-33644 audit@patchstack.com
WPDeveloper--Essential Addons for Elementor	Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.	2024-05-17	8.8	CVE-2023-41955 audit@patchstack.com
WPFactory--EAN for WooCommerce	Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9.	2024-05-17	7.2	CVE-2024-34370 audit@patchstack.com
WPvivid Team--WPvivid Backup and Migration	Improper Privilege Management vulnerability in WPvivid Team WPvivid Backup and Migration allows Privilege Escalation.This issue affects WPvivid Backup and Migration: from n/a through 0.9.90.	2024-05-17	8.8	CVE-2023-41243 audit@patchstack.com
WatchGuard--AuthPoint Password Manager	Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a adversary with local access to execute code under the context of the AuthPoint Password Manager application. This issue affects AuthPoint Password Manager for MacOS versions before 1.0.6.	2024-05-16	7.8	CVE-2024-1417 5d1c2695-1a31-4499-88ae-e847036fd7e3
WebToffee--WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels	Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1.	2024-05-17	7.2	CVE-2023-51546 audit@patchstack.com
WebWizards--SalesKing	Improper Privilege Management vulnerability in WebWizards SalesKing allows Privilege Escalation.This issue affects SalesKing: from n/a through 1.6.15.	2024-05-17	9.8	CVE-2024-22157 audit@patchstack.com
WebinarPress--WebinarPress	Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress.This issue affects WebinarPress: from n/a through 1.33.17.	2024-05-14	7.1	CVE-2024-34818 audit@patchstack.com
WhatArmy--WatchTowerHQ	Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.	2024-05-17	9.8	CVE-2023-25701 audit@patchstack.com
Wholesale--WholesaleX	Improper Privilege Management vulnerability in Wholesale WholesaleX allows Privilege Escalation.This issue affects WholesaleX: from n/a through 1.3.2.	2024-05-17	9.8	CVE-2024-30542 audit@patchstack.com
Woo product importer--Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy	Missing Authorization vulnerability in Woo product importer Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1.	2024-05-14	7.5	CVE-2024-32724 audit@patchstack.com
WooCommerce--WooCommerce One Page Checkout	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.	2024-05-17	7.6	CVE-2023-35881 audit@patchstack.com
XTemos--Woodmart Core	Improper Privilege Management vulnerability in XTemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.	2024-05-17	9.8	CVE-2023-32244 audit@patchstack.com
YARPP--YARPP	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YARPP allows PHP Local File Inclusion.This issue affects YARPP: from n/a through 5.30.4.	2024-05-17	7.7	CVE-2022-45374 audit@patchstack.com
YMS--VIS Pro	YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and enumerated through brute force attacks. Successful attacks can lead to unauthorised access and execution of operations based on assigned user permissions. This vulnerability affects VIS Pro in versions <= 3.3.0.6. This vulnerability has been mitigated by changes in authentication mechanisms and implementation of additional authentication layer and strong password policies.	2024-05-14	9.8	CVE-2024-3263 incident@nbu.gov.sk incident@nbu.gov.sk
ZTE--ZXUN-ePDG	ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.	2024-05-14	8.3	CVE-2024-22064 psirt@zte.com.cn
Zabbix--Zabbix	Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.	2024-05-17	9.1	CVE-2024-22120 security@zabbix.com
abetlen--llama-cpp-python	llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.	2024-05-14	9.6	CVE-2024-34359 security-advisories@github.com security-advisories@github.com
alttextai--Alt Text AI Automatically generate image alt text for SEO and accessibility	The Alt Text AI - Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the 'last_post_id' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2024-05-15	8.8	CVE-2024-4847 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
appscreo--Easy Social Share Buttons	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appscreo Easy Social Share Buttons allows PHP Local File Inclusion.This issue affects Easy Social Share Buttons: from n/a through 9.4.	2024-05-17	8.5	CVE-2024-31300 audit@patchstack.com
artbees--JupiterX	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue affects JupiterX: from n/a through 3.0.0.	2024-05-17	7.6	CVE-2023-32110 audit@patchstack.com
aws--amazon-redshift-jdbc-driver	The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)	2024-05-15	10	CVE-2024-32888 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
dataease--dataease	DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.	2024-05-14	7.5	CVE-2024-31441 security-advisories@github.com
dotmesh-io--dotmesh	Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder. The routine `untarFile` attempts to guard against creating symbolic links that point outside the directory a tar archive is extracted to. However, a malicious tarball first linking `subdir/parent` to `..` (allowed, because `subdir/..` falls within the archive root) and then linking `subdir/parent/escapes` to `..` results in a symbolic link pointing to the tarball's parent directory, contrary to the routine's goals. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, they may be able to read arbitrary system files the parent process has permissions to read. As of time of publication, no patch for this issue is available.	2024-05-14	8.1	CVE-2020-26312 security-advisories@github.com security-advisories@github.com
eProsima--Fast-DDS	FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed `RTPS` packet, the subscriber crashes when creating `pthread`. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.	2024-05-14	8.2	CVE-2024-30258 security-advisories@github.com security-advisories@github.com security-advisories@github.com
eProsima--Fast-DDS	FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.	2024-05-14	8.2	CVE-2024-30259 security-advisories@github.com security-advisories@github.com security-advisories@github.com
freescout-helpdesk--freescout	FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. This vulnerability arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code in the context of the application's domain. Unauthenticated attackers can exploit this vulnerability to inject malicious HTML content into emails. This could lead to various attacks such as form hijacking, application defacement, or data exfiltration via CSS injection. Although unauthenticated attackers are limited to HTML injection, the consequences can still be severe. Version 1.8.139 implements strict input validation and sanitization mechanisms to ensure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections.	2024-05-14	7.6	CVE-2024-34697 security-advisories@github.com security-advisories@github.com
froxlor--Froxlor	Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.	2024-05-14	9.6	CVE-2024-34070 security-advisories@github.com security-advisories@github.com
getgrav--grav	Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the web server by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. A low privileged user may also perform a full account takeover of other registered users including Administrators. Version 1.7.46 contains a patch.	2024-05-15	8.5	CVE-2024-34082 security-advisories@github.com security-advisories@github.com
git--git	Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.	2024-05-14	9	CVE-2024-32002 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
git--git	Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources.	2024-05-14	8.1	CVE-2024-32004 security-advisories@github.com security-advisories@github.com security-advisories@github.com
git--git	Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.	2024-05-14	7.3	CVE-2024-32465 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
google -- chrome	Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)	2024-05-14	9.6	CVE-2024-4671 chrome-cve-admin@google.com chrome-cve-admin@google.com
hakeemnala--Build App Online	The Build App Online plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.21. This is due to missing authentication checking in the 'set_user_cart' function with the 'user_id' header value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.	2024-05-18	9.8	CVE-2024-3658 security@wordfence.com security@wordfence.com
hoppscotch--hoppscotch-extension	The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversight during a change made to the extension in the commit d4e8e4830326f46ba17acd1307977ecd32a85b58, a critical check for the origin list was missed and allowed for messages to be sent to the extension which the extension gladly processed and responded back with the results of, while this wasn't supposed to happen and be blocked by the origin not being present in the origin list. This vulnerability exposes Hoppscotch Extension users to sites which call into Hoppscotch Extension APIs internally. This fundamentally allows any site running on the browser with the extension installed to bypass CORS restrictions if the user is running extensions with the given version. This security hole was patched in the commit 7e364b928ab722dc682d0fcad713a96cc38477d6 which was released along with the extension version `0.35`. As a workaround, Chrome users can use the Extensions Settings to disable the extension access to only the origins that you want. Firefox doesn't have an alternative to upgrading to a fixed version.	2024-05-14	7.6	CVE-2024-34714 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
icegram--Email Subscribers by Icegram Express Email Marketing, Newsletters, Automation for WordPress & WooCommerce	The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handle_ajax_request function in all versions up to, and including, 5.7.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to cause a loss of confidentiality, integrity, and availability, by performing multiple unauthorized actions. Some of these actions could also be leveraged to conduct PHP Object Injection and SQL Injection attacks.	2024-05-15	8.8	CVE-2024-4010 security@wordfence.com security@wordfence.com
jetmonsters--Hotel Booking Lite	The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2024-05-14	9.8	CVE-2024-4413 security@wordfence.com security@wordfence.com security@wordfence.com
jottlieb--Last Viewed Posts by WPBeginner	The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2024-05-14	9.8	CVE-2024-3070 security@wordfence.com security@wordfence.com
kognetiks--Kognetiks Chatbot for WordPress	The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upload_file_to_assistant function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers, with to upload arbitrary files on the affected site's server which may make remote code execution possible.	2024-05-14	9.8	CVE-2024-4560 security@wordfence.com security@wordfence.com
lobehub--lobe-chat	Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.	2024-05-14	9	CVE-2024-32964 security-advisories@github.com security-advisories@github.com
mantisbt--mantisbt	MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).	2024-05-14	7.3	CVE-2024-34077 security-advisories@github.com security-advisories@github.com security-advisories@github.com
metaphorcreations--Ditty Responsive News Tickers, Sliders, and Lists	The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2024-05-14	8.8	CVE-2024-3954 security@wordfence.com security@wordfence.com
micromatch--braces	The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.	2024-05-14	7.5	CVE-2024-4068 596c5446-0ce5-4ba2-aa66-48b3b757a647 596c5446-0ce5-4ba2-aa66-48b3b757a647 596c5446-0ce5-4ba2-aa66-48b3b757a647
micromatch--micromatch	The NPM package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.	2024-05-14	7.5	CVE-2024-4067 596c5446-0ce5-4ba2-aa66-48b3b757a647 596c5446-0ce5-4ba2-aa66-48b3b757a647 596c5446-0ce5-4ba2-aa66-48b3b757a647 596c5446-0ce5-4ba2-aa66-48b3b757a647
microsoft -- windows_10_1507	Windows MSHTML Platform Security Feature Bypass Vulnerability	2024-05-14	8.8	CVE-2024-30040 secure@microsoft.com
microsoft -- windows_10_1507	Windows DWM Core Library Elevation of Privilege Vulnerability	2024-05-14	7.8	CVE-2024-30051 secure@microsoft.com
miniOrange--WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)	Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.	2024-05-17	8	CVE-2023-47683 audit@patchstack.com
monetizemore--Advanced Ads Ad Manager & AdSense	The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placement_slug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2024-05-14	7.2	CVE-2024-2290 security@wordfence.com security@wordfence.com security@wordfence.com
n/a--Intel(R) Arc(TM) & Iris(R) Xe Graphics software	Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.	2024-05-16	7.8	CVE-2024-21864 secure@intel.com
n/a--Intel(R) BIOS Guard firmware	Improper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access.	2024-05-16	7.2	CVE-2023-27504 secure@intel.com
n/a--Intel(R) BIOS Guard firmware	Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via local access.	2024-05-16	7.2	CVE-2023-28402 secure@intel.com
n/a--Intel(R) DTT software installers	Exposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	7.9	CVE-2024-21813 secure@intel.com
n/a--Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware	Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.	2024-05-16	7.2	CVE-2022-37341 secure@intel.com
n/a--Intel(R) GPA Framework software installers	Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	7.8	CVE-2023-43748 secure@intel.com
n/a--Intel(R) GPA software installers	Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	8.2	CVE-2023-24460 secure@intel.com
n/a--Intel(R) GPA software installers	Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	7.3	CVE-2023-40071 secure@intel.com
n/a--Intel(R) GPA software installers	Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	7.8	CVE-2023-43629 secure@intel.com
n/a--Intel(R) Neural Compressor software	Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.	2024-05-16	10	CVE-2024-22476 secure@intel.com
n/a--Intel(R) Power Gadget software for Windows	Buffer overflow in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	8.8	CVE-2023-38581 secure@intel.com
n/a--Intel(R) Power Gadget software for Windows	Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	8.8	CVE-2023-42773 secure@intel.com
n/a--Intel(R) Power Gadget software for Windows	Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	8.8	CVE-2023-45217 secure@intel.com
n/a--Intel(R) Power Gadget software for Windows	Use after free in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	7.9	CVE-2023-46691 secure@intel.com
n/a--Intel(R) Power Gadget software for macOS	Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	8.8	CVE-2023-40070 secure@intel.com
n/a--Intel(R) Power Gadget software for macOS	Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	8.8	CVE-2023-46689 secure@intel.com
n/a--Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs	Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated user to potentially enable denial of service via adjacent access.	2024-05-16	7.6	CVE-2023-41092 secure@intel.com
n/a--Intel(R) TDX module software	Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.	2024-05-16	7.9	CVE-2023-45745 secure@intel.com
n/a--Intel(R) Thunderbolt driver software	Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	7	CVE-2022-37410 secure@intel.com
n/a--PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products	Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.	2024-05-16	7.5	CVE-2024-22382 secure@intel.com
n/a--UEFI firmware for some Intel(R) Server D50DNP Family products	Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.	2024-05-16	7.2	CVE-2024-22095 secure@intel.com
n/a--UEFI firmware for some Intel(R) Server D50DNP Family products	Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.	2024-05-16	7.5	CVE-2024-23487 secure@intel.com
n/a--UEFI firmware for some Intel(R) Server D50FCP Family products	Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privileged user to enable escalation of privilege via local access.	2024-05-16	7.5	CVE-2024-23980 secure@intel.com
n/a--UEFI firmware for some Intel(R) Server M50FCP Family products	Improper input validation in PfrSmiUpdateFw driver in UEFI firmware for some Intel(R) Server M50FCP Family products may allow a privileged user to enable escalation of privilege via local access.	2024-05-16	7.5	CVE-2024-24981 secure@intel.com
n/a--n/a	An issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows. Because it is possible to tamper with the directory and DLL files used during the installation process, an attacker can escalate privileges through arbitrary code execution. (An attacker must already have user privileges)	2024-05-14	7.3	CVE-2024-31954 cve@mitre.org
n/a--some Intel(R) PROSet/Wireless WiFi software for Windows	Improper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.	2024-05-16	8.2	CVE-2023-38654 secure@intel.com
nautobot--nautobot	Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.	2024-05-14	7.5	CVE-2024-34707 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
nocodb--nocodb	NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.	2024-05-14	7.3	CVE-2023-49781 security-advisories@github.com security-advisories@github.com
npgsql--npgsql	Npgsql is the .NET data provider for PostgreSQL. The `WriteBind()` method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs` uses `int` variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. This vulnerability is fixed in 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7, and 8.0.3.	2024-05-14	8.1	CVE-2024-32655 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
nvidia--ChatRTX	NVIDIA ChatRTX for Windows contains a vulnerability in Chat RTX UI, where a user can cause an improper privilege management issue by sending user inputs to change execution flow. A successful exploit of this vulnerability might lead to information disclosure, escalation of privileges, and data tampering.	2024-05-14	7.5	CVE-2024-0096 psirt@nvidia.com
nvidia--ChatRTX	NVIDIA ChatRTX for Windows contains a vulnerability in ChatRTX UI, where a user can cause an improper privilege management issue by exploiting interprocess communication between different processes. A successful exploit of this vulnerability might lead to information disclosure, escalation of privileges, and data tampering.	2024-05-14	7.5	CVE-2024-0097 psirt@nvidia.com
nvidia--NVIDIA Triton Inference Server	NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file. If this file exists, logs are appended to the file. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.	2024-05-14	9	CVE-2024-0087 psirt@nvidia.com
pencidesign--Penci Soledad Data Migrator	The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. This is limited to just PHP files.	2024-05-17	9.8	CVE-2024-3551 security@wordfence.com security@wordfence.com
plainware--ShiftController Employee Shift Scheduling	The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie in versions up to, and including, 4.9.57. This makes it possible for an authenticated attacker with contributor access-level or above to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2024-05-16	7.5	CVE-2024-4733 security@wordfence.com security@wordfence.com
plugins360--All-in-One Video Gallery	The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.	2024-05-15	8.8	CVE-2024-4670 security@wordfence.com security@wordfence.com
powerfulwp--Local Delivery Drivers for WooCommerce	Improper Privilege Management vulnerability in powerfulwp Local Delivery Drivers for WooCommerce allows Privilege Escalation.This issue affects Local Delivery Drivers for WooCommerce: from n/a through 1.9.0.	2024-05-17	9.8	CVE-2023-51481 audit@patchstack.com
ravanh--XML Sitemap & Google News	The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.	2024-05-14	8.1	CVE-2024-4441 security@wordfence.com security@wordfence.com
smp7, wp.insider--Simple Membership	Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.	2024-05-17	8.8	CVE-2023-41956 audit@patchstack.com
smp7, wp.insider--Simple Membership	Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4.	2024-05-17	8.6	CVE-2023-41957 audit@patchstack.com
spacemeshos--go-spacemesh	go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule and can serve as an attack vector where Nodes are rewarded for holding their PoST data for less than one epoch but still being eligible for rewards. This vulnerability is fixed in go-spacemesh 1.5.2-hotfix1 and Spacemesh API 1.37.1.	2024-05-14	8.2	CVE-2024-34360 security-advisories@github.com security-advisories@github.com security-advisories@github.com
spoonthemes--Adifier System	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spoonthemes Adifier System allows PHP Local File Inclusion.This issue affects Adifier System: from n/a before 3.1.4.	2024-05-17	7.5	CVE-2023-49753 audit@patchstack.com
stalwartlabs--mail-server	Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user (including web interface admins) can gain complete root access to the system. Usually, system services are run as a separate user (not as root) to isolate an attacker with Arbitrary Code Execution to the current service. Therefore, other system services and the system itself remains protected in case of a successful attack. stalwart-mail runs as a separate user, but it can give itself full privileges again in a simple way, so this protection is practically ineffective. Server admins who handed out the admin credentials to the mail server, but didn't want to hand out complete root access to the system, as well as any attacked user when the attackers gained Arbitrary Code Execution using another vulnerability, may be vulnerable. Version 0.8.0 contains a patch for the issue.	2024-05-16	9.1	CVE-2024-35187 security-advisories@github.com
strongSwan--strongSwan	strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).	2024-05-14	7.7	CVE-2022-4967 security@ubuntu.com security@ubuntu.com security@ubuntu.com
supsystic.com--Popup by Supsystic	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10.19.	2024-05-17	8.8	CVE-2023-46197 audit@patchstack.com
techjewel--Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder	The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.	2024-05-18	9.8	CVE-2024-2771 security@wordfence.com security@wordfence.com
techjewel--Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder	The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.	2024-05-18	7.5	CVE-2024-2782 security@wordfence.com security@wordfence.com
techjewel--Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder	The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	7.2	CVE-2024-4709 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
themeisle--Visualizer: Tables and Charts Manager for WordPress	The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queries that can be leveraged for privilege escalation among many other actions.	2024-05-16	8.8	CVE-2024-3750 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
themeum--Tutor LMS eLearning and online course solution	The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.	2024-05-16	9.8	CVE-2024-4223 security@wordfence.com security@wordfence.com
themeum--Tutor LMS eLearning and online course solution	The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the 'question_id' parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2024-05-16	8.8	CVE-2024-4318 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
themium--Tutor LMS Pro	The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.	2024-05-16	8.8	CVE-2024-4351 security@wordfence.com security@wordfence.com
themium--Tutor LMS Pro	The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'get_calendar_materials' function. The plugin is also vulnerable to SQL Injection via the 'year' parameter of that function due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2024-05-16	8.8	CVE-2024-4352 security@wordfence.com security@wordfence.com
themium--Tutor LMS Pro	The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.	2024-05-16	7.3	CVE-2024-4222 security@wordfence.com security@wordfence.com
thimpress--LearnPress WordPress LMS Plugin	The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'term_id' parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2024-05-14	9.8	CVE-2024-4434 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
thimpress--LearnPress WordPress LMS Plugin	The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.	2024-05-14	8.8	CVE-2024-4397 security@wordfence.com security@wordfence.com security@wordfence.com
unitecms--Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2024-05-14	8.8	CVE-2024-3055 security@wordfence.com security@wordfence.com security@wordfence.com
unitecms--Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.	2024-05-14	7.2	CVE-2024-2662 security@wordfence.com security@wordfence.com
valtimo-platform--valtimo-frontend-libraries	Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.	2024-05-14	9.8	CVE-2024-34706 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
vendor or project--product name	A potential vulnerability has been identified for OpenText Operations Bridge Reporter. The vulnerability could be exploited to inject malicious SQL queries. An attack requires to be an authenticated administrator of OBR with network access to the OBR web application.	2024-05-17	7.2	CVE-2021-22508 security@opentext.com
vercel--next.js	Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions. For a request to be exploitable, the affected route also had to be making use of the [rewrites](https://nextjs.org/docs/app/api-reference/next-config-js/rewrites) feature in Next.js. The vulnerability is resolved in Next.js `13.5.1` and newer.	2024-05-14	7.5	CVE-2024-34350 security-advisories@github.com
vercel--next.js	Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.	2024-05-14	7.5	CVE-2024-34351 security-advisories@github.com security-advisories@github.com security-advisories@github.com
weDevs--WP User Frontend	Improper Privilege Management vulnerability in weDevs WP User Frontend allows Privilege Escalation.This issue affects WP User Frontend: from n/a through 3.6.5.	2024-05-17	7.2	CVE-2023-47682 audit@patchstack.com
wpForo--wpForo Forum	Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.3.	2024-05-17	7.3	CVE-2023-47868 audit@patchstack.com

Medium Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
10Web Form Builder Team--Form Maker by 10Web	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.24.	2024-05-14	5.9	CVE-2024-34437 audit@patchstack.com
1Panel-dev--1Panel	1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.	2024-05-14	6.5	CVE-2024-34352 security-advisories@github.com
ABB--RobotWare 6	An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible. The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific condition when specially crafted message is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07 * OmniCore- RobotWare 7 < 7.14	2024-05-14	6.5	CVE-2024-1914 cybersecurity@ch.abb.com
AREOI--All Bootstrap Blocks	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AREOI All Bootstrap Blocks allows Stored XSS.This issue affects All Bootstrap Blocks: from n/a through 1.3.15.	2024-05-14	5.9	CVE-2024-35169 audit@patchstack.com
AROX SOLUTION--School ERP Pro+Responsive	Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session.	2024-05-14	6.5	CVE-2024-4822 cve-coordination@incibe.es
AROX SOLUTION--School ERP Pro+Responsive	Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.	2024-05-14	6.5	CVE-2024-4823 cve-coordination@incibe.es
Academy LMS--Academy LMS	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.25.	2024-05-14	5.3	CVE-2024-35171 audit@patchstack.com
Adam DeHaven--Perfect Pullquotes	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam DeHaven Perfect Pullquotes allows Stored XSS.This issue affects Perfect Pullquotes: from n/a through 1.7.5.	2024-05-14	6.5	CVE-2024-33951 audit@patchstack.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	5.5	CVE-2024-30311 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	5.5	CVE-2024-30312 psirt@adobe.com
Adobe--Acrobat Reader	Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-15	5.5	CVE-2024-34101 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30283 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30286 psirt@adobe.com
Adobe--Adobe Framemaker	Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30287 psirt@adobe.com
Adobe--Animate	Animate versions 24.0.2, 23.0.5 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30298 psirt@adobe.com
Adobe--Illustrator	Illustrator versions 28.4, 27.9.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-20793 psirt@adobe.com
Adobe--Substance3D - Designer	Substance3D - Designer versions 13.1.1 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30281 psirt@adobe.com
Adobe--Substance3D - Painter	Substance3D - Painter versions 9.1.2 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30308 psirt@adobe.com
Adobe--Substance3D - Painter	Substance3D - Painter versions 9.1.2 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-05-16	5.5	CVE-2024-30309 psirt@adobe.com
Aleksei Polechin (alek)--Archives Calendar Widget	Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.	2024-05-14	5.9	CVE-2024-33950 audit@patchstack.com
AlexaCRM--Dynamics 365 Integration	Insertion of Sensitive Information into Log File vulnerability in AlexaCRM Dynamics 365 Integration.This issue affects Dynamics 365 Integration: from n/a through 1.3.17.	2024-05-14	5.3	CVE-2024-34550 audit@patchstack.com
Andy Moyle--Church Admin	Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 4.1.6.	2024-05-17	6.3	CVE-2024-31281 audit@patchstack.com
Andy Moyle--Church Admin	Cross-Site Request Forgery (CSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 4.1.32.	2024-05-14	4.3	CVE-2024-34828 audit@patchstack.com
AppPresser Team--AppPresser	Missing Authorization vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0.	2024-05-14	6.5	CVE-2024-32776 audit@patchstack.com
Artbees--SellKit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Artbees SellKit allows Relative Path Traversal.This issue affects SellKit: from n/a through 1.8.1.	2024-05-17	6.5	CVE-2024-30509 audit@patchstack.com
Atanas Yonkov--Pliska	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Yonkov Pliska allows Stored XSS.This issue affects Pliska: from n/a through 0.3.5.	2024-05-14	6.5	CVE-2024-33954 audit@patchstack.com
Automattic--WP Job Manager	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.2.2.	2024-05-14	5.3	CVE-2024-34549 audit@patchstack.com
BdThemes--Ultimate Store Kit Elementor Addons	Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.2.	2024-05-14	5.4	CVE-2024-4606 audit@patchstack.com
Benoti--Brozzme Scroll Top	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue affects Brozzme Scroll Top: from n/a through 1.8.5.	2024-05-14	5.9	CVE-2024-34426 audit@patchstack.com
BestWebSoft--Captcha by BestWebSoft	Guessable CAPTCHA vulnerability in BestWebSoft Captcha by BestWebSoft allows Functionality Bypass.This issue affects Captcha by BestWebSoft: from n/a through 5.2.0.	2024-05-17	5.3	CVE-2024-31295 audit@patchstack.com
BetterAddons--Better Elementor Addons	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons better-elementor-addons allows Stored XSS.This issue affects Better Elementor Addons: from n/a through 1.4.4.	2024-05-14	6.5	CVE-2024-34432 audit@patchstack.com
Bootstrapped Ventures--Easy Affiliate Links	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures Easy Affiliate Links allows Stored XSS.This issue affects Easy Affiliate Links: from n/a through 3.7.2.	2024-05-14	6.5	CVE-2024-34441 audit@patchstack.com
Brainstorm Force--Ultimate Addons for Beaver Builder	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Relative Path Traversal.This issue affects Ultimate Addons for Beaver Builder: from n/a through 1.35.13.	2024-05-17	6.3	CVE-2023-51401 audit@patchstack.com
Byzoro--Smart S200 Management Platform	A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264437 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-15	6.3	CVE-2024-4904 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
CRM Perks--Integration for Contact Form 7 HubSpot	Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 HubSpot.This issue affects Integration for Contact Form 7 HubSpot: from n/a through 1.3.1.	2024-05-17	4.3	CVE-2024-34756 audit@patchstack.com
CRM Perks--Integration for Contact Form 7 and Salesforce	Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9.	2024-05-17	4.3	CVE-2024-34755 audit@patchstack.com
CRM Perks--Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms	Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.0.	2024-05-14	4.3	CVE-2024-34817 audit@patchstack.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.	2024-05-14	6.1	CVE-2024-30268 security-advisories@github.com security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.	2024-05-14	6.5	CVE-2024-31460 security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.	2024-05-14	5.4	CVE-2024-29894 security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.	2024-05-14	5.7	CVE-2024-31443 security-advisories@github.com security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.	2024-05-14	4.6	CVE-2024-31444 security-advisories@github.com
Cacti--cacti	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_nontemplated_fields_graph_item()` function from `lib/html_form_templates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.	2024-05-14	4.6	CVE-2024-31458 security-advisories@github.com
Campcodes--Complete Web-Based School Management System	A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/show_student1.php. The manipulation of the argument grade leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264441 was assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4906 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/show_student2.php. The manipulation of the argument grade leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264442 is the identifier assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4907 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view/student_attendance_history1.php. The manipulation of the argument index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264443.	2024-05-15	6.3	CVE-2024-4908 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /view/student_due_payment.php. The manipulation of the argument due_year leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264444.	2024-05-15	6.3	CVE-2024-4909 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/student_exam_mark_insert_form1.php. The manipulation of the argument grade leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264445 was assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4910 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/student_exam_mark_update_form.php. The manipulation of the argument exam leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264446 is the identifier assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4911 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability, which was classified as critical, was found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/general-setting of the component Setting Handler. The manipulation of the argument favicon/logo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263622 is the identifier assigned to this vulnerability.	2024-05-14	4.7	CVE-2024-4681 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability classified as critical has been found in Campcodes Online Examination System 1.0. This affects an unknown part of the file addExamExe.php. The manipulation of the argument examTitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264447.	2024-05-15	6.3	CVE-2024-4912 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability classified as critical was found in Campcodes Online Examination System 1.0. This vulnerability affects unknown code of the file exam.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264448.	2024-05-15	6.3	CVE-2024-4913 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. This issue affects some unknown processing of the file ranking-exam.php. The manipulation of the argument exam_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264449 was assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4914 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. Affected is an unknown function of the file result.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264450 is the identifier assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4915 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability has been found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file selExamAttemptExe.php. The manipulation of the argument thisId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264451.	2024-05-15	6.3	CVE-2024-4916 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file submitAnswerExe.php. The manipulation of the argument exmne_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264452.	2024-05-15	6.3	CVE-2024-4917 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. This affects an unknown part of the file updateQuestion.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264453 was assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4918 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Examination System	A vulnerability was found in Campcodes Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /adminpanel/admin/query/addCourseExe.php. The manipulation of the argument course_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264454 is the identifier assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4919 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability, which was classified as critical, has been found in Campcodes Online Laundry Management System 1.0. This issue affects some unknown processing of the file /admin_class.php. The manipulation of the argument id/delete_category/delete_inv/delete_laundry/delete_supply/delete_user/login/save_inv/save_user leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263891.	2024-05-14	6.3	CVE-2024-4792 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability, which was classified as critical, was found in Campcodes Online Laundry Management System 1.0. Affected is an unknown function of the file /manage_laundry.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263892.	2024-05-14	6.3	CVE-2024-4793 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage_receiving.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263893 was assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4794 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263894 is the identifier assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4795 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as critical. This affects an unknown part of the file /manage_inv.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263895.	2024-05-14	6.3	CVE-2024-4796 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manage_user.php of the component HTTP Request Parameter Handler. The manipulation of the argument id leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263938 is the identifier assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4817 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263939.	2024-05-14	5.3	CVE-2024-4818 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file admin_class.php. The manipulation of the argument type with the input 1 leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263940.	2024-05-14	4.3	CVE-2024-4819 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Cisco--Cisco AppDynamics	A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to the inability to handle unexpected input. An attacker who has local device access could exploit this vulnerability by sending an HTTP request to the targeted service. A successful exploit could allow the attacker to cause a DoS condition by stopping the Network Agent Service on the local device.	2024-05-15	5.5	CVE-2024-20394 ykramarz@cisco.com
Cisco--Cisco Network Services Orchestrator	A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of a parameter in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website.	2024-05-15	4.7	CVE-2024-20369 ykramarz@cisco.com
Cisco--Cisco Secure Client	A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM. This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device.	2024-05-15	6.8	CVE-2024-20391 ykramarz@cisco.com
Cisco--Cisco Secure Email and Web Manager	A vulnerability in the Cisco Crosswork NSO CLI and the ConfD CLI could allow an authenticated, low-privileged, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to an incorrect privilege assignment when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command. A successful exploit could allow the attacker to elevate privileges to root on the underlying operating system.	2024-05-15	4.8	CVE-2024-20383 ykramarz@cisco.com
Cisco--Cisco Secure Email	A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	2024-05-15	6.1	CVE-2024-20258 ykramarz@cisco.com
Cisco--Cisco Secure Email	A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to the web-based management API of the affected system. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to perform cross-site scripting (XSS) attacks, resulting in the execution of arbitrary script code in the browser of the targeted user, or could allow the attacker to access sensitive, browser-based information.	2024-05-15	6.1	CVE-2024-20392 ykramarz@cisco.com
Cisco--Cisco Secure Email	A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.r This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	2024-05-15	4.8	CVE-2024-20257 ykramarz@cisco.com
Cisco--Cisco Secure Web Appliance	A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	2024-05-15	4.8	CVE-2024-20256 ykramarz@cisco.com
CodeBard--Fast Custom Social Share by CodeBard	Cross-Site Request Forgery (CSRF) vulnerability in CodeBard Fast Custom Social Share by CodeBard.This issue affects Fast Custom Social Share by CodeBard: from n/a through 1.1.2.	2024-05-17	4.3	CVE-2024-34807 audit@patchstack.com
CodePeople--Appointment Hour Booking	Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Appointment Hour Booking allows Removing Important Client Functionality.This issue affects Appointment Hour Booking: from n/a through 1.4.56.	2024-05-17	5.3	CVE-2024-32720 audit@patchstack.com
CodePeople--CP Polls	: Improper Control of Interaction Frequency vulnerability in CodePeople CP Polls allows Flooding.This issue affects CP Polls: from n/a through 1.0.71.	2024-05-17	5.3	CVE-2024-24873 audit@patchstack.com
CodePeople--CP Polls	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP Polls: from n/a through 1.0.71.	2024-05-17	5.3	CVE-2024-24874 audit@patchstack.com
Codezips--E-Commerce Site	A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264460.	2024-05-16	6.3	CVE-2024-4923 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Codezips--E-Commerce Site	A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264746 is the identifier assigned to this vulnerability.	2024-05-17	6.3	CVE-2024-5049 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban--TranslatePress	Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects TranslatePress: from n/a through 2.7.5.	2024-05-14	4.3	CVE-2024-34827 audit@patchstack.com
Cozmoslabs--Profile Builder	Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from n/a through 3.11.2.	2024-05-17	5.3	CVE-2024-31341 audit@patchstack.com
Creative Motion--Clearfy Cache	Cross-Site Request Forgery (CSRF) vulnerability in Creative Motion Clearfy Cache.This issue affects Clearfy Cache: from n/a through 2.2.1.	2024-05-17	4.3	CVE-2024-34806 audit@patchstack.com
CriticalMoments--CMSaasStarter	CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.	2024-05-14	6.5	CVE-2024-34354 security-advisories@github.com security-advisories@github.com security-advisories@github.com
CyberPower--PowerPanel business	Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.	2024-05-15	6.5	CVE-2024-31409 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
CyberPower--PowerPanel business	The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered.	2024-05-15	4.9	CVE-2024-32042 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
Dassault Systmes--3DSwymer	A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code.	2024-05-17	5.4	CVE-2023-5597 3DS.Information-Security@3ds.com
Dell--PowerScale OneFS	Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service.	2024-05-14	6.1	CVE-2024-25965 security_alert@emc.com
Dell--PowerScale OneFS	Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.	2024-05-14	6.7	CVE-2024-25967 security_alert@emc.com
Dell--PowerScale OneFS	Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.	2024-05-14	6.2	CVE-2024-25969 security_alert@emc.com
Dell--PowerScale OneFS	Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity.	2024-05-14	6.5	CVE-2024-25970 security_alert@emc.com
Dell--PowerScale OneFS	Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.	2024-05-14	5.3	CVE-2024-25966 security_alert@emc.com
Dell--PowerScale OneFS	Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.	2024-05-14	5.9	CVE-2024-25968 security_alert@emc.com
Easy Digital Downloads--Easy Digital Downloads	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.	2024-05-14	5.3	CVE-2024-32100 audit@patchstack.com
Easy Digital Downloads--Easy Digital Downloads	Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.	2024-05-14	4.3	CVE-2024-31113 audit@patchstack.com
Elegant Themes--Divi Builder	The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the 'title' parameter in versions up to, and including, 4.25.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4490 security@wordfence.com security@wordfence.com security@wordfence.com
EnvoThemes--Envo's Elementor Templates & Widgets for WooCommerce	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through 1.4.8.	2024-05-14	6.5	CVE-2024-35167 audit@patchstack.com
Eric Alli--Google Typography	Missing Authorization vulnerability in Eric Alli Google Typography.This issue affects Google Typography: from n/a through 1.1.2.	2024-05-14	4.3	CVE-2024-33942 audit@patchstack.com
Extend Themes--EmpowerWP	Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.	2024-05-17	4.3	CVE-2024-34809 audit@patchstack.com
Felix Moira--Popup More Popups	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.	2024-05-17	5.9	CVE-2024-32800 audit@patchstack.com
Flothemes--Flo Forms	Missing Authorization vulnerability in Flothemes Flo Forms.This issue affects Flo Forms: from n/a through 1.0.42.	2024-05-17	5.3	CVE-2024-35174 audit@patchstack.com
FmeAddons--Conditional Checkout Fields for WooCommerce	Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3.	2024-05-17	5.3	CVE-2022-45070 audit@patchstack.com
Fortinet--FortiADC	An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins.	2024-05-14	5.5	CVE-2023-50180 psirt@fortinet.com
Fortinet--FortiNAC	An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.	2024-05-14	6.8	CVE-2024-31488 psirt@fortinet.com
Fortinet--FortiOS	A double free vulnerability [CWE-415] in Fortinet FortiOS before 7.0.0 may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.	2024-05-14	6.6	CVE-2023-44247 psirt@fortinet.com
Fortinet--FortiOS	An improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated attacker to provoke a denial of service on the administrative interface via crafted HTTP requests.	2024-05-14	5.3	CVE-2024-26007 psirt@fortinet.com
Fortinet--FortiProxy	A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands	2024-05-14	6.7	CVE-2023-36640 psirt@fortinet.com
Fortinet--FortiProxy	A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.5, 7.0.0 through 7.0.11, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 FortiPAM versions 1.1.0, 1.0.0 through 1.0.3 FortiOS versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15 FortiSwitchManager versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.	2024-05-14	6.7	CVE-2023-45583 psirt@fortinet.com
Fortinet--FortiProxy	An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.	2024-05-14	5	CVE-2023-45586 psirt@fortinet.com
GE HealthCare--EchoPAC Software Only	Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products	2024-05-14	6.8	CVE-2024-27108 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--EchoPAC Software Only	Vulnerable data in transit in GE HealthCare EchoPAC products	2024-05-14	5.7	CVE-2024-27106 171caf72-b841-4e04-a68e-93493aff2b94
GE HealthCare--Venue	Path traversal vulnerability in "deleteFiles" function of Common Service Desktop, a GE HealthCare ultrasound device component	2024-05-14	6.2	CVE-2024-1629 171caf72-b841-4e04-a68e-93493aff2b94
GZTimeWalker--GZCTF	GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in `v0.20.1`.	2024-05-14	6.5	CVE-2024-34699 security-advisories@github.com security-advisories@github.com
German Mesky--GMAce	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in German Mesky GMAce allows Path Traversal.This issue affects GMAce: from n/a through 1.5.2.	2024-05-17	4.9	CVE-2023-23872 audit@patchstack.com
GhozyLab, Inc.--Popup Builder	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29.	2024-05-17	5.9	CVE-2024-34567 audit@patchstack.com
GitLab--GitLab	An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages can lead to a regular expression DoS attack on the server.	2024-05-14	6.5	CVE-2023-6682 cve@gitlab.com cve@gitlab.com
GitLab--GitLab	An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat Messages integration may lead to a regular expression DoS attack on the server.	2024-05-14	6.5	CVE-2023-6688 cve@gitlab.com cve@gitlab.com
GitLab--GitLab	An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.	2024-05-14	6.5	CVE-2024-2454 cve@gitlab.com cve@gitlab.com
GitLab--GitLab	An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.	2024-05-14	6.5	CVE-2024-2651 cve@gitlab.com cve@gitlab.com
GitLab--GitLab	An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.	2024-05-14	5.7	CVE-2024-4597 cve@gitlab.com
GitLab--GitLab	An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.	2024-05-14	4.3	CVE-2024-4539 cve@gitlab.com
Google--Gvisor	A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6	2024-05-15	4.8	CVE-2023-7258 cve-coordination@google.com
Guido--VS Contact Form	Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7.	2024-05-17	5.3	CVE-2024-30540 audit@patchstack.com
Gutenify--Gutenify	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gutenify.This issue affects Gutenify: from n/a through 1.4.0.	2024-05-14	5.3	CVE-2024-35165 audit@patchstack.com
HCL Software--BigFix Platform	An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems.	2024-05-17	6.7	CVE-2024-23583 psirt@hcl.com
HCL Software--BigFix Platform	Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).	2024-05-18	5.7	CVE-2024-23554 psirt@hcl.com
HCL Software--BigFix Platform	SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.	2024-05-18	5.9	CVE-2024-23556 psirt@hcl.com
HCL Software--DRYiCE Lucy	HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.	2024-05-14	6.5	CVE-2023-37526 psirt@hcl.com
Harknell--AWSOM News Announcement	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harknell AWSOM News Announcement allows Stored XSS.This issue affects AWSOM News Announcement: from n/a through 1.6.0.	2024-05-14	5.9	CVE-2024-34428 audit@patchstack.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.	2024-05-14	5.3	CVE-2024-31478 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.	2024-05-14	5.3	CVE-2024-31479 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.	2024-05-14	5.3	CVE-2024-31480 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.	2024-05-14	5.3	CVE-2024-31481 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.	2024-05-14	5.3	CVE-2024-31482 security-alert@hpe.com
Hewlett Packard Enterprise (HPE)--Aruba InstantOS and Aruba Access Points running ArubaOS 10	An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.	2024-05-14	4.9	CVE-2024-31483 security-alert@hpe.com
Hidden Depth--Sticky banner	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidden Depth Sticky banner allows Stored XSS.This issue affects Sticky banner: from n/a through 1.2.0.	2024-05-14	5.9	CVE-2024-35170 audit@patchstack.com
Highfivery LLC--Zero Spam	Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.	2024-05-17	5.3	CVE-2024-32521 audit@patchstack.com
Huawei--HarmonyOS	The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerability may affect confidentiality.	2024-05-14	6.2	CVE-2023-52721 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	6.1	CVE-2024-32990 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	6.2	CVE-2024-32995 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	6.2	CVE-2024-32996 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	6.8	CVE-2024-32999 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	6.4	CVE-2024-4046 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	5.6	CVE-2024-32993 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	NULL pointer access vulnerability in the clock module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	5.9	CVE-2024-32998 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	4.7	CVE-2023-52383 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	4.7	CVE-2023-52384 psirt@huawei.com psirt@huawei.com
Huawei--HarmonyOS	Race condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	4.1	CVE-2023-52720 psirt@huawei.com psirt@huawei.com
Huseyin Berberoglu--WP Favorite Posts	Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Favorite Posts.This issue affects WP Favorite Posts: from n/a through 1.6.8.	2024-05-14	4.3	CVE-2024-34427 audit@patchstack.com
IBM--App Connect Enterprise	IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 285245.	2024-05-14	5.4	CVE-2024-28761 psirt@us.ibm.com psirt@us.ibm.com
IBM--App Connect Enterprise	IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restrictions of resource allocation. IBM X-Force ID: 285244.	2024-05-14	4.3	CVE-2024-28760 psirt@us.ibm.com psirt@us.ibm.com
IBM--QRadar SIEM	IBM QRadar SIEM 7.5 could allow a privileged user to configure user management that would disclose unintended sensitive information across tenants. IBM X-Force ID: 284575.	2024-05-14	6.8	CVE-2024-27269 psirt@us.ibm.com psirt@us.ibm.com
IBM--SDK, Java Technology Edition	The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.	2024-05-14	5.9	CVE-2023-38264 psirt@us.ibm.com psirt@us.ibm.com
IBM--Security Guardium	IBM Security Guardium 12.0 could allow a privileged user to perform unauthorized actions that could lead to a denial of service. IBM X-Force ID: 271690.	2024-05-16	4.4	CVE-2023-47717 psirt@us.ibm.com psirt@us.ibm.com
IBM--Spectrum Fusion HCI	IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.	2024-05-14	6.5	CVE-2023-43040 psirt@us.ibm.com psirt@us.ibm.com
IBM--TXSeries for Multiplatforms	IBM TXSeries for Multiplatforms 8.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 280191.	2024-05-14	6.1	CVE-2024-22344 psirt@us.ibm.com psirt@us.ibm.com
IBM--TXSeries for Multiplatforms	IBM TXSeries for Multiplatforms 8.2 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. IBM X-Force ID: 280192.	2024-05-14	6.2	CVE-2024-22345 psirt@us.ibm.com psirt@us.ibm.com
IBM--TXSeries for Multiplatforms	IBM TXSeries for Multiplatforms 8.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 280190.	2024-05-14	4	CVE-2024-22343 psirt@us.ibm.com psirt@us.ibm.com
IBM--UrbanCode Deploy	IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4, and 8.0 through 8.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285654.	2024-05-14	5.4	CVE-2024-28781 psirt@us.ibm.com psirt@us.ibm.com
ITPison--OMICARD EDM	ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information.	2024-05-15	5.3	CVE-2024-4894 twcert@cert.org.tw twcert@cert.org.tw
Imran Sayed--Headless CMS	Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3.	2024-05-17	5.3	CVE-2023-34186 audit@patchstack.com
JFrog--Artifactory	A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim's user email.	2024-05-15	6.4	CVE-2024-2248 reefs@jfrog.com
JetBrains--TeamCity	In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token	2024-05-16	5.5	CVE-2024-35301 cve@jetbrains.com
JetBrains--TeamCity	In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible	2024-05-16	5.4	CVE-2024-35302 cve@jetbrains.com
JetBrains--YouTrack	In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation	2024-05-16	5.9	CVE-2024-35299 cve@jetbrains.com
Justin Silver--Remote Content Shortcode	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Justin Silver Remote Content Shortcode allows PHP Local File Inclusion.This issue affects Remote Content Shortcode: from n/a through 1.5.	2024-05-17	6.5	CVE-2023-45652 audit@patchstack.com
Justin Tadlock--Unique	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Unique allows Stored XSS.This issue affects Unique: from n/a through 0.3.0.	2024-05-14	6.5	CVE-2024-33952 audit@patchstack.com
Kashipara--College Management System	A vulnerability, which was classified as critical, was found in Kashipara College Management System 1.0. This affects an unknown part of the file view_each_faculty.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263919.	2024-05-14	6.3	CVE-2024-4799 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability has been found in Kashipara College Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file submit_student.php. The manipulation of the argument date_of_birth leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263920.	2024-05-14	6.3	CVE-2024-4800 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability was found in Kashipara College Management System 1.0 and classified as critical. This issue affects some unknown processing of the file submit_new_faculty.php. The manipulation of the argument address leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263921 was assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4801 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability was found in Kashipara College Management System 1.0. It has been classified as critical. Affected is an unknown function of the file submit_extracurricular_activity.php. The manipulation of the argument activity_datetime leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263922 is the identifier assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4802 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability was found in Kashipara College Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file submit_admin.php. The manipulation of the argument phone leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263923.	2024-05-14	6.3	CVE-2024-4803 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability was found in Kashipara College Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file edit_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263924.	2024-05-14	6.3	CVE-2024-4804 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability classified as critical has been found in Kashipara College Management System 1.0. This affects an unknown part of the file edit_faculty.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263925 was assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4805 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability classified as critical was found in Kashipara College Management System 1.0. This vulnerability affects unknown code of the file each_extracurricula_activities.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263926 is the identifier assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4806 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability, which was classified as critical, has been found in Kashipara College Management System 1.0. This issue affects some unknown processing of the file delete_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263927.	2024-05-14	6.3	CVE-2024-4807 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability, which was classified as critical, was found in Kashipara College Management System 1.0. Affected is an unknown function of the file delete_faculty.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263928.	2024-05-14	6.3	CVE-2024-4808 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kashipara--College Management System	A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_each_detail.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264438 is the identifier assigned to this vulnerability.	2024-05-15	6.3	CVE-2024-4905 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Kiboko Labs--Arigato Autoresponder and Newsletter	Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.3.	2024-05-14	4.3	CVE-2024-34823 audit@patchstack.com
Kioware--Kioware	KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number.	2024-05-14	6.2	CVE-2024-3461 cvd@cert.pl cvd@cert.pl cvd@cert.pl
Kubernetes--azure-file-csi-driver	A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.	2024-05-15	6.5	CVE-2024-3744 jordan@liggitt.net jordan@liggitt.net
Linux--Linux kernel	In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value. To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded.	2024-05-14	5.3	CVE-2024-4810 security@openanolis.org
LionScripts--IP Blocker Lite	Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through 11.1.1.	2024-05-17	5.3	CVE-2024-30479 audit@patchstack.com
LizardByte--Sunshine	Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\Program.cmd` on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories.	2024-05-16	4.9	CVE-2024-31226 security-advisories@github.com security-advisories@github.com security-advisories@github.com
Matt van Andel--Adventure Journal	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt van Andel Adventure Journal allows Stored XSS.This issue affects Adventure Journal: from n/a through 1.7.2.	2024-05-14	6.5	CVE-2024-33953 audit@patchstack.com
Metagauss--EventPrime	Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.	2024-05-17	5.3	CVE-2023-33321 audit@patchstack.com
Metagauss--ProfileGrid	Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affects ProfileGrid : from n/a through 5.8.2.	2024-05-17	4.3	CVE-2024-32774 audit@patchstack.com
Microchip--SAME70	A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71 microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.	2024-05-16	6.3	CVE-2024-4760 dc3f6da9-85b5-4a73-84a2-2ec90b40fca5
Microsoft--.NET 7.0	Visual Studio Denial of Service Vulnerability	2024-05-14	5.9	CVE-2024-30046 secure@microsoft.com
Microsoft--.NET 8.0	.NET and Visual Studio Remote Code Execution Vulnerability	2024-05-14	6.3	CVE-2024-30045 secure@microsoft.com
Microsoft--Azure Migrate	Azure Migrate Cross-Site Scripting Vulnerability	2024-05-14	6.5	CVE-2024-30053 secure@microsoft.com
Microsoft--Microsoft Bing Search for iOS	Microsoft Bing Search Spoofing Vulnerability	2024-05-14	5.4	CVE-2024-30041 secure@microsoft.com
Microsoft--Microsoft Edge (Chromium-based)	Microsoft Edge (Chromium-based) Spoofing Vulnerability	2024-05-14	5.4	CVE-2024-30055 secure@microsoft.com
Microsoft--Microsoft Intune Mobile Application Management	Microsoft Intune for Android Mobile Application Management Tampering Vulnerability	2024-05-14	6.1	CVE-2024-30059 secure@microsoft.com
Microsoft--Microsoft SharePoint Enterprise Server 2016	Microsoft SharePoint Server Information Disclosure Vulnerability	2024-05-14	6.5	CVE-2024-30043 secure@microsoft.com
Microsoft--PowerBI-client JS SDK	Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability	2024-05-14	6.5	CVE-2024-30054 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-29997 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-29998 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-29999 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30000 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30001 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30002 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30003 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30004 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30005 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30012 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	2024-05-14	6.8	CVE-2024-30021 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows DWM Core Library Information Disclosure Vulnerability	2024-05-14	5.5	CVE-2024-30008 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Cryptographic Services Information Disclosure Vulnerability	2024-05-14	5.5	CVE-2024-30016 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	2024-05-14	5.5	CVE-2024-30034 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Remote Access Connection Manager Information Disclosure Vulnerability	2024-05-14	5.5	CVE-2024-30039 secure@microsoft.com
Microsoft--Windows 10 Version 1809	Windows Mark of the Web Security Feature Bypass Vulnerability	2024-05-14	5.4	CVE-2024-30050 secure@microsoft.com
Microsoft--Windows Server 2019	Windows Hyper-V Denial of Service Vulnerability	2024-05-14	6.5	CVE-2024-30011 secure@microsoft.com
Microsoft--Windows Server 2019	DHCP Server Service Denial of Service Vulnerability	2024-05-14	6.5	CVE-2024-30019 secure@microsoft.com
Microsoft--Windows Server 2019	Windows Deployment Services Information Disclosure Vulnerability	2024-05-14	6.5	CVE-2024-30036 secure@microsoft.com
MongoDB Inc--MongoDB Server	An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.	2024-05-14	5.3	CVE-2024-3374 cna@mongodb.com
N/A--N/A	The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the 'notice_id' GET parameter.	2024-05-14	5.4	CVE-2024-4860 vulnreport@tenable.com
Nathan Vonnahme--Configure Login Timeout	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nathan Vonnahme Configure Login Timeout allows Stored XSS.This issue affects Configure Login Timeout: from n/a through 1.0.	2024-05-14	5.9	CVE-2024-34419 audit@patchstack.com
Ninja Team--Filebird	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3.	2024-05-14	5.3	CVE-2024-35166 audit@patchstack.com
OCDI--One Click Demo Import	Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0.	2024-05-14	4.4	CVE-2024-34433 audit@patchstack.com
OceanicJS--Oceanic	Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input, ensuring strings are valid for the purpose they are being used for. One may also encode input with `encodeURIComponent` before providing it to the library.	2024-05-14	6.5	CVE-2024-34712 security-advisories@github.com security-advisories@github.com
OpenText--iManager	Path Traversal found in OpenTextâ„¢ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure.	2024-05-15	5.7	CVE-2024-3484 security@opentext.com
OpenText--iManager	Server Side Request Forgery vulnerability has been discovered in OpenTextâ„¢ iManager 3.2.6.0200. This could lead to senstive information disclosure.	2024-05-15	5.3	CVE-2024-3485 security@opentext.com
OpenText--iManager	File Upload vulnerability in unauthenticated session found in OpenTextâ„¢ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication.	2024-05-15	5.6	CVE-2024-3488 security@opentext.com
OpenText--iManager	Server Side Request Forgery vulnerability has been discovered in OpenTextâ„¢ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory traversal.	2024-05-15	5.3	CVE-2024-3970 security@opentext.com
Orchestrated--Corona Virus (COVID-19) Banner & Live Data	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data allows Stored XSS.This issue affects Corona Virus (COVID-19) Banner & Live Data: from n/a through 1.8.0.2.	2024-05-14	5.9	CVE-2024-34429 audit@patchstack.com
PHOENIX CONTACT--CHARX SEC-3000	A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.	2024-05-14	5	CVE-2024-28135 info@cert.vde.com
PHPGurukul--Online Course Registration System	A vulnerability classified as critical was found in PHPGurukul Online Course Registration System 3.1. Affected by this vulnerability is an unknown functionality of the file /pincode-verification.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264925 was assigned to this vulnerability.	2024-05-17	6.3	CVE-2024-5066 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
PaperCut--PaperCut NG, PaperCut MF	An arbitrary file deletion vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This vulnerability requires local login/console access to the PaperCut NG/MF server (eg: member of a domain admin group).	2024-05-14	6	CVE-2024-3037 eb41dac7-0af8-4f84-9f6d-0272772514f4
PaperCut--PaperCut NG, PaperCut MF	An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This vulnerability requires local login/console access to the PaperCut NG/MF server (eg: member of a domain admin group).	2024-05-14	6	CVE-2024-4712 eb41dac7-0af8-4f84-9f6d-0272772514f4
Phil Baylog--QuickieBar	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Baylog QuickieBar allows Stored XSS.This issue affects QuickieBar: from n/a through 1.8.4.	2024-05-14	5.9	CVE-2024-34425 audit@patchstack.com
PluginEver--Serial Numbers for WooCommerce License Manager	Missing Authorization vulnerability in PluginEver Serial Numbers for WooCommerce - License Manager.This issue affects Serial Numbers for WooCommerce - License Manager: from n/a through 1.7.3.	2024-05-17	5.3	CVE-2024-35173 audit@patchstack.com
PrestaShop--PrestaShop	PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.	2024-05-14	5.3	CVE-2024-34717 security-advisories@github.com security-advisories@github.com
Progress Software Corporation--WhatsUp Gold	In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery.	2024-05-14	5.4	CVE-2024-4562 security@progress.com security@progress.com
Progress Software Corporation--WhatsUp Gold	In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.	2024-05-14	4.2	CVE-2024-4561 security@progress.com security@progress.com
Progress Software--Telerik Report Server	An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.	2024-05-15	6.5	CVE-2024-4357 security@progress.com
Progress Software--Telerik Report Server	In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.	2024-05-15	5.3	CVE-2024-4837 security@progress.com
Proofpoint--Enterprise Protection	The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an authenticated user to relay HTTP requests from the Protection server to otherwise private network addresses.	2024-05-14	5	CVE-2024-0862 security@proofpoint.com
QODE Interactive--Qi Addons For Elementor	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QODE Interactive Qi Addons For Elementor allows PHP Local File Inclusion.This issue affects Qi Addons For Elementor: from n/a through 1.6.3.	2024-05-17	6.4	CVE-2023-47679 audit@patchstack.com
RadiusTheme--ShopBuilder Elementor WooCommerce Builder Addons	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RadiusTheme ShopBuilder - Elementor WooCommerce Builder Addons.This issue affects ShopBuilder - Elementor WooCommerce Builder Addons: from n/a through 2.1.8.	2024-05-14	5.3	CVE-2024-34812 audit@patchstack.com
RafflePress--Giveaways and Contests	Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: from n/a through 1.12.7.	2024-05-17	5.3	CVE-2024-32827 audit@patchstack.com
Rashed Latif--TT Custom Post Type Creator	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rashed Latif TT Custom Post Type Creator allows Stored XSS.This issue affects TT Custom Post Type Creator: from n/a through 1.0.	2024-05-14	5.9	CVE-2024-34430 audit@patchstack.com
Red Hat--Red Hat Advanced Cluster Management for Kubernetes 2	A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.	2024-05-17	6.6	CVE-2024-5042 secalert@redhat.com secalert@redhat.com secalert@redhat.com
Red Hat--Red Hat Enterprise Linux 6	A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host.	2024-05-14	5.5	CVE-2024-4693 secalert@redhat.com secalert@redhat.com
Red Hat--Red Hat OpenStack Platform 16.2	An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.	2024-05-14	5.5	CVE-2024-4840 secalert@redhat.com secalert@redhat.com
Red Hat--Red Hat Satellite 6	A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key. This issue does not directly allow unauthorized remote execution on the Satellite, although it can leak secrets that may lead to it.	2024-05-14	6.8	CVE-2024-4871 secalert@redhat.com secalert@redhat.com
Revmakx--WPCal.io Easy Meeting Scheduler	Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io - Easy Meeting Scheduler.This issue affects WPCal.Io - Easy Meeting Scheduler: from n/a through 0.9.5.8.	2024-05-14	5.4	CVE-2024-34816 audit@patchstack.com
Ruijie--RG-UAC	A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interface_commit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-14	6.3	CVE-2024-4813 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Ruijie--RG-UAC	A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Affected by this vulnerability is an unknown functionality of the file /view/networkConfig/RouteConfig/StaticRoute/static_route_edit_commit.php. The manipulation of the argument oldipmask/oldgateway leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263935. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-14	6.3	CVE-2024-4814 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Ruijie--RG-UAC	A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the file /view/bugSolve/viewData/detail.php. The manipulation of the argument filename leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263936. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-14	6.3	CVE-2024-4815 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Ruijie--RG-UAC	A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view/networkConfig/GRE/gre_add_commit.php. The manipulation of the argument name/remote/local/IP leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263937 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-14	6.3	CVE-2024-4816 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SAP_SE--SAP BusinessObjects Business Intelligence Platform (Webservices)	SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application.	2024-05-14	4.3	CVE-2024-33004 cna@sap.com cna@sap.com
SAP_SE--SAP Enable Now	SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the confidentiality of the application.	2024-05-14	6.5	CVE-2024-32730 cna@sap.com cna@sap.com
SAP_SE--SAP Global Label Management (GLM)	SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could lead to low impact on Confidentiality and Integrity of the application.	2024-05-14	4.2	CVE-2024-33009 cna@sap.com cna@sap.com
SAP_SE--SAP My Travel Requests	SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality, integrity and availability of the application.	2024-05-14	5.5	CVE-2024-32731 cna@sap.com cna@sap.com
SAP_SE--SAP NetWeaver Application Server ABAP and ABAP Platform	Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify sensitive information with no impact on availability of the application	2024-05-14	6.1	CVE-2024-32733 cna@sap.com cna@sap.com
SAP_SE--SAP NetWeaver Application server for ABAP and ABAP Platform	SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user's browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user's session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.	2024-05-14	6.5	CVE-2024-34687 cna@sap.com cna@sap.com
SAP_SE--SAP Replication Server	SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with high impact on Availability of the system.	2024-05-14	4.9	CVE-2024-33008 cna@sap.com cna@sap.com
SAP_SE--SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)	Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.	2024-05-14	4.3	CVE-2024-4138 cna@sap.com cna@sap.com
SAP_SE--SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)	Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and Availability are not affected.	2024-05-14	4.3	CVE-2024-4139 cna@sap.com cna@sap.com
SAP_SE--SAP S/4HANA (Document Service Handler for DPS)	Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application.	2024-05-14	6.1	CVE-2024-33002 cna@sap.com cna@sap.com
SKT Themes--SKT Addons for Elementor	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8.	2024-05-14	6.5	CVE-2024-34436 audit@patchstack.com
SKT Themes--SKT Addons for Elementor	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8.	2024-05-14	6.5	CVE-2024-34445 audit@patchstack.com
SailPoint--Identity Security Cloud	An improper access control was identified in the Identity Security Cloud (ISC) message server API that allowed an authenticated user to exfiltrate job processing metadata (opaque messageIDs, work queue depth and counts) for other tenants.	2024-05-15	6.5	CVE-2024-3317 psirt@sailpoint.com
SailPoint--Identity Security Cloud	A file path traversal vulnerability was identified in the DelimitedFileConnector Cloud Connector that allowed an authenticated administrator to set arbitrary connector attributes, including the "file" attribute, which in turn allowed the user to access files uploaded for other sources.	2024-05-15	4.2	CVE-2024-3318 psirt@sailpoint.com
SakuraIsayeki--WOWS-Karma	WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.	2024-05-14	6.3	CVE-2024-34695 security-advisories@github.com security-advisories@github.com security-advisories@github.com
Salon Booking System--Salon booking system	Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6.	2024-05-17	6.8	CVE-2023-48319 audit@patchstack.com
Samsung Open Source--Escargot	Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0.	2024-05-14	5.3	CVE-2024-32669 PSIRT@samsung.com
Samsung Open Source--Escargot	A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted input. This issue affects Escargot: 4.0.0.	2024-05-14	5.3	CVE-2024-32672 PSIRT@samsung.com
Samuel Marshall--JCH Optimize	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.2.0.	2024-05-16	4.3	CVE-2024-34808 audit@patchstack.com
ShortPixel--ShortPixel Adaptive Images	Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images.This issue affects ShortPixel Adaptive Images: from n/a through 3.8.3.	2024-05-14	4.4	CVE-2024-35172 audit@patchstack.com
ShortPixel--ShortPixel Adaptive Images	Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images.This issue affects ShortPixel Adaptive Images: from n/a through 3.8.3.	2024-05-14	4.3	CVE-2024-4689 audit@patchstack.com
SiAdmin--SiAdmin	Vulnerability in SiAdmin 1.1 that allows XSS via the /show.php query parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and thereby steal their cookie session credentials.	2024-05-16	6.3	CVE-2024-4993 cve-coordination@incibe.es
Siemens--OPUPI0 AMQP/MQTT	A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without sufficient protection on the devices. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.	2024-05-14	5.3	CVE-2024-31486 productcert@siemens.com
Siemens--Polarion ALM	A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.	2024-05-14	6.5	CVE-2024-33647 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). Downloading files overwrites files with the same name in the installation directory of the affected systems. The filename for the target file can be specified, thus arbitrary files can be overwritten by an attacker with the required privileges.	2024-05-14	6.5	CVE-2024-27946 productcert@siemens.com
Siemens--RUGGEDCOM CROSSBOW	A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems could allow log messages to be forwarded to a specific client under certain circumstances. An attacker could leverage this vulnerability to forward log messages to a specific compromised client.	2024-05-14	5.3	CVE-2024-27947 productcert@siemens.com
Siemens--S7-PCT	A vulnerability has been identified in S7-PCT (All versions), Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC PDM V9.2 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC STEP 7 V5 (All versions), SIMATIC WinCC OA V3.17 (All versions), SIMATIC WinCC OA V3.18 (All versions < V3.18 P025), SIMATIC WinCC OA V3.19 (All versions < V3.19 P010), SIMATIC WinCC Runtime Advanced (All versions), SIMATIC WinCC Runtime Professional V16 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Unified PC Runtime (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SINAMICS Startdrive (All versions < V19 SP1), SINUMERIK ONE virtual (All versions < V6.23), SINUMERIK PLC Programming Tool (All versions), TIA Portal Cloud Connector (All versions < V2.0), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 2). The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.	2024-05-14	6.5	CVE-2023-46280 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The "DBTest" tool of SIMATIC RTLS Locating Manager does not properly enforce access restriction. This could allow an authenticated local attacker to extract sensitive information from memory.	2024-05-14	6.3	CVE-2024-30208 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected components do not properly authenticate heartbeat messages. This could allow an unauthenticated remote attacker to affected the availability of secondary RTLS systems configured using a TeeRevProxy service and potentially cause loss of data generated during the time the attack is ongoing.	2024-05-14	6.5	CVE-2024-33494 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected application does not properly limit the size of specific logs. This could allow an unauthenticated remote attacker to exhaust system resources by creating a great number of log entries which could potentially lead to a denial of service condition. A successful exploitation requires the attacker to have access to specific SIMATIC RTLS Locating Manager Clients in the deployment.	2024-05-14	6.5	CVE-2024-33495 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.	2024-05-14	6.3	CVE-2024-33496 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected SIMATIC RTLS Locating Manager Track Viewer Client do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.	2024-05-14	6.3	CVE-2024-33497 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected applications do not properly release memory that is allocated when handling specifically crafted incoming packets. This could allow an unauthenticated remote attacker to cause a denial of service condition by crashing the service when it runs out of memory. The service is restarted automatically after a short time.	2024-05-14	5.3	CVE-2024-33498 productcert@siemens.com
SourceCodester--Best Courier Management System	A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file view_parcel.php. The manipulation of the argument id leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264480.	2024-05-16	4.3	CVE-2024-4945 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Employee and Visitor Gate Pass Logging System	A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /employee_gatepass/classes/Users.php?f=ssave. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264456.	2024-05-16	6.3	CVE-2024-4921 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Gas Agency Management System	A vulnerability has been found in SourceCodester Gas Agency Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file edituser.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264748.	2024-05-17	6.3	CVE-2024-5051 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Interactive Map with Marker	A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete-mark.php. The manipulation of the argument mark leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264535.	2024-05-16	6.3	CVE-2024-4967 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Online Art Gallery Management System	A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/adminHome.php. The manipulation of the argument sliderpic leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264481 was assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4946 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Online Birth Certificate Management System	A vulnerability was found in SourceCodester Online Birth Certificate Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264742 is the identifier assigned to this vulnerability.	2024-05-17	5.3	CVE-2024-5045 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Online Computer and Laptop Store	A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /admin/maintenance/manage_brand.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263918 is the identifier assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4798 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Online Computer and Laptop Store	A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/SystemSettings.php?f=update_settings. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263941 was assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4820 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Open Source Clinic Management System	A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263929 was assigned to this vulnerability.	2024-05-14	6.3	CVE-2024-4809 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--School Intramurals Student Attendance Management System	A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /intrams_sams/manage_course.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264461 was assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4925 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--School Intramurals Student Attendance Management System	A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /intrams_sams/manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264462 is the identifier assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4926 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264463.	2024-05-16	6.3	CVE-2024-4927 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=delete_category. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264464.	2024-05-16	6.3	CVE-2024-4928 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability classified as critical was found in SourceCodester Simple Online Bidding System 1.0. This vulnerability affects unknown code of the file /simple-online-bidding-system/index.php?page=view_prod. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264466 is the identifier assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4930 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Bidding System 1.0. This issue affects some unknown processing of the file /simple-online-bidding-system/admin/index.php?page=view_udet. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264467.	2024-05-16	6.3	CVE-2024-4931 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability, which was classified as critical, was found in SourceCodester Simple Online Bidding System 1.0. Affected is an unknown function of the file /simple-online-bidding-system/admin/index.php?page=manage_user. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264468.	2024-05-16	6.3	CVE-2024-4932 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability has been found in SourceCodester Simple Online Bidding System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/admin/index.php?page=manage_product. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264469 was assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4933 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Bidding System	A vulnerability classified as problematic has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/admin/ajax.php?action=save_user. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264465 was assigned to this vulnerability.	2024-05-16	4.3	CVE-2024-4929 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Online Mens Salon Management System	A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Mens Salon Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264926 is the identifier assigned to this vulnerability.	2024-05-17	6.3	CVE-2024-5069 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Sparkle WP--Editorialmag	Missing Authorization vulnerability in Sparkle WP Editorialmag editorialmag.This issue affects Editorialmag: from n/a through 1.1.9.	2024-05-17	4.3	CVE-2023-32129 audit@patchstack.com
Stefano Lissa & The Newsletter Team--Newsletter	Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: from n/a through 8.2.0.	2024-05-17	5.3	CVE-2024-30522 audit@patchstack.com
Strategy11 Form Builder Team--Formidable Forms	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7.	2024-05-17	5.3	CVE-2024-23522 audit@patchstack.com
StylemixThemes--Cost Calculator Builder PRO	Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.	2024-05-17	6.4	CVE-2024-4789 security@wordfence.com security@wordfence.com
Supsystic--Pricing Table by Supsystic	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This issue affects Pricing Table by Supsystic: from n/a through 1.9.12.	2024-05-17	4.3	CVE-2024-32790 audit@patchstack.com
Swift Ideas--Swift Framework	The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sf_edit_directory_item() function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary posts with arbitrary content. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details.	2024-05-14	5.3	CVE-2024-3915 security@wordfence.com security@wordfence.com
Swift Ideas--Swift Framework	The Swift Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 2.7.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details.	2024-05-14	5.3	CVE-2024-3916 security@wordfence.com security@wordfence.com
Sylius--Sylius	Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.	2024-05-14	6.1	CVE-2024-34349 security-advisories@github.com security-advisories@github.com
Synaptics--Synaptics Fingerprint Driver	Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for the Synaptics Hardware Support App.	2024-05-14	5.5	CVE-2023-5447 PSIRT@synaptics.com
TIBCO--Hawk	Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3 allows user's Enterprise Message Service (EMS) password to be exposed outside of the hawkagent.cfg and hawkevent.cfg config files.	2024-05-15	6.5	CVE-2024-3182 security@tibco.com
TYPO3--typo3	TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.	2024-05-14	5.4	CVE-2024-34356 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
TYPO3--typo3	TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.	2024-05-14	5.4	CVE-2024-34357 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
TYPO3--typo3	TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.	2024-05-14	5.3	CVE-2024-34358 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
Tech9logy Creators--WPCS ( WordPress Custom Search )	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tech9logy Creators WPCS ( WordPress Custom Search ) allows Stored XSS.This issue affects WPCS ( WordPress Custom Search ): from n/a through 1.1.	2024-05-14	5.9	CVE-2024-34418 audit@patchstack.com
The Events Calendar--BookIt	Improper Validation of Specified Quantity in Input vulnerability in The Events Calendar BookIt allows Manipulating Hidden Fields.This issue affects BookIt: from n/a through 2.4.0.	2024-05-17	6.5	CVE-2024-24715 audit@patchstack.com
Theme Freesia--Freesia Empire	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Freesia Empire allows Stored XSS.This issue affects Freesia Empire: from n/a through 1.4.1.	2024-05-14	6.5	CVE-2024-33955 audit@patchstack.com
ThemeFuse--Unyson	Cross-Site Request Forgery (CSRF) vulnerability in ThemeFuse Unyson.This issue affects Unyson: from n/a through 2.7.29.	2024-05-14	5.4	CVE-2024-34814 audit@patchstack.com
ThemeLocation--Custom WooCommerce Checkout Fields Editor	Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.	2024-05-14	4.3	CVE-2024-33956 audit@patchstack.com
ThemeNectar--Salient Shortcodes	The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-3811 security@wordfence.com security@wordfence.com
ThimPress--Thim Elementor Kit	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit allows Stored XSS.This issue affects Thim Elementor Kit: from n/a through 1.1.8.	2024-05-14	6.5	CVE-2024-34415 audit@patchstack.com
ThroughTek--Kalay SDK	ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.	2024-05-15	4.3	CVE-2023-6323 cve-requests@bitdefender.com
Toidicode.com (thanhtaivtt)--Viet Nam Affiliate	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toidicode.Com (thanhtaivtt) Viet Nam Affiliate allows Stored XSS.This issue affects Viet Nam Affiliate: from n/a through 1.0.0.	2024-05-14	5.9	CVE-2024-34417 audit@patchstack.com
Tongda--OA	A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/delete.php. The manipulation of the argument M_ID_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264436. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-15	6.3	CVE-2024-4903 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Trellix--ePolicy Orchestrator	ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege.	2024-05-16	4.3	CVE-2024-4843 trellixpsirt@trellix.com
UkrSolution--Barcode Scanner with Inventory & Order Manager	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.4.	2024-05-14	5.3	CVE-2024-34556 audit@patchstack.com
UkrSolution--Barcode Scanner with Inventory & Order Manager	Cross-Site Request Forgery (CSRF) vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.4.	2024-05-14	4.3	CVE-2024-34557 audit@patchstack.com
Uniform Server Zero--Uniform Server Zero	vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details.	2024-05-14	6.3	CVE-2023-5052 cve-coordination@incibe.es
Valiano--Unite Gallery Lite	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n/a through 1.7.59.	2024-05-17	6	CVE-2023-33310 audit@patchstack.com
ValvePress--WordPress Automatic Plugin	The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'autoplay' parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-4849 security@wordfence.com security@wordfence.com
VeronaLabs--WP SMS	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.	2024-05-14	5.9	CVE-2024-34811 audit@patchstack.com
Visualmodo--Borderless Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Visualmodo Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg allows Stored XSS.This issue affects Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: from n/a through 1.5.3.	2024-05-17	6.5	CVE-2024-34757 audit@patchstack.com
W3 Eden Inc.--Download Manager	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82.	2024-05-17	5.3	CVE-2024-32131 audit@patchstack.com
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 disks (/admin/DeviceS3). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.	2024-05-14	6.6	CVE-2024-3787 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.	2024-05-14	6.6	CVE-2024-3788 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Uncontrolled resource consumption vulnerability in White Bear Solutions WBSAirback, version 21.02.04. This vulnerability could allow an attacker to send multiple command injection payloads to influence the amount of resources consumed.	2024-05-14	6.5	CVE-2024-3789 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemUsers, login / description fields, passwd1/ passwd2 parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3790 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemConfiguration, name / free memory limit fields , type / password parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3791 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/DeviceReplication, execution range field, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3792 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/CloudAccounts, account name / user password / server fields, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3793 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/AdvancedSystem, description field, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3794 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupTemplate, name / description fields. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3795 cve-coordination@incibe.es
WBSAirback--White Bear Solutions	Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupSchedule, description field. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.	2024-05-14	4.8	CVE-2024-3796 cve-coordination@incibe.es
WP Club Manager--WP Club Manager	Missing Authorization vulnerability in WP Club Manager.This issue affects WP Club Manager: from n/a through 2.2.11.	2024-05-14	5.3	CVE-2024-32719 audit@patchstack.com
WP Happy Coders--Comments Like Dislike	Authentication Bypass by Spoofing vulnerability in WP Happy Coders Comments Like Dislike allows Functionality Bypass.This issue affects Comments Like Dislike: from n/a through 1.2.2.	2024-05-17	4.3	CVE-2024-25906 audit@patchstack.com
WP Royal--Royal Elementor Addons	Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.	2024-05-17	5.3	CVE-2024-32786 audit@patchstack.com
WPBlockart--Magazine Blocks	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockart Magazine Blocks allows Stored XSS.This issue affects Magazine Blocks: from n/a through 1.3.6.	2024-05-16	5.9	CVE-2024-34760 audit@patchstack.com
WPDeveloper--SchedulePress	Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through 5.0.8.	2024-05-14	6.5	CVE-2024-32717 audit@patchstack.com
WPMU DEV--Defender Security	Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.	2024-05-17	5	CVE-2022-44581 audit@patchstack.com
WPMU DEV--Defender Security	Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.	2024-05-17	5.3	CVE-2024-25595 audit@patchstack.com
Wangshen--SecGate 3600	A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-264747.	2024-05-17	6.3	CVE-2024-5050 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Warfare Plugins--Social Warfare	Cross-Site Request Forgery (CSRF) vulnerability in Warfare Plugins Social Warfare.This issue affects Social Warfare: from n/a through 4.4.5.1.	2024-05-14	4.3	CVE-2024-34825 audit@patchstack.com
Web-Settler--Landing Page Builder Free Landing Page Templates	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder - Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder - Free Landing Page Templates: from n/a through 3.1.9.9.	2024-05-17	6.8	CVE-2023-24379 audit@patchstack.com
WebToffee--Order Export & Order Import for WooCommerce	Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.9.	2024-05-16	4.4	CVE-2024-34751 audit@patchstack.com
Webvitaly--iFrame	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webvitaly iFrame allows Stored XSS.This issue affects iFrame: from n/a through 5.0.	2024-05-16	6.5	CVE-2024-34805 audit@patchstack.com
Wireshark Foundation--Wireshark	MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file	2024-05-14	6.4	CVE-2024-4854 cve@gitlab.com cve@gitlab.com cve@gitlab.com cve@gitlab.com
WordPlus--BP Better Messages	Missing Authorization vulnerability in WordPlus BP Better Messages allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Better Messages: from n/a through 2.4.32.	2024-05-17	5.3	CVE-2024-32802 audit@patchstack.com
Wpmet--Wp Ultimate Review	Authentication Bypass by Spoofing vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.3.2.	2024-05-17	5.3	CVE-2024-21746 audit@patchstack.com
Wpmet--Wp Ultimate Review	Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.	2024-05-17	5.3	CVE-2024-32685 audit@patchstack.com
Zoom Video Communications, Inc.--Zoom Workplace VDI App for Windows	Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.	2024-05-15	6.7	CVE-2024-27244 security@zoom.us
Zoom Video Communications, Inc.--see references	Buffer overflow in some Zoom Workplace Apps and SDK's may allow an authenticated user to conduct a denial of service via network access.	2024-05-15	6.5	CVE-2024-27243 security@zoom.us
abuhayat--HTML5 Audio Player- Best WordPress Audio Player Plugin	The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4398 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
aio-libs--aiosmtpd	aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.	2024-05-18	5.4	CVE-2024-34083 security-advisories@github.com security-advisories@github.com security-advisories@github.com
argoproj--argo-cd	Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.	2024-05-14	6.5	CVE-2024-32476 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
asterisk--asterisk	Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.	2024-05-17	5.8	CVE-2024-35190 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
athemes--Sydney Toolbox	The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4473 security@wordfence.com security@wordfence.com
automattic--Jetpack WP Security, Backup, Speed, & Growth	The Jetpack - WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4392 security@wordfence.com security@wordfence.com
avimegladon--Custom Post Type Attachment	The Custom Post Type Attachment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pdf_attachment' shortcode in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4546 security@wordfence.com security@wordfence.com
bdthemes--Prime Slider Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)	The Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the General widget in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4339 security@wordfence.com security@wordfence.com
blakeblackshear--frigate	Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.	2024-05-14	6.8	CVE-2024-32874 security-advisories@github.com security-advisories@github.com
blocksera--Image Hover Effects Elementor Addon	The Image Hover Effects - Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-1166 security@wordfence.com security@wordfence.com
boldgrid--Post and Page Builder by BoldGrid Visual Drag and Drop Editor	The Post and Page Builder by BoldGrid - Visual Drag and Drop Editor plguin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 1.26.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4400 security@wordfence.com security@wordfence.com
brainstormforce--Elementor Header & Footer Builder	The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hfe_svg_mime_types' function in versions up to, and including, 1.6.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4634 security@wordfence.com security@wordfence.com security@wordfence.com
brainstormforce--Elementor Header & Footer Builder	The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page.	2024-05-16	5	CVE-2024-2619 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
brainstormforce--Starter Templates Elementor, WordPress & Beaver Builder Templates	The Starter Templates - Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_upload_mimes' function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4630 security@wordfence.com security@wordfence.com security@wordfence.com
brainstormforce--Starter Templates Elementor, WordPress & Beaver Builder Templates	The Starter Templates - Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.	2024-05-14	4.3	CVE-2024-1467 security@wordfence.com security@wordfence.com security@wordfence.com
britner--Gutenberg Blocks with AI by Kadence WP Page Builder Features	The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in the advanced heading widget in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4208 security@wordfence.com security@wordfence.com
britner--Gutenberg Blocks with AI by Kadence WP Page Builder Features	The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown timer in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4209 security@wordfence.com security@wordfence.com security@wordfence.com
britner--Gutenberg Blocks with AI by Kadence WP Page Builder Features	The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the plugin's blocks in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4481 security@wordfence.com security@wordfence.com
britner--Gutenberg Blocks with AI by Kadence WP Page Builder Features	The Gutenberg Blocks by Kadence Blocks - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial', 'Progress Bar', 'Lottie Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	5.4	CVE-2024-3189 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
buddypress--BuddyPress	The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3974 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
carazo--Import and export users and customers	The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	4.4	CVE-2024-4656 security@wordfence.com security@wordfence.com
carazo--Import and export users and customers	The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-05-15	4.4	CVE-2024-4734 security@wordfence.com security@wordfence.com
code-projects--Budget Management	A vulnerability classified as critical was found in code-projects Budget Management 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument edit leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264745 was assigned to this vulnerability.	2024-05-17	6.3	CVE-2024-5048 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects--Simple Chat System	A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /login.php. The manipulation of the argument email/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264537 was assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4972 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects--Simple Chat System	A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file /register.php. The manipulation of the argument name/number/address leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264538 is the identifier assigned to this vulnerability.	2024-05-16	6.3	CVE-2024-4973 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
codename065--Sliding Widgets	Missing Authorization vulnerability in codename065 Sliding Widgets allows Cross-Site Scripting (XSS).This issue affects Sliding Widgets: from n/a through 1.5.0.	2024-05-14	6.5	CVE-2024-33938 audit@patchstack.com
codewoogeek--Back In Stock Notifier for WooCommerce \| WooCommerce Waitlist Pro	The The Back In Stock Notifier for WooCommerce \| WooCommerce Waitlist Pro plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.3.1. This is due to the plugin for WordPress allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.	2024-05-14	6.5	CVE-2024-4038 security@wordfence.com security@wordfence.com
creativethemeshq--Blocksy Companion	The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4487 security@wordfence.com security@wordfence.com security@wordfence.com
creativethemeshq--Blocksy	The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in versions up to, and including, 2.0.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4158 security@wordfence.com security@wordfence.com
croixhaug--Appointment Booking Calendar Simply Schedule Appointments Booking Plugin	The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to, and including, 1.6.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4288 security@wordfence.com security@wordfence.com security@wordfence.com
daext--Soccer Engine Soccer Plugin for WordPress	The Soccer Engine - Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for unauthenticated attackers to change plugin settings as well as teams, players, etc. via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-14	4.3	CVE-2024-4312 security@wordfence.com security@wordfence.com
davidanderson--Testimonial Slider	The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4193 security@wordfence.com security@wordfence.com
deTheme--DethemeKit For Elementor	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.1.2.	2024-05-17	6.5	CVE-2024-34575 audit@patchstack.com
detheme--DethemeKit For Elementor	The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-4374 security@wordfence.com security@wordfence.com
devitemsllc--HT Mega Absolute Addons For Elementor	The HT Mega - Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justify Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3989 security@wordfence.com security@wordfence.com
devitemsllc--HT Mega Absolute Addons For Elementor	The HT Mega - Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3990 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
devitemsllc--ShopLentor WooCommerce Builder for Elementor & Gutenberg +12 Modules All in One Solution (formerly WooLentor)	The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purchased them.	2024-05-14	5.3	CVE-2023-6327 security@wordfence.com security@wordfence.com security@wordfence.com
directus--directus	Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0.	2024-05-14	5.4	CVE-2024-34709 security-advisories@github.com security-advisories@github.com
directus--directus	Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them. This vulnerability is fixed in 10.11.0.	2024-05-14	4.9	CVE-2024-34708 security-advisories@github.com security-advisories@github.com
divSpot--DS Site Message	Cross-Site Request Forgery (CSRF) vulnerability in divSpot DS Site Message.This issue affects DS Site Message: from n/a through 1.14.4.	2024-05-14	4.3	CVE-2024-34439 audit@patchstack.com
envothemes--Envo Extra	The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4385 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
fluxcd--source-controller	The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.	2024-05-15	5.1	CVE-2024-31216 security-advisories@github.com security-advisories@github.com security-advisories@github.com
frappe--frappe	Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.	2024-05-14	6.1	CVE-2024-34074 security-advisories@github.com security-advisories@github.com security-advisories@github.com
freescout-helpdesk--freescout	FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/public/js/main.js` source file. The Prototype Pollution arises because the `getQueryParam` Function recursively merges an object containing user-controllable properties into an existing object (For URL Query Parameters Parsing), without first sanitizing the keys. This can allow an attacker to inject a property with a key `__proto__`, along with arbitrarily nested properties. The merge operation assigns the nested properties to the `params` object's prototype instead of the target object itself. As a result, the attacker can pollute the prototype with properties containing harmful values, which are then inherited by user-defined objects and subsequently used by the application dangerously. The vulnerability lets an attacker control properties of objects that would otherwise be inaccessible. If the application subsequently handles an attacker-controlled property in an unsafe way, this can potentially be chained with other vulnerabilities like DOM-based XSS, Open Redirection, Cookie Manipulation, Link Manipulation, HTML Injection, etc. Version 1.8.139 contains a patch for the issue.	2024-05-14	4.6	CVE-2024-34698 security-advisories@github.com security-advisories@github.com
giuliopanda--ADFO Custom data in admin dashboard	The ADFO - Custom data in admin dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dbp_id' parameter in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-05-14	6.1	CVE-2024-4104 security@wordfence.com security@wordfence.com security@wordfence.com
giuliopanda--ADFO Custom data in admin dashboard	The ADFO - Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller() function. This makes it possible for unauthenticated attackers to edit the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-14	4.3	CVE-2024-4103 security@wordfence.com security@wordfence.com
https://elementor.com/--Elementor Website Builder Pro	The Elementor Website Builder - More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4107 security@wordfence.com security@wordfence.com
iePlexus--Featured Content Gallery	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iePlexus Featured Content Gallery allows Stored XSS.This issue affects Featured Content Gallery: from n/a through 3.2.0.	2024-05-14	5.9	CVE-2024-34424 audit@patchstack.com
iqonicdesign--Graphina Elementor Charts and Graphs	The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4574 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
ithemelandco--Bulk Posts Editing For WordPress	The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplication, post content retrieval, post taxonomy manipulation.	2024-05-15	4.3	CVE-2024-4199 security@wordfence.com security@wordfence.com
ithemelandco--Bulk Posts Editing For WordPress	The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the plugin's AJAX actions.. This makes it possible for unauthenticated attackers to create and duplicate posts, retrieve post content, and modify post taxonomy among other things via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-16	4.3	CVE-2024-4204 security@wordfence.com security@wordfence.com
justinbusa--Beaver Builder WordPress Page Builder	The Beaver Builder - WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter in all versions up to, and including, 2.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3923 security@wordfence.com security@wordfence.com security@wordfence.com
justinbusa--Beaver Builder WordPress Page Builder	The Beaver Builder - WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attribute in all versions up to, and including, 2.8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4430 security@wordfence.com security@wordfence.com security@wordfence.com
kraftplugins--Mega Elements Addons for Elementor	The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4702 security@wordfence.com security@wordfence.com
levelfourstorefront--Shopping Cart & eCommerce Store	The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as payment details, addresses and other PII.	2024-05-14	5.3	CVE-2024-4213 security@wordfence.com security@wordfence.com
litonice13--Master Addons Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor	The Master Addons - Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-3134 security@wordfence.com security@wordfence.com
litonice13--Master Addons Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor	The Master Addons - Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4580 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
mantisbt--mantisbt	MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.	2024-05-14	6.6	CVE-2024-34081 security-advisories@github.com security-advisories@github.com security-advisories@github.com
mantisbt--mantisbt	MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.	2024-05-14	5.3	CVE-2024-34080 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
matrix-org--matrix-sdk-crypto	The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side `key backup` stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair. Due to a logic bug introduced in commit 71136e44c03c79f80d6d1a2446673bc4d53a2067, matrix-sdk-crypto version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate). This issue has been resolved in matrix-sdk-crypto version 0.7.1. No known workarounds are available.	2024-05-14	5.5	CVE-2024-34353 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
matter-labs--era-compiler-solidity	era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.	2024-05-14	5.9	CVE-2024-34704 security-advisories@github.com
mgibbs189--Custom Field Suite	The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-05-14	4.4	CVE-2024-3068 security@wordfence.com security@wordfence.com security@wordfence.com
mihdan--Mihdan: Yandex Turbo Feed	The Mihdan: Yandex Turbo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.6.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4411 security@wordfence.com security@wordfence.com
miraheze--CreateWiki	CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there. Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings. As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm..	2024-05-14	5.9	CVE-2024-34701 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
monetizemore--Advanced Ads Ad Manager & AdSense	The Advanced Ads - Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3952 security@wordfence.com security@wordfence.com security@wordfence.com
mra13--Simple Membership	The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4383 security@wordfence.com security@wordfence.com security@wordfence.com
n/a--DedeCMS	A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?action=view. The manipulation of the argument filename with the input ../../../../../etc/passwd leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263889 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-14	4.3	CVE-2024-4790 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
n/a--Emlog Pro	A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-17	4.7	CVE-2024-5043 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
n/a--Endurance Gaming Mode software installers	Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-42433 secure@intel.com
n/a--Intel(R) Advisor software	Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21772 secure@intel.com
n/a--Intel(R) BIOS PPAM firmware	Improper conditions check in some Intel(R) BIOS PPAM firmware may allow a privileged user to potentially enable escalation of privilege via local access.	2024-05-16	6.1	CVE-2023-28383 secure@intel.com
n/a--Intel(R) CST software	Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-40155 secure@intel.com
n/a--Intel(R) CST software	Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	4.4	CVE-2023-39433 secure@intel.com
n/a--Intel(R) CST software	Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	4.4	CVE-2023-41082 secure@intel.com
n/a--Intel(R) CST	Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	4.7	CVE-2023-43487 secure@intel.com
n/a--Intel(R) Chipset Device Software	Uncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21814 secure@intel.com
n/a--Intel(R) Computing Improvement Program software	Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21843 secure@intel.com
n/a--Intel(R) Core(TM) Ultra Processors	Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	4.7	CVE-2023-46103 secure@intel.com
n/a--Intel(R) DLB driver software	Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local access.	2024-05-16	6.5	CVE-2024-22015 secure@intel.com
n/a--Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors	Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable denial of service via local access.	2024-05-16	6.4	CVE-2024-21823 secure@intel.com
n/a--Intel(R) DSA software uninstallers	Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-45743 secure@intel.com
n/a--Intel(R) Data Center GPU Max Series 1100 and 1550 products	Improper conditions check in the Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow an privileged user to potentially enable denial of service via local access.	2024-05-16	6	CVE-2023-47165 secure@intel.com
n/a--Intel(R) Distribution for GDB software	Uncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21841 secure@intel.com
n/a--Intel(R) Ethernet Controller Administrative Tools software	Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21828 secure@intel.com
n/a--Intel(R) FPGA products	Out of bounds write in firmware for some Intel(R) FPGA products before version 2.9.0 may allow escalation of privilege and information disclosure.	2024-05-16	5.7	CVE-2023-49614 secure@intel.com
n/a--Intel(R) FPGA products	Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service.	2024-05-16	4.4	CVE-2024-22390 secure@intel.com
n/a--Intel(R) GPA Framework software	Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-35192 secure@intel.com
n/a--Intel(R) GPA Framework software	Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21861 secure@intel.com
n/a--Intel(R) GPA software	Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-41961 secure@intel.com
n/a--Intel(R) GPA software	Uncontrolled search path in some Intel(R) GPA software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21788 secure@intel.com
n/a--Intel(R) Graphics Windows DCH driver software	Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driver software before versions 31.0.101.3790/31.0.101.2114 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-43751 secure@intel.com
n/a--Intel(R) Inspector software	Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-22379 secure@intel.com
n/a--Intel(R) Media SDK software	Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	5.9	CVE-2023-48368 secure@intel.com
n/a--Intel(R) Media SDK	Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	4.8	CVE-2023-45221 secure@intel.com
n/a--Intel(R) Neural Compressor software	Time-of-check Time-of-use race condition in Intel(R) Neural Compressor software before version 2.5.0 may allow an authenticated user to potentially enable information disclosure via local access.	2024-05-16	4.7	CVE-2024-21792 secure@intel.com
n/a--Intel(R) PCM software	Uncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21818 secure@intel.com
n/a--Intel(R) PROSet/Wireless WiFi software for Windows	Race condition for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.	2024-05-16	4.3	CVE-2023-40536 secure@intel.com
n/a--Intel(R) PROSet/Wireless WiFi software for linux	Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.	2024-05-16	4.7	CVE-2023-47210 secure@intel.com
n/a--Intel(R) PROSet/Wireless WiFi software	Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.	2024-05-16	4.3	CVE-2023-38417 secure@intel.com
n/a--Intel(R) Power Gadget software for Windows	Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-45736 secure@intel.com
n/a--Intel(R) Power Gadget software for Windows	NULL pointer dereference in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	5	CVE-2023-41234 secure@intel.com
n/a--Intel(R) Power Gadget software for Windwos	Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	5.5	CVE-2023-45315 secure@intel.com
n/a--Intel(R) Power Gadget software for macOS	Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	5.5	CVE-2023-45846 secure@intel.com
n/a--Intel(R) Processor Diagnostic Tool software	Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21831 secure@intel.com
n/a--Intel(R) Processor Identification Utility software	Uncontrolled search path in some Intel(R) Processor Identification Utility software before versions 6.10.34.1129, 7.1.6 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21774 secure@intel.com
n/a--Intel(R) Quartus(R) Prime Lite Edition Design software	Improper conditions check for some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21809 secure@intel.com
n/a--Intel(R) Quartus(R) Prime Lite Edition Design software	Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21837 secure@intel.com
n/a--Intel(R) Quartus(R) Prime Pro Edition Design software	Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21777 secure@intel.com
n/a--Intel(R) Quartus(R) Prime Standard Edition Design software	Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21862 secure@intel.com
n/a--Intel(R) TDX module software	Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.	2024-05-16	6	CVE-2023-47855 secure@intel.com
n/a--Intel(R) VTune(TM) Profiler software	Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-45320 secure@intel.com
n/a--Intel(R) Wireless Bluetooth products for Windows	Improper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	5.5	CVE-2023-47859 secure@intel.com
n/a--Intel(R) Wireless Bluetooth(R) products for Windows	Improper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to potentially enable denial of service via local access.	2024-05-16	4.4	CVE-2023-45845 secure@intel.com
n/a--Intel(R) XTU software	Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2024-21835 secure@intel.com
n/a--Libva software maintained by Intel(R)	Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-39929 secure@intel.com
n/a--UEFI firmware for some Intel(R) Server Board S2600BP products	Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user to potentially enable denial of service via local access.	2024-05-16	5.8	CVE-2023-22662 secure@intel.com
n/a--n/a	An issue was discovered in Samsung Magician 8.0.0 on macOS. Because symlinks are used during the installation process, an attacker can escalate privileges via arbitrary file permission writes. (The attacker must already have user privileges, and an administrator password must be entered during the program installation stage for privilege escalation.)	2024-05-14	6.7	CVE-2024-31952 cve@mitre.org
n/a--n/a	An issue was discovered in Samsung Magician 8.0.0 on macOS. Because it is possible to tamper with the directory and executable files used during the installation process, an attacker can escalate privileges through arbitrary code execution. (The attacker must already have user privileges, and an administrator password must be entered during the program installation stage for privilege escalation.)	2024-05-14	6.7	CVE-2024-31953 cve@mitre.org
n/a--n/a	A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.	2024-05-14	4.3	CVE-2024-28759 cve@mitre.org cve@mitre.org
n/a--onboard video driver software for Intel(R) Server Boards based on Intel(R) 62X Chipset	Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X Chipset may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	6.7	CVE-2023-42668 secure@intel.com
nalam-1--Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )	The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text effect widget in all versions up to, and including, 1.1.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-2923 security@wordfence.com security@wordfence.com
nko--Visual Portfolio, Photo Gallery & Post Grid	The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4363 security@wordfence.com security@wordfence.com security@wordfence.com
nocodb--nocodb	NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the database. Version 0.202.10 contains a patch for the issue.	2024-05-14	6.5	CVE-2023-50718 security-advisories@github.com
nocodb--nocodb	NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack. This allows remote attacker to execute JavaScript code in the context of the user accessing the vector. An attacker could have used this vulnerability to execute requests in the name of a logged-in user or potentially collect information about the attacked user by displaying a malicious form. Version 0.202.10 contains a patch for the issue.	2024-05-14	5.7	CVE-2023-50717 security-advisories@github.com
nvidia--ChatRTX	NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information issue by data sniffing. A successful exploit of this vulnerability might lead to information disclosure.	2024-05-14	5.5	CVE-2024-0098 psirt@nvidia.com
nvidia--NVIDIA Triton Inference Server	NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulnerability might lead to denial of service and data tampering.	2024-05-14	6.5	CVE-2024-0100 psirt@nvidia.com
nvidia--NVIDIA Triton Inference Server	NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an improper memory access issue by a network API. A successful exploit of this vulnerability might lead to denial of service and data tampering.	2024-05-14	5.5	CVE-2024-0088 psirt@nvidia.com
optimole--Image Optimization by Optimole Lazy Load, CDN, Convert WebP & AVIF	The Image Optimization by Optimole - Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_meme_types' function in versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4636 security@wordfence.com security@wordfence.com security@wordfence.com
paperless-ngx--paperless-ngx	Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.	2024-05-15	5.5	CVE-2024-35184 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
phpbits--Forty Four 404 Plugin for WordPress	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpbits Forty Four - 404 Plugin for WordPress allows Stored XSS.This issue affects Forty Four - 404 Plugin for WordPress: from n/a through 1.4.	2024-05-14	5.9	CVE-2024-34423 audit@patchstack.com
piotnetdotcom--Piotnet Addons For Elementor	The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-4432 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
posimyththemes--The Plus Addons for Elementor Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce	The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-34373 is likely a duplicate of this issue.	2024-05-14	6.4	CVE-2024-0445 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
posimyththemes--The Plus Addons for Elementor Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce	The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-2785 security@wordfence.com security@wordfence.com security@wordfence.com
prasunsen--Hostel	The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-14	4.3	CVE-2024-4314 security@wordfence.com security@wordfence.com
pt-guy--Content Views Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)	The Content Views - Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pagingType' parameter in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4446 security@wordfence.com security@wordfence.com
pure-chat--Pure Chat Live Chat Plugin & More!	The Pure Chat - Live Chat Plugin & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the purechatwid and purechatwname parameter in all versions up to, and including, 2.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3595 security@wordfence.com security@wordfence.com
rankmath--Rank Math SEO with AI Best SEO Tools	The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'textAlign' parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4335 security@wordfence.com security@wordfence.com security@wordfence.com
rankmath--Rank Math SEO with AI Best SEO Tools	The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in versions up to, and including, 1.0.218 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4617 security@wordfence.com security@wordfence.com security@wordfence.com
realmag777--WordPress Meta Data and Taxonomies Filter (MDTF)	Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.	2024-05-17	6.5	CVE-2024-34434 audit@patchstack.com
redbitcz--SimpleShop	The SimpleShop plugin for WordPress is vulnerable to unauthorized disconnection from SimpleShop due to a missing capability check on the maybe_disconnect_simpleshop function in all versions up to, and including, 2.10.2. This makes it possible for unauthenticated attackers to disconnect the SimpleShop.	2024-05-14	5.3	CVE-2024-1229 security@wordfence.com security@wordfence.com security@wordfence.com
redbitcz--SimpleShop	The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybe_disconnect_simpleshop function. This makes it possible for unauthenticated attackers to disconnect the site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-14	4.3	CVE-2024-1230 security@wordfence.com security@wordfence.com security@wordfence.com
reviewx--ReviewX Multi-criteria Rating & Reviews for WooCommerce	The ReviewX - Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments.	2024-05-16	4.3	CVE-2024-3609 security@wordfence.com security@wordfence.com
ruby--rexml	REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.	2024-05-16	5.3	CVE-2024-35176 security-advisories@github.com security-advisories@github.com security-advisories@github.com
sbouey--Falang multilanguage for WordPress	The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.49 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-05-14	4.4	CVE-2024-4417 security@wordfence.com security@wordfence.com
sc0ttkclark--Pods Custom Content Types and Fields	The Pods - Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pod Form widget in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	5.4	CVE-2024-3956 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
shaonsina--Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)	The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4333 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
shaonsina--Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)	The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Particle Layer widget in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4373 security@wordfence.com security@wordfence.com
smartersite--WP Compress Image Optimizer [All-In-One]	The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.	2024-05-14	6.5	CVE-2024-4445 security@wordfence.com security@wordfence.com security@wordfence.com
smartersite--WP Compress Image Optimizer [All-In-One]	The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.	2024-05-14	4.3	CVE-2023-6812 security@wordfence.com security@wordfence.com
smartypants--SP Project & Document Manager	The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.	2024-05-14	4.3	CVE-2024-1693 security@wordfence.com security@wordfence.com
solidus--solidus	Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.	2024-05-14	5.7	CVE-2024-4859 vulnreport@tenable.com
squelch--Squelch Tabs and Accordions Shortcodes	The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-14	4.3	CVE-2024-4463 security@wordfence.com security@wordfence.com
stacklok--minder	Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to interact with REST endpoints to fetch data for rule evaluation. When fetching data with the REST ingester, Minder sends a request to an endpoint and will use the data from the body of the response as the data to evaluate against a certain rule. If the response is sufficiently large, it can drain memory on the machine and crash the Minder server. The attacker can control the remote REST endpoints that Minder sends requests to, and they can configure the remote REST endpoints to return responses with large bodies. They would then instruct Minder to send a request to their configured endpoint that would return the large response which would crash the Minder server. Version 0.0.49 fixes this issue.	2024-05-16	5.3	CVE-2024-35185 security-advisories@github.com security-advisories@github.com
stalwartlabs--mail-server	Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins) can read arbitrary files as root. This issue affects admins who have set up to run stalwart with `RUN_AS_USER` who handed out admin credentials to the mail server but expect these to only grant access according to the `RUN_AS_USER` and are attacked where the attackers managed to achieve Arbitrary Code Execution using another vulnerability. Version 0.8.0 contains a patch for the issue.	2024-05-15	6.8	CVE-2024-35179 security-advisories@github.com
stellar--stellar-core	Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could be randomly crashed due to a race condition with a 3rd party library. The likelihood of affecting the network is low since crashed nodes come back up online right away. Code fix mitigation is part of Stellar-core v20.4.0 release	2024-05-14	5.9	CVE-2024-32985 security-advisories@github.com
swte--Swift Performance Lite	The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve and modify settings.	2024-05-14	5.4	CVE-2024-3722 security@wordfence.com security@wordfence.com
talspotim--Comments Evolved for WordPress	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in talspotim Comments Evolved for WordPress allows Stored XSS.This issue affects Comments Evolved for WordPress: from n/a through 1.6.3.	2024-05-14	5.9	CVE-2024-34420 audit@patchstack.com
techjewel--Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder	The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts.	2024-05-18	6.4	CVE-2024-2772 security@wordfence.com security@wordfence.com
tg123--sshpiper	sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.	2024-05-14	5.3	CVE-2024-35175 security-advisories@github.com security-advisories@github.com security-advisories@github.com
thehappymonster--Happy Addons for Elementor	The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4391 security@wordfence.com security@wordfence.com security@wordfence.com
thehappymonster--Happy Addons for Elementor	The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied 'tooltip_position' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4478 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
thehappymonster--Happy Addons for Elementor	The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id' parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-4865 security@wordfence.com security@wordfence.com security@wordfence.com
thehappymonster--Happy Addons for Elementor	The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id' parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-5088 security@wordfence.com security@wordfence.com security@wordfence.com
themeisle--Menu Icons by ThemeIsle	The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_mime_type' function in versions up to, and including, 0.13.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4635 security@wordfence.com security@wordfence.com security@wordfence.com
themelooks--Enter Addons Ultimate Template Builder for Elementor	The Enter Addons - Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3680 security@wordfence.com security@wordfence.com
themelooks--Enter Addons Ultimate Template Builder for Elementor	The Enter Addons - Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-3831 security@wordfence.com security@wordfence.com
themeum--Tutor LMS eLearning and online course solution	The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.	2024-05-16	6.5	CVE-2024-4279 security@wordfence.com security@wordfence.com security@wordfence.com
themifyme--Themify Shortcodes	The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4567 security@wordfence.com security@wordfence.com
thimpress--LearnPress WordPress LMS Plugin	The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_html' parameter in all versions up to, and including, 4.2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4277 security@wordfence.com security@wordfence.com
thimpress--LearnPress WordPress LMS Plugin	The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the 'create_account' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.	2024-05-14	5.3	CVE-2024-4444 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
thimpress--Thim Elementor Kit	The Thim Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4329 security@wordfence.com security@wordfence.com
tigroumeow--Gallery Block (Meow Gallery)	The Gallery Block (Meow Gallery) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_atts' parameter in versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4386 security@wordfence.com security@wordfence.com security@wordfence.com
timstrifler--Exclusive Addons for Elementor	The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versions up to, and including, 2.6.9.6 due to insufficient input sanitization and output escaping on user supplied 'url' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4618 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
trinhtuantai--Viet Affiliate Link	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trinhtuantai Viet Affiliate Link allows Stored XSS.This issue affects Viet Affiliate Link: from n/a through 1.2.	2024-05-14	5.9	CVE-2024-34422 audit@patchstack.com
uapp--Testimonial Carousel For Elementor	The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-4698 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
unitecms--Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-05-14	6.1	CVE-2024-3547 security@wordfence.com security@wordfence.com
upwerd--Visual Footer Credit Remover	The Visual Footer Credit Remover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'selector' parameter in all versions up to, and including, 2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-05-14	4.4	CVE-2024-2846 security@wordfence.com security@wordfence.com
videousermanuals--White Label CMS	The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings.	2024-05-14	5.3	CVE-2024-4280 security@wordfence.com security@wordfence.com
villatheme--Orders Tracking for WooCommerce	The The Orders Tracking for WooCommerce plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.10. This is due to the plugin allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. A partial patch was released in 1.2.10, and a complete patch was released in 1.2.11.	2024-05-14	6.5	CVE-2024-4039 security@wordfence.com security@wordfence.com security@wordfence.com
visualmodo--Borderless Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg	The Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4666 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
weForms--weForms	Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.	2024-05-17	5.3	CVE-2024-32512 audit@patchstack.com
webdevmattcrom--GiveWP Donation Plugin and Fundraising Platform	The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-3714 security@wordfence.com security@wordfence.com
webtechideas--WTI Like Post	Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1.4.6.	2024-05-17	5.3	CVE-2024-33917 audit@patchstack.com
wolfi-dev--wolfictl	wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user's GitHub token to be sent to remote servers other than `github.com`. Most git-dependent functionality in wolfictl relies on its own `git` package, which contains centralized logic for implementing interactions with git repositories. Some of this functionality requires authentication in order to access private repositories. A central function `GetGitAuth` looks for a GitHub token in the environment variable `GITHUB_TOKEN` and returns it as an HTTP basic auth object to be used with the `github.com/go-git/go-git/v5` library. Most callers (direct or indirect) of `GetGitAuth` use the token to authenticate to github.com only; however, in some cases callers were passing this authentication without checking that the remote git repository was hosted on github.com. This behavior has existed in one form or another since commit 0d06e1578300327c212dda26a5ab31d09352b9d0 - committed January 25, 2023. This impacts anyone who ran the `wolfictl check update` commands with a Melange configuration that included a `git-checkout` directive step that referenced a git repository not hosted on github.com. This also impacts anyone who ran `wolfictl update ` with a remote URL outside of github.com. Additionally, these subcommands must have run with the `GITHUB_TOKEN` environment variable set to a valid GitHub token. Users should upgrade to version 0.16.10 to receive a patch.	2024-05-15	4.4	CVE-2024-35183 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
wpdevteam--EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor	The EmbedPress - Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 3.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4316 security@wordfence.com security@wordfence.com
wpdevteam--Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders	The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Interactive Circle widget in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4275 security@wordfence.com security@wordfence.com
wpdevteam--Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders	The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.5	CVE-2024-4448 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wpdevteam--Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders	The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Fancy Text', 'Filter Gallery', 'Sticky Video', 'Content Ticker', 'Woo Product Gallery', & 'Twitter Feed' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4449 security@wordfence.com security@wordfence.com
wpdevteam--Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders	The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eael_ext_toc_title_tag' parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4624 security@wordfence.com security@wordfence.com security@wordfence.com
wpdevteam--Essential Blocks Page Builder Gutenberg Blocks, Patterns & Templates	The Essential Blocks - Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-18	6.4	CVE-2024-4891 security@wordfence.com security@wordfence.com security@wordfence.com
wpexpertsio--Password Protected Ultimate Plugin to Password Protect Your WordPress Content with Ease	The Password Protected - Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticated attackers, with subscriber access or higher, to extract post titles and content, thus bypassing the plugin's password protection.	2024-05-15	4.3	CVE-2024-0437 security@wordfence.com security@wordfence.com
wpjoli--Joli FAQ SEO WordPress FAQ Plugin	The Joli FAQ SEO - WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-05-14	4.3	CVE-2024-4082 security@wordfence.com security@wordfence.com
wpkube--Simple Basic Contact Form	The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.	2024-05-14	6.5	CVE-2024-4144 security@wordfence.com security@wordfence.com security@wordfence.com
wpkube--Simple Basic Contact Form	The Simple Basic Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'scf_email' parameter in versions up to, and including, 20221201 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-05-14	6.1	CVE-2024-4150 security@wordfence.com security@wordfence.com security@wordfence.com
wproyal--Royal Elementor Addons and Templates	The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in all versions up to, and including, 1.3.974 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	5.4	CVE-2024-3887 security@wordfence.com security@wordfence.com
wpsurface--BlogLentor	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsurface BlogLentor allows Stored XSS.This issue affects BlogLentor: from n/a through 1.0.8.	2024-05-14	6.5	CVE-2024-34421 audit@patchstack.com
wpzoom--WPZOOM Addons for Elementor (Templates, Widgets)	The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-15	6.4	CVE-2024-4370 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
xpro--140+ Widgets \| Best Addons For Elementor FREE	The 140+ Widgets \| Best Addons For Elementor - FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-14	6.4	CVE-2024-4440 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
yithemes--YITH WooCommerce Gift Cards	The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers to modify WooCommerce settings.	2024-05-14	5.3	CVE-2024-0870 security@wordfence.com security@wordfence.com
yoast--Yoast SEO	The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-05-14	6.1	CVE-2024-4041 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
yoast--Yoast SEO	The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-05-16	6.4	CVE-2024-4984 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com

Low Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
Bill Minozzi--Car Dealer	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects Car Dealer: from n/a through 4.15.	2024-05-17	2.7	CVE-2024-4214 audit@patchstack.com
Campcodes--Complete Web-Based School Management System	A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/show_student_subject.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263593 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4672 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is some unknown functionality of the file /view/show_student_grade_subject.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263594 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4673 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/show_friend_request.php. The manipulation of the argument my_index leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263595.	2024-05-14	3.5	CVE-2024-4674 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /view/show_events.php. The manipulation of the argument event_id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263596.	2024-05-14	3.5	CVE-2024-4675 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /view/range_grade_text.php. The manipulation of the argument count leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263597 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4676 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /view/my_student_exam_marks1.php. The manipulation of the argument year leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263598 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4677 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /view/find_friends.php. The manipulation of the argument my_type leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263599.	2024-05-14	3.5	CVE-2024-4678 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /view/exam_timetable_update_form.php. The manipulation of the argument exam leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263623.	2024-05-14	3.5	CVE-2024-4682 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /view/exam_timetable_insert_form.php. The manipulation of the argument exam leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263624.	2024-05-14	3.5	CVE-2024-4683 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /view/exam_timetable_grade_wise.php. The manipulation of the argument exam leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263625 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4684 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /view/exam_timetable.php. The manipulation of the argument exam leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263626 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4685 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /view/emarks_range_grade_update_form.php. The manipulation of the argument grade leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263627.	2024-05-14	3.5	CVE-2024-4686 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/create_events.php. The manipulation of the argument my_index leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263628.	2024-05-14	3.5	CVE-2024-4687 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/conversation_history_admin.php. The manipulation of the argument conversation_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263629 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4688 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/all_teacher.php. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263791.	2024-05-14	3.5	CVE-2024-4713 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is some unknown functionality of the file /model/update_subject.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263792.	2024-05-14	3.5	CVE-2024-4714 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /model/update_grade.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263793 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4715 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /model/update_exam.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263794 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4716 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /model/update_classroom.php. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263795.	2024-05-14	3.5	CVE-2024-4717 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /model/delete_student_grade_subject.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263796.	2024-05-14	3.5	CVE-2024-4718 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /model/delete_record.php. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263797 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4719 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /model/approve_petty_cash.php. The manipulation of the argument admin_index leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263798 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4720 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /model/add_student_subject.php. The manipulation of the argument index leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263799.	2024-05-14	3.5	CVE-2024-4721 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Complete Web-Based School Management System	A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects unknown code of the file index.php. The manipulation of the argument category leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263800.	2024-05-14	3.5	CVE-2024-4722 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability, which was classified as problematic, has been found in Campcodes Legal Case Management System 1.0. This issue affects some unknown processing of the file /admin/case-status. The manipulation of the argument case_status leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263801 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4723 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability, which was classified as problematic, was found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/case-type. The manipulation of the argument case_type_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263802 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4724 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability has been found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/client_user. The manipulation of the argument f_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263803.	2024-05-14	3.5	CVE-2024-4725 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/clients. The manipulation of the argument f_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263804.	2024-05-14	3.5	CVE-2024-4726 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/court-type. The manipulation of the argument court_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263805 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4727 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/court. The manipulation of the argument court_name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263806 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4728 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/expense-type. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263807.	2024-05-14	3.5	CVE-2024-4729 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability classified as problematic has been found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/judge. The manipulation of the argument judge_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263808.	2024-05-14	3.5	CVE-2024-4730 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability classified as problematic was found in Campcodes Legal Case Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/role. The manipulation of the argument slug leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263809 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4731 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability, which was classified as problematic, has been found in Campcodes Legal Case Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/service. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263810 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4732 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability has been found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tasks. The manipulation of the argument task_subject leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263821 was assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4735 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/tax. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263822 is the identifier assigned to this vulnerability.	2024-05-14	3.5	CVE-2024-4736 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vendor. The manipulation of the argument company_name/mobile leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263823.	2024-05-14	3.5	CVE-2024-4737 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Legal Case Management System	A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument new_client leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263824.	2024-05-14	3.5	CVE-2024-4738 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Campcodes--Online Laundry Management System	A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /ajax.php. The manipulation of the argument name/customer_name/username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263896.	2024-05-14	3.5	CVE-2024-4797 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
Filipe Seabra--WordPress Manuteno	Authentication Bypass by Spoofing vulnerability in Filipe Seabra WordPress ManutenÃ§Ã£o allows Functionality Bypass.This issue affects WordPress ManutenÃ§Ã£o: from n/a through 1.0.6.	2024-05-17	3.7	CVE-2024-22139 audit@patchstack.com
Huawei--HarmonyOS	Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.	2024-05-14	3.3	CVE-2024-32989 psirt@huawei.com psirt@huawei.com
IBM--Security Guardium	IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service. IBM X-Force ID: 271526.	2024-05-14	2.7	CVE-2023-47711 psirt@us.ibm.com psirt@us.ibm.com
JetBrains--TeamCity	In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible	2024-05-16	3.5	CVE-2024-35300 cve@jetbrains.com
Nozomi Networks--Arc	On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.	2024-05-15	3.8	CVE-2023-5937 prodsec@nozominetworks.com
OpenText--iManager	Broken Authentication vulnerability discovered in OpenTextâ„¢ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypass authentication.	2024-05-15	3.5	CVE-2024-3487 security@opentext.com
Pippin Williamson--CGC Maintenance Mode	Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode: from n/a through 1.2.	2024-05-17	3.7	CVE-2024-30480 audit@patchstack.com
SAP_SE--SAP Bank Account Management	SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system.	2024-05-14	3.5	CVE-2024-33000 cna@sap.com cna@sap.com
SAP_SE--SAPUI5 (PDFViewer)	PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.	2024-05-14	3.5	CVE-2024-33007 cna@sap.com cna@sap.com
Siemens--Parasolid V35.1	A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.208), Parasolid V36.1 (All versions < V36.1.173). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.	2024-05-14	3.3	CVE-2024-32637 productcert@siemens.com
Siemens--SIMATIC RTLS Locating Manager	A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected application contains a hidden configuration item to enable debug functionality. This could allow an authenticated local attacker to gain insight into the internal configuration of the deployment.	2024-05-14	3.3	CVE-2024-33583 productcert@siemens.com
SourceCodester--Interactive Map with Marker	A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Marker Name of the component Add Marker. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264536.	2024-05-16	3.5	CVE-2024-4968 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
SourceCodester--Simple Image Stack Website	A vulnerability, which was classified as problematic, was found in SourceCodester Simple Image Stack Website 1.0. This affects an unknown part. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264459.	2024-05-16	3.5	CVE-2024-4922 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
TYPO3--typo3	TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.	2024-05-14	3.5	CVE-2024-34355 security-advisories@github.com security-advisories@github.com security-advisories@github.com
Wireshark Foundation--editcap	Memory handling issue in editcap could cause denial of service via crafted capture file	2024-05-14	3.6	CVE-2024-4853 cve@gitlab.com cve@gitlab.com
Wireshark Foundation--editcap	Use after free issue in editcap could cause denial of service via crafted capture file	2024-05-14	3.6	CVE-2024-4855 cve@gitlab.com cve@gitlab.com cve@gitlab.com cve@gitlab.com
cea-hpc--sshproxy	sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.	2024-05-14	3.5	CVE-2024-34713 security-advisories@github.com security-advisories@github.com
code-projects--Simple Chat System	A vulnerability, which was classified as problematic, was found in code-projects Simple Chat System 1.0. Affected is an unknown function of the file /register.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264540.	2024-05-16	3.5	CVE-2024-4974 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects--Simple Chat System	A vulnerability, which was classified as problematic, has been found in code-projects Simple Chat System 1.0. This issue affects some unknown processing of the component Message Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264539.	2024-05-16	3.5	CVE-2024-4975 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
git--git	Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.	2024-05-14	3.9	CVE-2024-32020 security-advisories@github.com security-advisories@github.com security-advisories@github.com
git--git	Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.	2024-05-14	3.9	CVE-2024-32021 security-advisories@github.com
gocd--gocd	GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a `redirect_to` query parameter with inadequate validation. Attackers could theoretically abuse the query parameter to steal session tokens or other values from the user's browser. In practice exploiting this to perform privileged actions is likely rather difficult to exploit because the target user would need to be triggered to open an attacker-crafted link in the period where the server is starting up (but not completely started), requiring chaining with a separate denial-of-service vulnerability. Additionally, GoCD server restarts invalidate earlier session tokens (i.e GoCD does not support persistent sessions), so a stolen session token would be unusable once the server has completed restart, and executed XSS would be done within a logged-out context. The issue is fixed in GoCD 24.1.0. As a workaround, it is technically possible in earlier GoCD versions to override the loading page with an earlier version which is not vulnerable, by starting GoCD with the Java system property override as either `-Dloading.page.resource.path=/loading_pages/default.loading.page.html` (simpler early version of loading page without GoCD introduction) or `-Dloading.page.resource.path=/does_not_exist.html` (to display a simple message with no interactivity).	2024-05-14	3.1	CVE-2024-28866 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
helderk--Maintenance Mode	Authentication Bypass by Spoofing vulnerability in helderk Maintenance Mode allows Functionality Bypass.This issue affects Maintenance Mode: from n/a through 3.0.1.	2024-05-17	3.7	CVE-2024-32708 audit@patchstack.com
n/a--Emlog Pro	A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipulation of the argument AuthCookie leads to improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-264741 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-05-17	3.7	CVE-2024-5044 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
n/a--Intel(R) CBI software	Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	2.8	CVE-2023-43745 secure@intel.com
n/a--Intel(R) Media SDK and some Intel(R) oneVPL software	Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	3.9	CVE-2023-22656 secure@intel.com
n/a--Intel(R) Media SDK software	Improper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.	2024-05-16	3.3	CVE-2023-47169 secure@intel.com
n/a--Intel(R) Power Gadget software for macOS	Improper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable information disclosure via local access.	2024-05-16	3.8	CVE-2023-38420 secure@intel.com
n/a--Intel(R) Processors	Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access.	2024-05-16	2.8	CVE-2023-45733 secure@intel.com
n/a--Intel(R) Trace Analyzer and Collector software	Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2022.0.0 published Nov 2023 may allow an authenticated user to potentially enable information disclosure via local access.	2024-05-16	2.8	CVE-2024-22384 secure@intel.com
n/a--Intel(R) oneVPL software	Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.	2024-05-16	3.9	CVE-2023-47282 secure@intel.com
n/a--Intel(R) oneVPL software	NULL pointer dereference in some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable information disclosure via local access.	2024-05-16	3.3	CVE-2023-48727 secure@intel.com
n/a--PostgreSQL	Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.	2024-05-14	3.1	CVE-2024-4317 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
octo-sts--app	octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. This vulnerability can spike the resource utilization of the STS service, and combined with a significant traffic volume could potentially lead to a denial of service. This vulnerability is fixed in 0.1.0	2024-05-14	3.7	CVE-2024-34079 security-advisories@github.com security-advisories@github.com

Severity Not Yet Assigned

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
Aidin--Phormer	Phormer prior to version 3.35 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote unauthenticated attacker may execute an arbitrary script on the web browser of the user.	2024-05-14	not yet calculated	CVE-2024-34749 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
Ant Media--Ant Media Server Community Edition	Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.	2024-05-14	not yet calculated	CVE-2024-3462 cvd@cert.pl cvd@cert.pl cvd@cert.pl
Apache Software Foundation--Apache Airflow	Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.	2024-05-14	not yet calculated	CVE-2024-32077 security@apache.org security@apache.org
Apple--iOS and iPadOS	A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Ventura 13.6.7, macOS Sonoma 14.4. An app may be able to access user-sensitive data.	2024-05-14	not yet calculated	CVE-2024-27789 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An attacker may be able to elevate privileges.	2024-05-14	not yet calculated	CVE-2024-27796 product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to share items from the lock screen.	2024-05-14	not yet calculated	CVE-2024-27803 product-security@apple.com
Apple--iOS and iPadOS	The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges.	2024-05-14	not yet calculated	CVE-2024-27804 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5. An app may be able to read sensitive location information.	2024-05-14	not yet calculated	CVE-2024-27810 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	A logic issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5. An attacker may be able to access user data.	2024-05-14	not yet calculated	CVE-2024-27816 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An attacker may be able to cause unexpected app termination or arbitrary code execution.	2024-05-14	not yet calculated	CVE-2024-27818 product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A shortcut may output sensitive user data without consent.	2024-05-14	not yet calculated	CVE-2024-27821 product-security@apple.com product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.	2024-05-14	not yet calculated	CVE-2024-27834 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device may be able to access notes from the lock screen.	2024-05-14	not yet calculated	CVE-2024-27835 product-security@apple.com
Apple--iOS and iPadOS	A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicious application may be able to determine a user's current location.	2024-05-14	not yet calculated	CVE-2024-27839 product-security@apple.com
Apple--iOS and iPadOS	The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An app may be able to disclose kernel memory.	2024-05-14	not yet calculated	CVE-2024-27841 product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	This issue was addressed with improved checks This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An app may be able to bypass Privacy preferences.	2024-05-14	not yet calculated	CVE-2024-27847 product-security@apple.com product-security@apple.com
Apple--iOS and iPadOS	A privacy issue was addressed with improved client ID handling for alternative app marketplaces. This issue is fixed in iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may be able to distribute a script that tracks users on other webpages.	2024-05-14	not yet calculated	CVE-2024-27852 product-security@apple.com
Apple--iTunes for Windows	The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected app termination or arbitrary code execution.	2024-05-14	not yet calculated	CVE-2024-27793 product-security@apple.com
Apple--macOS	This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5, macOS Ventura 13.6.5, macOS Sonoma 14.4. A malicious application may be able to access Find My data.	2024-05-14	not yet calculated	CVE-2024-23229 product-security@apple.com product-security@apple.com product-security@apple.com
Apple--macOS	A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to read arbitrary files.	2024-05-14	not yet calculated	CVE-2024-23236 product-security@apple.com
Apple--macOS	An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.5. An attacker may be able to elevate privileges.	2024-05-14	not yet calculated	CVE-2024-27798 product-security@apple.com
Apple--macOS	The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.	2024-05-14	not yet calculated	CVE-2024-27813 product-security@apple.com
Apple--macOS	A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to gain root privileges.	2024-05-14	not yet calculated	CVE-2024-27822 product-security@apple.com
Apple--macOS	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.5. An app may be able to elevate privileges.	2024-05-14	not yet calculated	CVE-2024-27824 product-security@apple.com
Apple--macOS	A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to bypass certain Privacy preferences.	2024-05-14	not yet calculated	CVE-2024-27825 product-security@apple.com
Apple--macOS	This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.5. An app may be able to read arbitrary files.	2024-05-14	not yet calculated	CVE-2024-27827 product-security@apple.com
Apple--macOS	The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may lead to unexpected app termination or arbitrary code execution.	2024-05-14	not yet calculated	CVE-2024-27829 product-security@apple.com
Apple--macOS	A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.	2024-05-14	not yet calculated	CVE-2024-27837 product-security@apple.com
Apple--macOS	The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges.	2024-05-14	not yet calculated	CVE-2024-27842 product-security@apple.com
Apple--macOS	A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to elevate privileges.	2024-05-14	not yet calculated	CVE-2024-27843 product-security@apple.com
CEMI Tomasz Paweek--CemiPark	The access control in CemiPark software does not properly validate user-entered data, which allows the authentication bypass. An attacker who has network access to the login panel can log in with administrator rights to the application.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.	2024-05-14	not yet calculated	CVE-2024-4423 cvd@cert.pl cvd@cert.pl cvd@cert.pl
CEMI Tomasz Paweek--CemiPark	The access control in CemiPark software does not properly validate user-entered data, which allows the stored cross-site scripting (XSS) attack. The parameters used to enter data into the system do not have appropriate validation, which makes possible to smuggle in HTML/JavaScript code. This code will be executed in the user's browser space.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.	2024-05-14	not yet calculated	CVE-2024-4424 cvd@cert.pl cvd@cert.pl cvd@cert.pl
CEMI Tomasz Paweek--CemiPark	The access control in CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.	2024-05-14	not yet calculated	CVE-2024-4425 cvd@cert.pl cvd@cert.pl cvd@cert.pl
Claris--FileMaker Server	Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by eliminating the send of Admin Role passwords in the Node.js socket.	2024-05-14	not yet calculated	CVE-2023-42955 product-security@apple.com
Claris--FileMaker Server	Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue has been fixed in FileMaker Server 20.3.2 by validating transactions before replying to client requests.	2024-05-14	not yet calculated	CVE-2024-27790 product-security@apple.com
Devolutions--Server	Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request.	2024-05-17	not yet calculated	CVE-2024-5072 security@devolutions.net
Digisol--Digisol Router DG-GR1321	This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to improper implementation of password policies. An attacker with physical access could exploit this by creating password that do not adhere to the defined security standards/policy on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to expose the router to potential security threats.	2024-05-14	not yet calculated	CVE-2024-2257 vdisclose@cert-in.org.in
Digisol--Digisol Router DG-GR1321	This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.	2024-05-14	not yet calculated	CVE-2024-4231 vdisclose@cert-in.org.in
Digisol--Digisol Router DG-GR1321	This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.	2024-05-14	not yet calculated	CVE-2024-4232 vdisclose@cert-in.org.in
Google--Chrome	Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)	2024-05-14	not yet calculated	CVE-2024-4761 chrome-cve-admin@google.com chrome-cve-admin@google.com
Google--Chrome	Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)	2024-05-15	not yet calculated	CVE-2024-4947 chrome-cve-admin@google.com chrome-cve-admin@google.com
Google--Chrome	Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	2024-05-15	not yet calculated	CVE-2024-4948 chrome-cve-admin@google.com chrome-cve-admin@google.com
Google--Chrome	Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)	2024-05-15	not yet calculated	CVE-2024-4949 chrome-cve-admin@google.com chrome-cve-admin@google.com
Google--Chrome	Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)	2024-05-15	not yet calculated	CVE-2024-4950 chrome-cve-admin@google.com chrome-cve-admin@google.com
HP Inc.--Plantronics Hub	A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.	2024-05-14	not yet calculated	CVE-2024-27460 hp-security-alert@hp.com
Ligowave--UNITY	A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.	2024-05-16	not yet calculated	CVE-2024-4999 research@onekey.com
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.	2024-05-14	not yet calculated	CVE-2023-52654 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value. The driver will then proceed to parse the header located at that position, which will either oops or process some random value. The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver.	2024-05-14	not yet calculated	CVE-2023-52655 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it.	2024-05-14	not yet calculated	CVE-2023-52656 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd/pm: resolve reboot exception for si oland" This reverts commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86. This causes hangs on SI when DC is enabled and errors on driver reboot and power off cycles.	2024-05-17	not yet calculated	CVE-2023-52657 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" This reverts commit 662404b24a4c4d839839ed25e3097571f5938b9b. The revert is required due to the suspicion it is not good for anything and cause crash.	2024-05-17	not yet calculated	CVE-2023-52658 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type On 64-bit platforms, the pfn_to_kaddr() macro requires that the input value is 64 bits in order to ensure that valid address bits don't get lost when shifting that input by PAGE_SHIFT to calculate the physical address to provide a virtual address for. One such example is in pvalidate_pages() (used by SEV-SNP guests), where the GFN in the struct used for page-state change requests is a 40-bit bit-field, so attempts to pass this GFN field directly into pfn_to_kaddr() ends up causing guest crashes when dealing with addresses above the 1TB range due to the above. Fix this issue with SEV-SNP guests, as well as any similar cases that might cause issues in current/future code, by using an inline function, instead of a macro, so that the input is implicitly cast to the expected 64-bit input type prior to performing the shift operation. While it might be argued that the issue is on the caller side, other archs/macros have taken similar approaches to deal with instances like this, such as ARM explicitly casting the input to phys_addr_t: e48866647b48 ("ARM: 8396/1: use phys_addr_t in pfn_to_kaddr()") A C inline function is even better though. [ mingo: Refined the changelog some more & added __always_inline. ]	2024-05-17	not yet calculated	CVE-2023-52659 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: media: rkisp1: Fix IRQ handling due to shared interrupts The driver requests the interrupts as IRQF_SHARED, so the interrupt handlers can be called at any time. If such a call happens while the ISP is powered down, the SoC will hang as the driver tries to access the ISP registers. This can be reproduced even without the platform sharing the IRQ line: Enable CONFIG_DEBUG_SHIRQ and unload the driver, and the board will hang. Fix this by adding a new field, 'irqs_enabled', which is used to bail out from the interrupt handler when the ISP is not operational.	2024-05-17	not yet calculated	CVE-2023-52660 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe() If clk_get_sys(..., "pll_d2_out0") fails, the clk_get_sys() call must be undone. Add the missing clk_put and a new 'put_pll_d_out0' label in the error handling path, and use it.	2024-05-17	not yet calculated	CVE-2023-52661 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node When ida_alloc_max fails, resources allocated before should be freed, including *res allocated by kmalloc and ttm_resource_init.	2024-05-17	not yet calculated	CVE-2023-52662 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() Driver uses kasprintf() to initialize fw_{code,data}_bin members of struct acp_dev_data, but kfree() is never called to deallocate the memory, which results in a memory leak. Fix the issue by switching to devm_kasprintf(). Additionally, ensure the allocation was successful by checking the pointer validity.	2024-05-17	not yet calculated	CVE-2023-52663 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.	2024-05-17	not yet calculated	CVE-2023-52664 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2 Commit 8c5fa3b5c4df ("powerpc/64: Make ELFv2 the default for big-endian builds"), merged in Linux-6.5-rc1 changes the calling ABI in a way that is incompatible with the current code for the PS3's LV1 hypervisor calls. This change just adds the line '# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set' to the ps3_defconfig file so that the PPC64_ELF_ABI_V1 is used. Fixes run time errors like these: BUG: Kernel NULL pointer dereference at 0x00000000 Faulting instruction address: 0xc000000000047cf0 Oops: Kernel access of bad area, sig: 11 [#1] Call Trace: [c0000000023039e0] [c00000000100ebfc] ps3_create_spu+0xc4/0x2b0 (unreliable) [c000000002303ab0] [c00000000100d4c4] create_spu+0xcc/0x3c4 [c000000002303b40] [c00000000100eae4] ps3_enumerate_spus+0xa4/0xf8	2024-05-17	not yet calculated	CVE-2023-52665 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential circular locking issue in smb2_set_ea() smb2_set_ea() can be called in parent inode lock range. So add get_write argument to smb2_set_ea() not to call nested mnt_want_write().	2024-05-17	not yet calculated	CVE-2023-52666 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fs_any_create_groups When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fs_any_create_groups() will free ft->g. However, its caller fs_any_create_table() will free ft->g again through calling mlx5e_destroy_flow_table(), which will lead to a double-free. Fix this by setting ft->g to NULL in fs_any_create_groups().	2024-05-17	not yet calculated	CVE-2023-52667 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix lock ordering in btrfs_zone_activate() The btrfs CI reported a lockdep warning as follows by running generic generic/129. WARNING: possible circular locking dependency detected 6.7.0-rc5+ #1 Not tainted ------------------------------------------------------ kworker/u5:5/793427 is trying to acquire lock: ffff88813256d028 (&cache->lock){+.+.}-{2:2}, at: btrfs_zone_finish_one_bg+0x5e/0x130 but task is already holding lock: ffff88810a23a318 (&fs_info->zone_active_bgs_lock){+.+.}-{2:2}, at: btrfs_zone_finish_one_bg+0x34/0x130 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&fs_info->zone_active_bgs_lock){+.+.}-{2:2}: ... -> #0 (&cache->lock){+.+.}-{2:2}: ... This is because we take fs_info->zone_active_bgs_lock after a block_group's lock in btrfs_zone_activate() while doing the opposite in other places. Fix the issue by expanding the fs_info->zone_active_bgs_lock's critical section and taking it before a block_group's lock.	2024-05-17	not yet calculated	CVE-2023-52668 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.	2024-05-17	not yet calculated	CVE-2023-52669 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove() Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac	2024-05-17	not yet calculated	CVE-2023-52670 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 [Why] Under some circumstances, disabling an OPTC and attempting to reclaim its OPP(s) for a different OPTC could cause a hang/underflow due to OPPs not being properly disconnected from the disabled OPTC. [How] Ensure that all OPPs are unassigned from an OPTC when it gets disabled.	2024-05-17	not yet calculated	CVE-2023-52671 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write. Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue. [Christian Brauner : rewrite to account for watch queues]	2024-05-17	not yet calculated	CVE-2023-52672 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a debugfs null pointer error [WHY & HOW] Check whether get_subvp_en() callback exists before calling it.	2024-05-17	not yet calculated	CVE-2023-52673 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[].	2024-05-17	not yet calculated	CVE-2023-52674 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.	2024-05-17	not yet calculated	CVE-2023-52675 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: bpf: Guard stack limits against 32bit overflow This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904	2024-05-17	not yet calculated	CVE-2023-52676 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: riscv: Check if the code to patch lies in the exit section Otherwise we fall through to vmalloc_to_page() which panics since the address does not lie in the vmalloc region.	2024-05-17	not yet calculated	CVE-2023-52677 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c Before using list_first_entry, make sure to check that list is not empty, if list is empty return -ENODATA. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL?	2024-05-17	not yet calculated	CVE-2023-52678 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop. Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur". Extend the unittest to detect the double free and add an additional test case that actually triggers this path.	2024-05-17	not yet calculated	CVE-2023-52679 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing error checks to _ctl_get() The _ctl_get() functions which call scarlett2_update_*() were not checking the return value. Fix to check the return value and pass to the caller.	2024-05-17	not yet calculated	CVE-2023-52680 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: efivarfs: Free s_fs_info on unmount Now that we allocate a s_fs_info struct on fs context creation, we should ensure that we free it again when the superblock goes away.	2024-05-17	not yet calculated	CVE-2023-52681 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait on block writeback for post_read case If inode is compressed, but not encrypted, it missed to call f2fs_wait_on_block_writeback() to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fs_gc - do_garbage_collect - gc_data_segment - move_data_block - f2fs_submit_page_write migrate normal cluster's block via meta_inode's page cache - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_submit_page_bio IRQ - f2fs_read_end_io IRQ old data overrides new data due to out-of-order GC and common IO. - f2fs_read_end_io	2024-05-17	not yet calculated	CVE-2023-52682 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplication overflow In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE.	2024-05-17	not yet calculated	CVE-2023-52683 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: qseecom: fix memory leaks in error paths Fix instances of returning error codes directly instead of jumping to the relevant labels where memory allocated for the SCM calls would be freed.	2024-05-17	not yet calculated	CVE-2023-52684 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit unsigned long, while the ecc_blocks variable this value gets assigned to has (always 32-bit) int type. Even if that value fits into int type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as size_t should fix this mess... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.	2024-05-17	not yet calculated	CVE-2023-52685 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_event_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.	2024-05-17	not yet calculated	CVE-2023-52686 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Add error handling for dma_map_sg() calls Macro dma_map_sg() may return 0 on error. This patch enables checks in case of the macro failure and ensures unmapping of previously mapped buffers with dma_unmap_sg(). Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.	2024-05-17	not yet calculated	CVE-2023-52687 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix the error handler of rfkill config When the core rfkill config throws error, it should free the allocated resources. Currently it is not freeing the core pdev create resources. Avoid this issue by calling the core pdev destroy in the error handler of core rfkill config. Found this issue in the code review and it is compile tested only.	2024-05-17	not yet calculated	CVE-2023-52688 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing mutex lock around get meter levels As scarlett2_meter_ctl_get() uses meter_level_map[], the data_mutex should be locked while accessing it.	2024-05-17	not yet calculated	CVE-2023-52689 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check to scom_debug_init_one() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Add a null pointer check, and release 'ent' to avoid memory leaks.	2024-05-17	not yet calculated	CVE-2023-52690 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in si_dpm_init When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered.	2024-05-17	not yet calculated	CVE-2023-52691 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() scarlett2_usb_set_config() calls scarlett2_usb_get() but was not checking the result. Return the error if it fails rather than continuing with an invalid value.	2024-05-17	not yet calculated	CVE-2023-52692 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being passed to acpi_get_pci_dev() for detecting the parent pci device. Check acpi_get_parent() result and set parent device only in case of success. Found by Linux Verification Center (linuxtesting.org) with SVACE.	2024-05-17	not yet calculated	CVE-2023-52693 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse.	2024-05-17	not yet calculated	CVE-2023-52694 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check writeback connectors in create_validate_stream_for_sink [WHY & HOW] This is to check connector type to avoid unhandled null pointer for writeback connectors.	2024-05-17	not yet calculated	CVE-2023-52695 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_powercap_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.	2024-05-17	not yet calculated	CVE-2023-52696 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL sof_sdw_rt_sdca_jack_exit() are used by different codecs, and some of them use the same dai name. For example, rt712 and rt713 both use "rt712-sdca-aif1" and sof_sdw_rt_sdca_jack_exit(). As a result, sof_sdw_rt_sdca_jack_exit() will be called twice by mc_dailink_exit_loop(). Set ctx->headset_codec_dev = NULL; after put_device(ctx->headset_codec_dev); to avoid ctx->headset_codec_dev being put twice.	2024-05-17	not yet calculated	CVE-2023-52697 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: calipso: fix memory leak in netlbl_calipso_add_pass() If IPv6 support is disabled at boot (ipv6.disable=1), the calipso_init() -> netlbl_calipso_ops_register() function isn't called, and the netlbl_calipso_ops_get() function always returns NULL. In this case, the netlbl_calipso_add_pass() function allocates memory for the doi_def variable but doesn't free it with the calipso_doi_free(). BUG: memory leak unreferenced object 0xffff888011d68180 (size 64): comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s) hex dump (first 32 bytes): 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<...>] kmalloc include/linux/slab.h:552 [inline] [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline] [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111 [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739 [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800 [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515 [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339 [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934 [<...>] sock_sendmsg_nosec net/socket.c:651 [inline] [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671 [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342 [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396 [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429 [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller [PM: merged via the LSM tree at Jakub Kicinski request]	2024-05-17	not yet calculated	CVE-2023-52698 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling"). It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")). This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").	2024-05-14	not yet calculated	CVE-2024-27393 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcp_ao_connect_init Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of tcp_ao_connect_init, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.	2024-05-14	not yet calculated	CVE-2024-27394 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.	2024-05-14	not yet calculated	CVE-2024-27395 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.	2024-05-14	not yet calculated	CVE-2024-27396 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished. .lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue.	2024-05-14	not yet calculated	CVE-2024-27397 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread \| Worker Thread sco_sock_release \| sco_sock_close \| __sco_sock_close \| sco_sock_set_timer \| schedule_delayed_work \| sco_sock_kill \| (wait a time) sock_put(sk) //FREE \| sco_sock_timeout \| sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] ano ---truncated---	2024-05-14	not yet calculated	CVE-2024-27398 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below: [ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeo ---truncated---	2024-05-14	not yet calculated	CVE-2024-27399 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 This reverts drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap. The basic problem here is that after the move the old location is simply not available any more. Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well. Also rework the statistic handling so that we don't update the eviction counter before the move. v2: add missing NULL check	2024-05-14	not yet calculated	CVE-2024-27400 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows.	2024-05-14	not yet calculated	CVE-2024-27401 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fix racy skb_queue_empty() use The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skb_peek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer.	2024-05-17	not yet calculated	CVE-2024-27402 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow.	2024-05-17	not yet calculated	CVE-2024-27403 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data races on remote_id Similar to the previous patch, address the data race on remote_id, adding the suitable ONCE annotations.	2024-05-17	not yet calculated	CVE-2024-27404 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped. Adding a few custom traces showed the following: [002] d..1 7828.532866: dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI ==> 0 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list. Same is case with packets of size 2048: [002] d..1 7828.557948: dwc3_gadget_giveback: ep1out: req 0000000011dfd96e length 2049/16384 zsI ==> 0 [002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800 Lecroy shows one byte coming in extra confirming that the byte is coming in from PC: Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590) - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590) --- Packet 4063861 Data(1024 bytes) Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590) --- Packet 4063863 Data(1 byte) Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722) According to Windows driver, no ZLP is needed if wBlockLength is non-zero, because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there are in-market NCM devices that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the transfer is no longer multiple of wMaxPacketSize.	2024-05-17	not yet calculated	CVE-2024-27405 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU Trying to run the iov_iter unit test on a nommu system such as the qemu kc705-nommu emulation results in a crash. KTAP version 1 # Subtest: iov_iter # module: kunit_iov_iter 1..9 BUG: failure at mm/nommu.c:318/vmap()! Kernel panic - not syncing: BUG! The test calls vmap() directly, but vmap() is not supported on nommu systems, causing the crash. TEST_IOV_ITER therefore needs to depend on MMU.	2024-05-17	not yet calculated	CVE-2024-27406 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed overflow check in mi_enum_attr()	2024-05-17	not yet calculated	CVE-2024-27407 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the eDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred.	2024-05-17	not yet calculated	CVE-2024-27408 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the HDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred.	2024-05-17	not yet calculated	CVE-2024-27409 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode. This leads to an overwrite of data in the wdev->u union for the interface type it currently has, causing cfg80211_change_iface() to do wrong things when switching. We could probably allow setting an interface to mesh while setting the mesh ID at the same time by doing a different order of operations here, but realistically there's no userspace that's going to do this, so just disallow changes in iftype when setting mesh ID.	2024-05-17	not yet calculated	CVE-2024-27410 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: keep DMA buffers required for suspend/resume Nouveau deallocates a few buffers post GPU init which are required for GPU suspend/resume to function correctly. This is likely not as big an issue on systems where the NVGPU is the only GPU, but on multi-GPU set ups it leads to a regression where the kernel module errors and results in a system-wide rendering freeze. This commit addresses that regression by moving the two buffers required for suspend and resume to be deallocated at driver unload instead of post init.	2024-05-17	not yet calculated	CVE-2024-27411 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally calls free_irq(client->irq) leading to: [ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxx_battery_i2c_remove() mirroring probe() to fix this.	2024-05-17	not yet calculated	CVE-2024-27412 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 \| cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); \| ^ Use the correct type instead here.	2024-05-17	not yet calculated	CVE-2024-27413 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length"), an adjustment was made to the old loop logic in the function `rtnl_bridge_setlink` to enable the loop to also check the length of the IFLA_BRIDGE_MODE attribute. However, this adjustment removed the `break` statement and led to an error logic of the flags writing back at the end of this function. if (have_flags) memcpy(nla_data(attr), &flags, sizeof(flags)); // attr should point to IFLA_BRIDGE_FLAGS NLA !!! Before the mentioned commit, the `attr` is granted to be IFLA_BRIDGE_FLAGS. However, this is not necessarily true fow now as the updated loop will let the attr point to the last NLA, even an invalid NLA which could cause overflow writes. This patch introduces a new variable `br_flag` to save the NLA pointer that points to IFLA_BRIDGE_FLAGS and uses it to resolve the mentioned error logic.	2024-05-17	not yet calculated	CVE-2024-27414 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for multicast (broadcast) frames on bridges. Example: macvlan0 \| br0 / \ ethX ethY ethX (or Y) receives a L2 multicast or broadcast packet containing an IP packet, flow is not yet in conntrack table. 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting. -> skb->_nfct now references a unconfirmed entry 2. skb is broad/mcast packet. bridge now passes clones out on each bridge interface. 3. skb gets passed up the stack. 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb and schedules a work queue to send them out on the lower devices. The clone skb->_nfct is not a copy, it is the same entry as the original skb. The macvlan rx handler then returns RX_HANDLER_PASS. 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb. The Macvlan broadcast worker and normal confirm path will race. This race will not happen if step 2 already confirmed a clone. In that case later steps perform skb_clone() with skb->_nfct already confirmed (in hash table). This works fine. But such confirmation won't happen when eb/ip/nftables rules dropped the packets before they reached the nf_confirm step in postrouting. Pablo points out that nf_conntrack_bridge doesn't allow use of stateful nat, so we can safely discard the nf_conn entry and let inet call conntrack again. This doesn't work for bridge netfilter: skb could have a nat transformation. Also bridge nf prevents re-invocation of inet prerouting via 'sabotage_in' hook. Work around this problem by explicit confirmation of the entry at LOCAL_IN time, before upper layer has a chance to clone the unconfirmed entry. The downside is that this disables NAT and conntrack helpers. Alternative fix would be to add locking to all code parts that deal with unconfirmed packets, but even if that could be done in a sane way this opens up other problems, for example: -m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4 -m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5 For multicast case, only one of such conflicting mappings will be created, conntrack only handles 1:1 NAT mappings. Users should set create a setup that explicitly marks such traffic NOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass them, ruleset might have accept rules for untracked traffic already, so user-visible behaviour would change.	2024-05-17	not yet calculated	CVE-2024-27415 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support SSP since otherwise this event shouldn't be generated.	2024-05-17	not yet calculated	CVE-2024-27416 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount.	2024-05-17	not yet calculated	CVE-2024-27417 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: mctp: take ownership of skb in mctp_local_output Currently, mctp_local_output only takes ownership of skb on success, and we may leak an skb if mctp_local_output fails in specific states; the skb ownership isn't transferred until the actual output routing occurs. Instead, make mctp_local_output free the skb on all error paths up to the route action, so it always consumes the passed skb.	2024-05-17	not yet calculated	CVE-2024-27418 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix data-races around sysctl_net_busy_read We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27419 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_link_fails_count We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27420 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_routing_control We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27421 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27422 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27423 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_transport_busy_delay We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27424 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27425 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27426 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_transport_timeout We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27427 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27428 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser We need to protect the reader reading the sysctl value because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27429 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a data-race around sysctl_netrom_default_path_quality We need to protect the reader reading sysctl_netrom_default_path_quality because the value can be changed concurrently.	2024-05-17	not yet calculated	CVE-2024-27430 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.	2024-05-17	not yet calculated	CVE-2024-27431 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix PPE hanging issue A patch to resolve an issue was found in MediaTek's GPL-licensed SDK: In the mtk_ppe_stop() function, the PPE scan mode is not disabled before disabling the PPE. This can potentially lead to a hang during the process of disabling the PPE. Without this patch, the PPE may experience a hang during the reboot test.	2024-05-17	not yet calculated	CVE-2024-27432 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() 'clk_data' is allocated with mtk_devm_alloc_clk_data(). So calling mtk_free_clk_data() explicitly in the remove function would lead to a double-free. Remove the redundant call.	2024-05-17	not yet calculated	CVE-2024-27433 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash. in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP and MFP which is of course not possible.	2024-05-17	not yet calculated	CVE-2024-27434 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, admin_q reconnect failed forever while remote target and network is ok. After dig into it, we found it may caused by a ABBA deadlock due to tag allocation. In my case, the tag was hold by a keep alive request waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the request maked as idle and will not process before reset success. As fabric_q shares tagset with admin_q, while reconnect remote target, we need a tag for connect command, but the only one reserved tag was held by keep alive command which waiting inside admin_q. As a result, we failed to reconnect admin_q forever. In order to fix this issue, I think we should keep two reserved tags for admin queue.	2024-05-17	not yet calculated	CVE-2024-27435 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.	2024-05-17	not yet calculated	CVE-2024-27436 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock with fiemap and extent locking While working on the patchset to remove extent locking I got a lockdep splat with fiemap and pagefaulting with my new extent lock replacement lock. This deadlock exists with our normal code, we just don't have lockdep annotations with the extent locking so we've never noticed it. Since we're copying the fiemap extent to user space on every iteration we have the chance of pagefaulting. Because we hold the extent lock for the entire range we could mkwrite into a range in the file that we have mmap'ed. This would deadlock with the following stack trace [<0>] lock_extent+0x28d/0x2f0 [<0>] btrfs_page_mkwrite+0x273/0x8a0 [<0>] do_page_mkwrite+0x50/0xb0 [<0>] do_fault+0xc1/0x7b0 [<0>] __handle_mm_fault+0x2fa/0x460 [<0>] handle_mm_fault+0xa4/0x330 [<0>] do_user_addr_fault+0x1f4/0x800 [<0>] exc_page_fault+0x7c/0x1e0 [<0>] asm_exc_page_fault+0x26/0x30 [<0>] rep_movs_alternative+0x33/0x70 [<0>] _copy_to_user+0x49/0x70 [<0>] fiemap_fill_next_extent+0xc8/0x120 [<0>] emit_fiemap_extent+0x4d/0xa0 [<0>] extent_fiemap+0x7f8/0xad0 [<0>] btrfs_fiemap+0x49/0x80 [<0>] __x64_sys_ioctl+0x3e1/0xb50 [<0>] do_syscall_64+0x94/0x1a0 [<0>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 I wrote an fstest to reproduce this deadlock without my replacement lock and verified that the deadlock exists with our existing locking. To fix this simply don't take the extent lock for the entire duration of the fiemap. This is safe in general because we keep track of where we are when we're searching the tree, so if an ordered extent updates in the middle of our fiemap call we'll still emit the correct extents because we know what offset we were on before. The only place we maintain the lock is searching delalloc. Since the delalloc stuff can change during writeback we want to lock the extent range so we have a consistent view of delalloc at the time we're checking to see if we need to set the delalloc flag. With this patch applied we no longer deadlock with my testcase.	2024-05-17	not yet calculated	CVE-2024-35784 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix kernel panic caused by incorrect error handling The error path while failing to register devices on the TEE bus has a bug leading to kernel panic as follows: [ 15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c [ 15.406913] Mem abort info: [ 15.409722] ESR = 0x0000000096000005 [ 15.413490] EC = 0x25: DABT (current EL), IL = 32 bits [ 15.418814] SET = 0, FnV = 0 [ 15.421878] EA = 0, S1PTW = 0 [ 15.425031] FSC = 0x05: level 1 translation fault [ 15.429922] Data abort info: [ 15.432813] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 15.438310] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 15.443372] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000 [ 15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000 [ 15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") lead to the introduction of this bug. So fix it appropriately.	2024-05-17	not yet calculated	CVE-2024-35785 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf If VM_BIND is enabled on the client the legacy submission ioctl can't be used, however if a client tries to do so regardless it will return an error. In this case the clients mutex remained unlocked leading to a deadlock inside nouveau_drm_postclose or any other nouveau ioctl call.	2024-05-17	not yet calculated	CVE-2024-35786 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix incorrect usage for sb_index Commit d7038f951828 ("md-bitmap: don't use ->index for pages backing the bitmap file") removed page->index from bitmap code, but left wrong code logic for clustered-md. current code never set slot offset for cluster nodes, will sometimes cause crash in clustered env. Call trace (partly): md_bitmap_file_set_bit+0x110/0x1d8 [md_mod] md_bitmap_startwrite+0x13c/0x240 [md_mod] raid1_make_request+0x6b0/0x1c08 [raid1] md_handle_request+0x1dc/0x368 [md_mod] md_submit_bio+0x80/0xf8 [md_mod] __submit_bio+0x178/0x300 submit_bio_noacct_nocheck+0x11c/0x338 submit_bio_noacct+0x134/0x614 submit_bio+0x28/0xdc submit_bh_wbc+0x130/0x1cc submit_bh+0x1c/0x28	2024-05-17	not yet calculated	CVE-2024-35787 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix bounds check for dcn35 DcfClocks [Why] NumFclkLevelsEnabled is used for DcfClocks bounds check instead of designated NumDcfClkLevelsEnabled. That can cause array index out-of-bounds access. [How] Use designated variable for dcn35 DcfClocks bounds check.	2024-05-17	not yet calculated	CVE-2024-35788 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.	2024-05-17	not yet calculated	CVE-2024-35789 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group The DisplayPort driver's sysfs nodes may be present to the userspace before typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns NULL in those cases. Remove manual sysfs node creation in favor of adding attribute group as default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is not used here otherwise the path to the sysfs nodes is no longer compliant with the ABI.	2024-05-17	not yet calculated	CVE-2024-35790 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.	2024-05-17	not yet calculated	CVE-2024-35791 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - Fix use after free in unprepare The unprepare call must be carried out before the finalize call as the latter can free the request.	2024-05-17	not yet calculated	CVE-2024-35792 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: debugfs: fix wait/cancellation handling during remove Ben Greear further reports deadlocks during concurrent debugfs remove while files are being accessed, even though the code in question now uses debugfs cancellations. Turns out that despite all the review on the locking, we missed completely that the logic is wrong: if the refcount hits zero we can finish (and need not wait for the completion), but if it doesn't we have to trigger all the cancellations. As written, we can _never_ get into the loop triggering the cancellations. Fix this, and explain it better while at it.	2024-05-17	not yet calculated	CVE-2024-35793 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen sync_thread during suspend 1) commit f52f5c71f3d4 ("md: fix stopping sync thread") remove MD_RECOVERY_FROZEN from __md_stop_writes() and doesn't realize that dm-raid relies on __md_stop_writes() to frozen sync_thread indirectly. Fix this problem by adding MD_RECOVERY_FROZEN in md_stop_writes(), and since stop_sync_thread() is only used for dm-raid in this case, also move stop_sync_thread() to md_stop_writes(). 2) The flag MD_RECOVERY_FROZEN doesn't mean that sync thread is frozen, it only prevent new sync_thread to start, and it can't stop the running sync thread; In order to frozen sync_thread, after seting the flag, stop_sync_thread() should be used. 3) The flag MD_RECOVERY_FROZEN doesn't mean that writes are stopped, use it as condition for md_stop_writes() in raid_postsuspend() doesn't look correct. Consider that reentrant stop_sync_thread() do nothing, always call md_stop_writes() in raid_postsuspend(). 4) raid_message can set/clear the flag MD_RECOVERY_FROZEN at anytime, and if MD_RECOVERY_FROZEN is cleared while the array is suspended, new sync_thread can start unexpected. Fix this by disallow raid_message() to change sync_thread status during suspend. Note that after commit f52f5c71f3d4 ("md: fix stopping sync thread"), the test shell/lvconvert-raid-reshape.sh start to hang in stop_sync_thread(), and with previous fixes, the test won't hang there anymore, however, the test will still fail and complain that ext4 is corrupted. And with this patch, the test won't hang due to stop_sync_thread() or fail due to ext4 is corrupted anymore. However, there is still a deadlock related to dm-raid456 that will be fixed in following patches.	2024-05-17	not yet calculated	CVE-2024-35794 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix deadlock while reading mqd from debugfs An errant disk backup on my desktop got into debugfs and triggered the following deadlock scenario in the amdgpu debugfs files. The machine also hard-resets immediately after those lines are printed (although I wasn't able to reproduce that part when reading by hand): [ 1318.016074][ T1082] ====================================================== [ 1318.016607][ T1082] WARNING: possible circular locking dependency detected [ 1318.017107][ T1082] 6.8.0-rc7-00015-ge0c8221b72c0 #17 Not tainted [ 1318.017598][ T1082] ------------------------------------------------------ [ 1318.018096][ T1082] tar/1082 is trying to acquire lock: [ 1318.018585][ T1082] ffff98c44175d6a0 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x40/0x80 [ 1318.019084][ T1082] [ 1318.019084][ T1082] but task is already holding lock: [ 1318.020052][ T1082] ffff98c4c13f55f8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: amdgpu_debugfs_mqd_read+0x6a/0x250 [amdgpu] [ 1318.020607][ T1082] [ 1318.020607][ T1082] which lock already depends on the new lock. [ 1318.020607][ T1082] [ 1318.022081][ T1082] [ 1318.022081][ T1082] the existing dependency chain (in reverse order) is: [ 1318.023083][ T1082] [ 1318.023083][ T1082] -> #2 (reservation_ww_class_mutex){+.+.}-{3:3}: [ 1318.024114][ T1082] __ww_mutex_lock.constprop.0+0xe0/0x12f0 [ 1318.024639][ T1082] ww_mutex_lock+0x32/0x90 [ 1318.025161][ T1082] dma_resv_lockdep+0x18a/0x330 [ 1318.025683][ T1082] do_one_initcall+0x6a/0x350 [ 1318.026210][ T1082] kernel_init_freeable+0x1a3/0x310 [ 1318.026728][ T1082] kernel_init+0x15/0x1a0 [ 1318.027242][ T1082] ret_from_fork+0x2c/0x40 [ 1318.027759][ T1082] ret_from_fork_asm+0x11/0x20 [ 1318.028281][ T1082] [ 1318.028281][ T1082] -> #1 (reservation_ww_class_acquire){+.+.}-{0:0}: [ 1318.029297][ T1082] dma_resv_lockdep+0x16c/0x330 [ 1318.029790][ T1082] do_one_initcall+0x6a/0x350 [ 1318.030263][ T1082] kernel_init_freeable+0x1a3/0x310 [ 1318.030722][ T1082] kernel_init+0x15/0x1a0 [ 1318.031168][ T1082] ret_from_fork+0x2c/0x40 [ 1318.031598][ T1082] ret_from_fork_asm+0x11/0x20 [ 1318.032011][ T1082] [ 1318.032011][ T1082] -> #0 (&mm->mmap_lock){++++}-{3:3}: [ 1318.032778][ T1082] __lock_acquire+0x14bf/0x2680 [ 1318.033141][ T1082] lock_acquire+0xcd/0x2c0 [ 1318.033487][ T1082] __might_fault+0x58/0x80 [ 1318.033814][ T1082] amdgpu_debugfs_mqd_read+0x103/0x250 [amdgpu] [ 1318.034181][ T1082] full_proxy_read+0x55/0x80 [ 1318.034487][ T1082] vfs_read+0xa7/0x360 [ 1318.034788][ T1082] ksys_read+0x70/0xf0 [ 1318.035085][ T1082] do_syscall_64+0x94/0x180 [ 1318.035375][ T1082] entry_SYSCALL_64_after_hwframe+0x46/0x4e [ 1318.035664][ T1082] [ 1318.035664][ T1082] other info that might help us debug this: [ 1318.035664][ T1082] [ 1318.036487][ T1082] Chain exists of: [ 1318.036487][ T1082] &mm->mmap_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex [ 1318.036487][ T1082] [ 1318.037310][ T1082] Possible unsafe locking scenario: [ 1318.037310][ T1082] [ 1318.037838][ T1082] CPU0 CPU1 [ 1318.038101][ T1082] ---- ---- [ 1318.038350][ T1082] lock(reservation_ww_class_mutex); [ 1318.038590][ T1082] lock(reservation_ww_class_acquire); [ 1318.038839][ T1082] lock(reservation_ww_class_mutex); [ 1318.039083][ T1082] rlock(&mm->mmap_lock); [ 1318.039328][ T1082] [ 1318.039328][ T1082] * DEADLOCK * [ 1318.039328][ T1082] [ 1318.040029][ T1082] 1 lock held by tar/1082: [ 1318.040259][ T1082] #0: ffff98c4c13f55f8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: amdgpu_debugfs_mqd_read+0x6a/0x250 [amdgpu] [ 1318.040560][ T1082] [ 1318.040560][ T1082] stack backtrace: [ ---truncated---	2024-05-17	not yet calculated	CVE-2024-35795 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in platform_get_resource_byname in the call stack, where it causes a null pointer in strcmp. if (type == resource_type(r) && !strcmp(r->name, name)) It should have been replaced with devm_platform_ioremap_resource.	2024-05-17	not yet calculated	CVE-2024-35796 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count. Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case. Bail on get_shadow_from_swap_cache() returning NULL.	2024-05-17	not yet calculated	CVE-2024-35797 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race in read_extent_buffer_pages() There are reports from tree-checker that detects corrupted nodes, without any obvious pattern so possibly an overwrite in memory. After some debugging it turns out there's a race when reading an extent buffer the uptodate status can be missed. To prevent concurrent reads for the same extent buffer, read_extent_buffer_pages() performs these checks: /* (1) / if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags)) return 0; / (2) / if (test_and_set_bit(EXTENT_BUFFER_READING, &eb->bflags)) goto done; At this point, it seems safe to start the actual read operation. Once that completes, end_bbio_meta_read() does / (3) / set_extent_buffer_uptodate(eb); / (4) */ clear_bit(EXTENT_BUFFER_READING, &eb->bflags); Normally, this is enough to ensure only one read happens, and all other callers wait for it to finish before returning. Unfortunately, there is a racey interleaving: Thread A \| Thread B \| Thread C ---------+----------+--------- (1) \| \| \| (1) \| (2) \| \| (3) \| \| (4) \| \| \| (2) \| \| \| (1) When this happens, thread B kicks of an unnecessary read. Worse, thread C will see UPTODATE set and return immediately, while the read from thread B is still in progress. This race could result in tree-checker errors like this as the extent buffer is concurrently modified: BTRFS critical (device dm-0): corrupted node, root=256 block=8550954455682405139 owner mismatch, have 11858205567642294356 expect [256, 18446744073709551360] Fix it by testing UPTODATE again after setting the READING bit, and if it's been set, skip the unnecessary read. [ minor update of changelog ]	2024-05-17	not yet calculated	CVE-2024-35798 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent crash when disable stream [Why] Disabling stream encoder invokes a function that no longer exists. [How] Check if the function declaration is NULL in disable stream encoder.	2024-05-17	not yet calculated	CVE-2024-35799 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel Check if get_next_variable() is actually valid pointer before calling it. In kdump kernel this method is set to NULL that causes panic during the kexec-ed kernel boot. Tested with QEMU and OVMF firmware.	2024-05-17	not yet calculated	CVE-2024-35800 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD.	2024-05-17	not yet calculated	CVE-2024-35801 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: x86/sev: Fix position dependent variable references in startup code The early startup code executes from a 1:1 mapping of memory, which differs from the mapping that the code was linked and/or relocated to run at. The latter mapping is not active yet at this point, and so symbol references that rely on it will fault. Given that the core kernel is built without -fPIC, symbol references are typically emitted as absolute, and so any such references occuring in the early startup code will therefore crash the kernel. While an attempt was made to work around this for the early SEV/SME startup code, by forcing RIP-relative addressing for certain global SEV/SME variables via inline assembly (see snp_cpuid_get_table() for example), RIP-relative addressing must be pervasively enforced for SEV/SME global variables when accessed prior to page table fixups. __startup_64() already handles this issue for select non-SEV/SME global variables using fixup_pointer(), which adjusts the pointer relative to a `physaddr` argument. To avoid having to pass around this `physaddr` argument across all functions needing to apply pointer fixups, introduce a macro RIP_RELATIVE_REF() which generates a RIP-relative reference to a given global variable. It is used where necessary to force RIP-relative accesses to global variables. For backporting purposes, this patch makes no attempt at cleaning up other occurrences of this pattern, involving either inline asm or fixup_pointer(). Those will be addressed later. [ bp: Call it "rip_rel_ref" everywhere like other code shortens "rIP-relative reference" and make the asm wrapper __always_inline. ]	2024-05-17	not yet calculated	CVE-2024-35802 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Call mixed mode boot services on the firmware's stack Normally, the EFI stub calls into the EFI boot services using the stack that was live when the stub was entered. According to the UEFI spec, this stack needs to be at least 128k in size - this might seem large but all asynchronous processing and event handling in EFI runs from the same stack and so quite a lot of space may be used in practice. In mixed mode, the situation is a bit different: the bootloader calls the 32-bit EFI stub entry point, which calls the decompressor's 32-bit entry point, where the boot stack is set up, using a fixed allocation of 16k. This stack is still in use when the EFI stub is started in 64-bit mode, and so all calls back into the EFI firmware will be using the decompressor's limited boot stack. Due to the placement of the boot stack right after the boot heap, any stack overruns have gone unnoticed. However, commit 5c4feadb0011983b ("x86/decompressor: Move global symbol references to C code") moved the definition of the boot heap into C code, and now the boot stack is placed right at the base of BSS, where any overruns will corrupt the end of the .data section. While it would be possible to work around this by increasing the size of the boot stack, doing so would affect all x86 systems, and mixed mode systems are a tiny (and shrinking) fraction of the x86 installed base. So instead, record the firmware stack pointer value when entering from the 32-bit firmware, and switch to this stack every time a EFI boot service call is made.	2024-05-17	not yet calculated	CVE-2024-35803 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM effectively corrupts guest memory during live migration by writing to guest memory without informing userspace that the page is dirty. Marking the page dirty got unintentionally dropped when KVM's emulated CMPXCHG was converted to do a user access. Before that, KVM explicitly mapped the guest page into kernel memory, and marked the page dirty during the unmap phase. Mark the page dirty even if the CMPXCHG fails, as the old data is written back on failure, i.e. the page is still written. The value written is guaranteed to be the same because the operation is atomic, but KVM's ABI is that all writes are dirty logged regardless of the value written. And more importantly, that's what KVM did before the buggy commit. Huge kudos to the folks on the Cc list (and many others), who did all the actual work of triaging and debugging. base-commit: 6769ea8da8a93ed4630f1ce64df6aafcaabfce64	2024-05-17	not yet calculated	CVE-2024-35804 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: dm snapshot: fix lockup in dm_exception_table_exit There was reported lockup when we exit a snapshot with many exceptions. Fix this by adding "cond_resched" to the loop that frees the exceptions.	2024-05-17	not yet calculated	CVE-2024-35805 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgr_lock smp_call_function_single disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. This is already done by qman_update_cgr and qman_delete_cgr; fix the other lockers.	2024-05-17	not yet calculated	CVE-2024-35806 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/ # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 221 - 215)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2221 - 42*15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((22*21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^152^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not.	2024-05-17	not yet calculated	CVE-2024-35807 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_mutex', this is definitely unsafe because md_reap_sync_thread() can change many fields that is protected by 'reconfig_mutex'. However, hold 'reconfig_mutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Fix this problem by using stop_sync_thread() to unregister sync_thread, like md/raid did.	2024-05-17	not yet calculated	CVE-2024-35808 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash due to an unhandled page fault [1]. The problem is that rtsx_pci_runtime_idle() is not expected to be running after pm_runtime_get_sync() has been called, but the latter doesn't really guarantee that. It only guarantees that the suspend and resume callbacks will not be running when it returns. However, if a .runtime_idle() callback is already running when pm_runtime_get_sync() is called, the latter will notice that the runtime PM status of the device is RPM_ACTIVE and it will return right away without waiting for the former to complete. In fact, it cannot wait for .runtime_idle() to complete because it may be called from that callback (it arguably does not make much sense to do that, but it is not strictly prohibited). Thus in general, whoever is providing a .runtime_idle() callback needs to protect it from running in parallel with whatever code runs after pm_runtime_get_sync(). [Note that .runtime_idle() will not start after pm_runtime_get_sync() has returned, but it may continue running then if it has started earlier.] One way to address that race condition is to call pm_runtime_barrier() after pm_runtime_get_sync() (not before it, because a nonzero value of the runtime PM usage counter is necessary to prevent runtime PM callbacks from being invoked) to wait for the .runtime_idle() callback to complete should it be running at that point. A suitable place for doing that is in pci_device_remove() which calls pm_runtime_get_sync() before removing the driver, so it may as well call pm_runtime_barrier() subsequently, which will prevent the race in question from occurring, not just in the rtsx_pcr driver, but in any PCI drivers providing .runtime_idle() callbacks.	2024-05-17	not yet calculated	CVE-2024-35809 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix the lifetime of the bo cursor memory The cleanup can be dispatched while the atomic update is still active, which means that the memory acquired in the atomic update needs to not be invalidated by the cleanup. The buffer objects in vmw_plane_state instead of using the builtin map_and_cache were trying to handle the lifetime of the mapped memory themselves, leading to crashes. Use the map_and_cache instead of trying to manage the lifetime of the buffer objects held by the vmw_plane_state. Fixes kernel oops'es in IGT's kms_cursor_legacy forked-bo.	2024-05-17	not yet calculated	CVE-2024-35810 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]	2024-05-17	not yet calculated	CVE-2024-35811 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: usb: cdc-wdm: close race between read and workqueue wdm_read() cannot race with itself. However, in service_outstanding_interrupt() it can race with the workqueue, which can be triggered by error handling. Hence we need to make sure that the WDM_RESPONDING flag is not just only set but tested.	2024-05-17	not yet calculated	CVE-2024-35812 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid negative index with array access Commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu") assigns prev_idata = idatas[i - 1], but doesn't check that the iterator i is greater than zero. Let's fix this by adding a check.	2024-05-17	not yet calculated	CVE-2024-35813 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bouncing via a restricted DMA SWIOTLB pool. When virtio allocates the virtqueues for the vsock device using dma_alloc_coherent(), the SWIOTLB search can return page-unaligned allocations if 'area->index' was left unaligned by a previous allocation from the buffer: # Final address in brackets is the SWIOTLB address returned to the caller \| virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800) \| virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800) \| virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800) This ends badly (typically buffer corruption and/or a hang) because swiotlb_alloc() is expecting a page-aligned allocation and so blindly returns a pointer to the 'struct page' corresponding to the allocation, therefore double-allocating the first half (2KiB slot) of the 4KiB page. Fix the problem by treating the allocation alignment separately to any additional alignment requirements from the device, using the maximum of the two as the stride to search the buffer slots and taking care to ensure a minimum of page-alignment for buffers larger than a page. This also resolves swiotlb allocation failures occuring due to the inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and resulting in alignment requirements exceeding swiotlb_max_mapping_size().	2024-05-17	not yet calculated	CVE-2024-35814 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the current code, depending on the compiler, the req->ki_ctx read happens either before the IOCB_AIO_RW test or after that test. Move the req->ki_ctx read such that it is guaranteed that the IOCB_AIO_RW test happens first.	2024-05-17	not yet calculated	CVE-2024-35815 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: prevent leak of left-over IRQ on unbind Commit 5a95f1ded28691e6 ("firewire: ohci: use devres for requested IRQ") also removed the call to free_irq() in pci_remove(), leading to a leftover irq of devm_request_irq() at pci_disable_msi() in pci_remove() when unbinding the driver from the device remove_proc_entry: removing non-empty directory 'irq/136', leaking at least 'firewire_ohci' Call Trace: ? remove_proc_entry+0x19c/0x1c0 ? __warn+0x81/0x130 ? remove_proc_entry+0x19c/0x1c0 ? report_bug+0x171/0x1a0 ? console_unlock+0x78/0x120 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? remove_proc_entry+0x19c/0x1c0 unregister_irq_proc+0xf4/0x120 free_desc+0x3d/0xe0 ? kfree+0x29f/0x2f0 irq_free_descs+0x47/0x70 msi_domain_free_locked.part.0+0x19d/0x1d0 msi_domain_free_irqs_all_locked+0x81/0xc0 pci_free_msi_irqs+0x12/0x40 pci_disable_msi+0x4c/0x60 pci_remove+0x9d/0xc0 [firewire_ohci 01b483699bebf9cb07a3d69df0aa2bee71db1b26] pci_device_remove+0x37/0xa0 device_release_driver_internal+0x19f/0x200 unbind_store+0xa1/0xb0 remove irq with devm_free_irq() before pci_disable_msi() also remove it in fail_msi: of pci_probe() as this would lead to an identical leak	2024-05-17	not yet calculated	CVE-2024-35816 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgpu_ttm_backend_unbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue.	2024-05-17	not yet calculated	CVE-2024-35817 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: LoongArch: Define the __io_aw() hook as mmiowb() Commit fb24ea52f78e0d595852e ("drivers: Remove explicit invocations of mmiowb()") remove all mmiowb() in drivers, but it says: "NOTE: mmiowb() has only ever guaranteed ordering in conjunction with spin_unlock(). However, pairing each mmiowb() removal in this patch with the corresponding call to spin_unlock() is not at all trivial, so there is a small chance that this change may regress any drivers incorrectly relying on mmiowb() to order MMIO writes between CPUs using lock-free synchronisation." The mmio in radeon_ring_commit() is protected by a mutex rather than a spinlock, but in the mutex fastpath it behaves similar to spinlock. We can add mmiowb() calls in the radeon driver but the maintainer says he doesn't like such a workaround, and radeon is not the only example of mutex protected mmio. So we should extend the mmiowb tracking system from spinlock to mutex, and maybe other locking primitives. This is not easy and error prone, so we solve it in the architectural code, by simply defining the __io_aw() hook as mmiowb(). And we no longer need to override queued_spin_unlock() so use the generic definition. Without this, we get such an error when run 'glxgears' on weak ordering architectures such as LoongArch: radeon 0000:04:00.0: ring 0 stalled for more than 10324msec radeon 0000:04:00.0: ring 3 stalled for more than 10240msec radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000001f412 last fence id 0x000000000001f414 on ring 3) radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000000f940 last fence id 0x000000000000f941 on ring 0) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] ERROR Couldn't update BO_VA (-35)	2024-05-17	not yet calculated	CVE-2024-35818 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlock for cgr_lock smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down.	2024-05-17	not yet calculated	CVE-2024-35819 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_queue_proc modifying req->flags With multiple poll entries __io_queue_proc() might be running in parallel with poll handlers and possibly task_work, we should not be carelessly modifying req->flags there. io_poll_double_prepare() handles a similar case with locking but it's much easier to move it into __io_arm_poll_handler().	2024-05-17	not yet calculated	CVE-2024-35820 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(), which is after we copied the new data into the page.	2024-05-17	not yet calculated	CVE-2024-35821 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug().	2024-05-17	not yet calculated	CVE-2024-35822 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers.	2024-05-17	not yet calculated	CVE-2024-35823 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume When not configured for wakeup lis3lv02d_i2c_suspend() will call lis3lv02d_poweroff() even if the device has already been turned off by the runtime-suspend handler and if configured for wakeup and the device is runtime-suspended at this point then it is not turned back on to serve as a wakeup source. Before commit b1b9f7a49440 ("misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback"), lis3lv02d_poweroff() failed to disable the regulators which as a side effect made calling poweroff() twice ok. Now that poweroff() correctly disables the regulators, doing this twice triggers a WARN() in the regulator core: unbalanced disables for regulator-dummy WARNING: CPU: 1 PID: 92 at drivers/regulator/core.c:2999 _regulator_disable ... Fix lis3lv02d_i2c_suspend() to not call poweroff() a second time if already runtime-suspended and add a poweron() call when necessary to make wakeup work. lis3lv02d_i2c_resume() has similar issues, with an added weirness that it always powers on the device if it is runtime suspended, after which the first runtime-resume will call poweron() again, causing the enabled count for the regulator to increase by 1 every suspend/resume. These unbalanced regulator_enable() calls cause the regulator to never be turned off and trigger the following WARN() on driver unbind: WARNING: CPU: 1 PID: 1724 at drivers/regulator/core.c:2396 _regulator_put Fix this by making lis3lv02d_i2c_resume() mirror the new suspend().	2024-05-17	not yet calculated	CVE-2024-35824 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid datagrams present. According to the NCM spec: "If wBlockLength = 0x0000, the block is terminated by a short packet. In this case, the USB transfer must still be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent, and the size is a multiple of wMaxPacketSize for the given pipe, then no ZLP shall be sent. wBlockLength= 0x0000 must be used with extreme care, because of the possibility that the host and device may get out of sync, and because of test issues. wBlockLength = 0x0000 allows the sender to reduce latency by starting to send a very large NTB, and then shortening it when the sender discovers that there's not sufficient data to justify sending a large NTB" However, there is a potential issue with the current implementation, as it checks for the occurrence of multiple NTBs in a single giveback by verifying if the leftover bytes to be processed is zero or not. If the block length reads zero, we would process the same NTB infintely because the leftover bytes is never zero and it leads to a crash. Fix this by bailing out if block length reads zero.	2024-05-17	not yet calculated	CVE-2024-35825 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages() Fix an incorrect number of pages being released for buffers that do not start at the beginning of a page.	2024-05-17	not yet calculated	CVE-2024-35826 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values can fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but the cast is unnecessary.	2024-05-17	not yet calculated	CVE-2024-35827 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().	2024-05-17	not yet calculated	CVE-2024-35828 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks.	2024-05-17	not yet calculated	CVE-2024-35829 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access.	2024-05-17	not yet calculated	CVE-2024-35830 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix release of pinned pages when __io_uaddr_map fails Looking at the error path of __io_uaddr_map, if we fail after pinning the pages for any reasons, ret will be set to -EINVAL and the error handler won't properly release the pinned pages. I didn't manage to trigger it without forcing a failure, but it can happen in real life when memory is heavily fragmented.	2024-05-17	not yet calculated	CVE-2024-35831 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exit bch_fs::snapshots is allocated by kvzalloc in __snapshot_t_mut. It should be freed by kvfree not kfree. Or umount will triger: [ 406.829178 ] BUG: unable to handle page fault for address: ffffe7b487148008 [ 406.830676 ] #PF: supervisor read access in kernel mode [ 406.831643 ] #PF: error_code(0x0000) - not-present page [ 406.832487 ] PGD 0 P4D 0 [ 406.832898 ] Oops: 0000 [#1] PREEMPT SMP PTI [ 406.833512 ] CPU: 2 PID: 1754 Comm: umount Kdump: loaded Tainted: G OE 6.7.0-rc7-custom+ #90 [ 406.834746 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 [ 406.835796 ] RIP: 0010:kfree+0x62/0x140 [ 406.836197 ] Code: 80 48 01 d8 0f 82 e9 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 78 9f 1f 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 56 9f 1f 01 <48> 8b 50 08 48 89 c7 f6 c2 01 0f 85 b0 00 00 00 66 90 48 8b 07 f6 [ 406.837810 ] RSP: 0018:ffffb9d641607e48 EFLAGS: 00010286 [ 406.838213 ] RAX: ffffe7b487148000 RBX: ffffb9d645200000 RCX: ffffb9d641607dc4 [ 406.838738 ] RDX: 000065bb00000000 RSI: ffffffffc0d88b84 RDI: ffffb9d645200000 [ 406.839217 ] RBP: ffff9a4625d00068 R08: 0000000000000001 R09: 0000000000000001 [ 406.839650 ] R10: 0000000000000001 R11: 000000000000001f R12: ffff9a4625d4da80 [ 406.840055 ] R13: ffff9a4625d00000 R14: ffffffffc0e2eb20 R15: 0000000000000000 [ 406.840451 ] FS: 00007f0a264ffb80(0000) GS:ffff9a4e2d500000(0000) knlGS:0000000000000000 [ 406.840851 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 406.841125 ] CR2: ffffe7b487148008 CR3: 000000018c4d2000 CR4: 00000000000006f0 [ 406.841464 ] Call Trace: [ 406.841583 ] [ 406.841682 ] ? __die+0x1f/0x70 [ 406.841828 ] ? page_fault_oops+0x159/0x470 [ 406.842014 ] ? fixup_exception+0x22/0x310 [ 406.842198 ] ? exc_page_fault+0x1ed/0x200 [ 406.842382 ] ? asm_exc_page_fault+0x22/0x30 [ 406.842574 ] ? bch2_fs_release+0x54/0x280 [bcachefs] [ 406.842842 ] ? kfree+0x62/0x140 [ 406.842988 ] ? kfree+0x104/0x140 [ 406.843138 ] bch2_fs_release+0x54/0x280 [bcachefs] [ 406.843390 ] kobject_put+0xb7/0x170 [ 406.843552 ] deactivate_locked_super+0x2f/0xa0 [ 406.843756 ] cleanup_mnt+0xba/0x150 [ 406.843917 ] task_work_run+0x59/0xa0 [ 406.844083 ] exit_to_user_mode_prepare+0x197/0x1a0 [ 406.844302 ] syscall_exit_to_user_mode+0x16/0x40 [ 406.844510 ] do_syscall_64+0x4e/0xf0 [ 406.844675 ] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 406.844907 ] RIP: 0033:0x7f0a2664e4fb	2024-05-17	not yet calculated	CVE-2024-35832 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA This dma_alloc_coherent() is undone neither in the remove function, nor in the error handling path of fsl_qdma_probe(). Switch to the managed version to fix both issues.	2024-05-17	not yet calculated	CVE-2024-35833 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: xsk: recycle buffer in case Rx queue was full Add missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce descriptor to XSK Rx queue.	2024-05-17	not yet calculated	CVE-2024-35834 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again.	2024-05-17	not yet calculated	CVE-2024-35835 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: dpll: fix pin dump crash for rebound module When a kernel module is unbound but the pin resources were not entirely freed (other kernel module instance of the same PCI device have had kept the reference to that pin), and kernel module is again bound, the pin properties would not be updated (the properties are only assigned when memory for the pin is allocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbind. If the pin dump is invoked in this state, the result is a kernel crash. Prevent the crash by storing persistent pin properties in dpll subsystem, copy the content from the kernel module when pin is allocated, instead of using memory of the kernel module.	2024-05-17	not yet calculated	CVE-2024-35836 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue.	2024-05-17	not yet calculated	CVE-2024-35837 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential sta-link leak When a station is allocated, links are added but not set to valid yet (e.g. during connection to an AP MLD), we might remove the station without ever marking links valid, and leak them. Fix that.	2024-05-17	not yet calculated	CVE-2024-35838 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added to a neigh->arp_queue while waiting for an arp reply. Where original skb's skb->dev can be different to neigh's neigh->dev. For instance in case of bridging dnated skb from one veth to another, the skb would be added to a neigh->arp_queue of the bridge. As skb->dev can be reset back to nf_bridge->physindev and used, and as there is no explicit mechanism that prevents this physindev from been freed under us (for instance neigh_flush_dev doesn't cleanup skbs from different device's neigh queue) we can crash on e.g. this stack: arp_process neigh_update skb = __skb_dequeue(&neigh->arp_queue) neigh_resolve_output(..., skb) ... br_nf_dev_xmit br_nf_pre_routing_finish_bridge_slow skb->dev = nf_bridge->physindev br_handle_frame_finish Let's use plain ifindex instead of net_device link. To peek into the original net_device we will use dev_get_by_index_rcu(). Thus either we get device and are safe to use it or we don't get it and drop skb.	2024-05-17	not yet calculated	CVE-2024-35839 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() subflow_finish_connect() uses four fields (backup, join_id, thmac, none) that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set in mptcp_parse_option()	2024-05-17	not yet calculated	CVE-2024-35840 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in __sk_msg_free A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user provided pages from the msg into the msg_pl. This will loop over the msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user can also set the MORE flag to hint stack to delay sending until receiving more pages and ideally a full buffer. If the user adds more pages to the msg than can fit in the msg_pl scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send the buffer anyways. What actually happens though is we abort the msg to msg_pl scatterlist setup and then because we forget to set 'full record' indicating we can no longer consume data without a send we fallthrough to the 'continue' path which will check if msg_data_left(msg) has more bytes to send and then attempts to fit them in the already full msg_pl. Then next iteration of sender doing send will encounter a full msg_pl and throw the warning in the syzbot report. To fix simply check if we have a full_record in splice code path and if not send the msg regardless of MORE flag.	2024-05-17	not yet calculated	CVE-2024-35841 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: sof-common: Add NULL check for normal_link string It's not granted that all entries of struct sof_conn_stream declare a `normal_link` (a non-SOF, direct link) string, and this is the case for SoCs that support only SOF paths (hence do not support both direct and SOF usecases). For example, in the case of MT8188 there is no normal_link string in any of the sof_conn_stream entries and there will be more drivers doing that in the future. To avoid possible NULL pointer KPs, add a NULL check for `normal_link`.	2024-05-17	not yet calculated	CVE-2024-35842 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with device_rbtree_find() to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after device_rbtree_find() and before iopf_get_dev_fault_param(), which would cause a use-after-free problem. Add a mutex to synchronize the I/O page fault reporting path and the IOMMU release device path. This lock doesn't introduce any performance overhead, as the conflict between I/O page fault reporting and device releasing is very rare.	2024-05-17	not yet calculated	CVE-2024-35843 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix reserve_cblocks counting error when out of space When a file only needs one direct_node, performing the following operations will cause the file to be unrepairable: unisoc # ./f2fs_io compress test.apk unisoc #df -h \| grep dm-48 /dev/block/dm-48 112G 112G 1.2M 100% /data unisoc # ./f2fs_io release_cblocks test.apk 924 unisoc # df -h \| grep dm-48 /dev/block/dm-48 112G 112G 4.8M 100% /data unisoc # dd if=/dev/random of=file4 bs=1M count=3 3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s unisoc # df -h \| grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot unisoc # df -h \| grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 0 This is because the file has only one direct_node. After returning to -ENOSPC, reserved_blocks += ret will not be executed. As a result, the reserved_blocks at this time is still 0, which is not the real number of reserved blocks. Therefore, fsck cannot be set to repair the file. After this patch, the fsck flag will be set to fix this problem. unisoc # df -h \| grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot then fsck will be executed unisoc # df -h \| grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 924	2024-05-17	not yet calculated	CVE-2024-35844 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.	2024-05-17	not yet calculated	CVE-2024-35845 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroup_disable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs [1] and the Red Hat bugzilla [2]. The problem is that when memcg is disabled with the boot time flag, the zswap shrinker might get called with sc->memcg == NULL. This is okay in many places, like the lruvec operations. But it crashes in memcg_page_state() - which is only used due to the non-node accounting of cgroup's the zswap memory to begin with. Nhat spotted that the memcg can be NULL in the memcg-disabled case, and I was then able to reproduce the crash locally as well. [1] https://github.com/libguestfs/libguestfs/issues/139 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2275252	2024-05-17	not yet calculated	CVE-2024-35846 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ]	2024-05-17	not yet calculated	CVE-2024-35847 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device.	2024-05-17	not yet calculated	CVE-2024-35848 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000 This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory. Fix this by using kvzalloc() which zeroes out the memory on allocation.	2024-05-17	not yet calculated	CVE-2024-35849 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev setup Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when setup() is called for a non-serdev controller.	2024-05-17	not yet calculated	CVE-2024-35850 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev suspend Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when wakeup() is called for a non-serdev controller during suspend. Just return true for now to restore the original behaviour and address the crash with pre-6.2 kernels, which do not have commit e9b3e5b8c657 ("Bluetooth: hci_qca: only assign wakeup with serial port support") that causes the crash to happen already at setup() time.	2024-05-17	not yet calculated	CVE-2024-35851 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately. After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled. The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle. Fix by freeing the hints if hints are associated with a work that was canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hints is fragile. [1] unreferenced object 0xffff88810e7c3000 (size 256): comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... backtrace (crc 2544ddb9): [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/0xf20 [<00000000ceee9e81>] worker_thread+0x799/0x12c0 [<00000000bda6fe39>] kthread+0x246/0x300 [<0000000070056d23>] ret_from_fork+0x34/0x70 [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30	2024-05-17	not yet calculated	CVE-2024-35852 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. If the migration fails, the code tries to migrate the filters back to the old region. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides the fact that this ping pong is not a very good idea, it also creates a problem. Each virtual chunk references two chunks: The currently used one ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the first holds the chunk we want to migrate filters to and the second holds the chunk we are migrating filters from. The code currently assumes - but does not verify - that the backup chunk does not exist (NULL) if the currently used chunk does not reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backup chunk being overwritten and leaked [1]. Fix by not rolling back a failed rollback and add a warning to avoid future cases. [1] WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 Modules linked in: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] Call Trace: mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30	2024-05-17	not yet calculated	CVE-2024-35853 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration. The destruction of a region that still has filters referencing it can result in a use-after-free [1]. Fix by not destroying the region if migration failed. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30	2024-05-17	not yet calculated	CVE-2024-35854 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device. As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1]. Fix by closing the race and perform the activity query under the 'vregion->lock' mutex. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181 CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30	2024-05-17	not yet calculated	CVE-2024-35855 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Fix double free of skb in coredump hci_devcd_append() would free the skb on error so the caller don't have to free it again otherwise it would cause the double free of skb. Reported-by : Dan Carpenter	2024-05-17	not yet calculated	CVE-2024-35856 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) Second problem is a read from dev->ip6_ptr with no NULL check: if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) Use the correct RCU API to fix these. v2: add missing include	2024-05-17	not yet calculated	CVE-2024-35857 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix memory leak when bringing down interface When bringing down the TX rings we flush the rings but forget to reclaimed the flushed packets. This leads to a memory leak since we do not free the dma mapped buffers. This also leads to tx control block corruption when bringing down the interface for power management.	2024-05-17	not yet calculated	CVE-2024-35858 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux--Linux	In the Linux kernel, the following vulnerability has been resolved: block: fix module reference leakage from bdev_open_by_dev error path At the time bdev_may_open() is called, module reference is grabbed already, hence module reference should be released if bdev_may_open() failed. This problem is found by code review.	2024-05-17	not yet calculated	CVE-2024-35859 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mozilla--Firefox	A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.	2024-05-14	not yet calculated	CVE-2024-4367 security@mozilla.org security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4764 security@mozilla.org security@mozilla.org
Mozilla--Firefox	Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. This issue only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4765 security@mozilla.org security@mozilla.org
Mozilla--Firefox	Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have lead to potential user confusion and spoofing attacks. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4766 security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.	2024-05-14	not yet calculated	CVE-2024-4767 security@mozilla.org security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.	2024-05-14	not yet calculated	CVE-2024-4768 security@mozilla.org security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.	2024-05-14	not yet calculated	CVE-2024-4769 security@mozilla.org security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.	2024-05-14	not yet calculated	CVE-2024-4770 security@mozilla.org security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4771 security@mozilla.org security@mozilla.org
Mozilla--Firefox	An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4772 security@mozilla.org security@mozilla.org
Mozilla--Firefox	When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a spoofed web site. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4773 security@mozilla.org security@mozilla.org
Mozilla--Firefox	The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4774 security@mozilla.org security@mozilla.org
Mozilla--Firefox	An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4775 security@mozilla.org security@mozilla.org
Mozilla--Firefox	A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4776 security@mozilla.org security@mozilla.org
Mozilla--Firefox	Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.	2024-05-14	not yet calculated	CVE-2024-4777 security@mozilla.org security@mozilla.org security@mozilla.org security@mozilla.org
Mozilla--Firefox	Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126.	2024-05-14	not yet calculated	CVE-2024-4778 security@mozilla.org security@mozilla.org
Mozilla--Focus for iOS	The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affects Focus for iOS < 126.	2024-05-17	not yet calculated	CVE-2024-5022 security@mozilla.org security@mozilla.org
NEC Platforms, Ltd--ITK-6DGS-1(BK) TEL	NEC Platforms DT900 and DT900S Series 5.0.0.0 - v5.3.4.4, v5.4.0.0 - v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.	2024-05-14	not yet calculated	CVE-2024-3016 psirt-info@cyber.jp.nec.com
Netflix--ConsoleMe	Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0.	2024-05-16	not yet calculated	CVE-2024-5023 security-report@netflix.com
OpenSSL--OpenSSL	Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.	2024-05-16	not yet calculated	CVE-2024-4603 openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org
Puneeth Reddy--Online Shopping System Advanced	Open-source project Online Shopping System Advanced is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser.	2024-05-14	not yet calculated	CVE-2024-3579 cvd@cert.pl cvd@cert.pl
Rockwell Automation--FactoryTalk Remote Access	An unquoted executable path exists in the Rockwell Automation FactoryTalkÂ® Remote Accessâ„¢ possibly resulting in remote code execution if exploited. While running the FTRA installer package, the executable path is not properly quoted, which could allow a threat actor to enter a malicious executable and run it as a System user. A threat actor needs admin privileges to exploit this vulnerability.	2024-05-16	not yet calculated	CVE-2024-3640 PSIRT@rockwellautomation.com
Rockwell Automation--FactoryTalk View SE	A vulnerability exists in the Rockwell Automation FactoryTalkÂ® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in information exposure, revealing sensitive information. Additionally, a threat actor could potentially modify and delete the data in a remote database. An attack would only affect the HMI design time, not runtime.	2024-05-16	not yet calculated	CVE-2024-4609 PSIRT@rockwellautomation.com
The Document Foundation--LibreOffice	Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.	2024-05-14	not yet calculated	CVE-2024-3044 security@documentfoundation.org
Unknown--Add Custom CSS and JS	The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack	2024-05-14	not yet calculated	CVE-2024-3903 contact@wpscan.com
Unknown--Base64 Encoder/Decoder	The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	2024-05-15	not yet calculated	CVE-2024-3822 contact@wpscan.com
Unknown--Base64 Encoder/Decoder	The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack	2024-05-15	not yet calculated	CVE-2024-3823 contact@wpscan.com
Unknown--Base64 Encoder/Decoder	The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack	2024-05-15	not yet calculated	CVE-2024-3824 contact@wpscan.com
Unknown--HL Twitter	The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack	2024-05-15	not yet calculated	CVE-2024-3629 contact@wpscan.com
Unknown--HL Twitter	The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-05-15	not yet calculated	CVE-2024-3630 contact@wpscan.com
Unknown--HL Twitter	The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack	2024-05-15	not yet calculated	CVE-2024-3631 contact@wpscan.com
Unknown--LetterPress	The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers	2024-05-14	not yet calculated	CVE-2024-3590 contact@wpscan.com
Unknown--Newsletter Popup	The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins	2024-05-16	not yet calculated	CVE-2024-3641 contact@wpscan.com
Unknown--Newsletter Popup	The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack	2024-05-16	not yet calculated	CVE-2024-3642 contact@wpscan.com
Unknown--Newsletter Popup	The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack	2024-05-16	not yet calculated	CVE-2024-3643 contact@wpscan.com
Unknown--Newsletter Popup	The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-05-16	not yet calculated	CVE-2024-3644 contact@wpscan.com
Unknown--NextGEN Gallery	The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed	2024-05-17	not yet calculated	CVE-2024-2744 contact@wpscan.com
Unknown--Popup4Phone	The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.	2024-05-17	not yet calculated	CVE-2024-3231 contact@wpscan.com
Unknown--Popup4Phone	The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-05-17	not yet calculated	CVE-2024-3580 contact@wpscan.com
Unknown--Post Grid Gutenberg Blocks and WordPress Blog Plugin	The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks	2024-05-14	not yet calculated	CVE-2024-3239 contact@wpscan.com
Unknown--SP Project & Document Manager	The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user	2024-05-15	not yet calculated	CVE-2024-3748 contact@wpscan.com
Unknown--SP Project & Document Manager	The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user	2024-05-15	not yet calculated	CVE-2024-3749 contact@wpscan.com
Unknown--Save as PDF Plugin by Pdfcrowd	The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-05-14	not yet calculated	CVE-2023-5971 contact@wpscan.com
Unknown--Ultimate Blocks	The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks	2024-05-14	not yet calculated	CVE-2024-3241 contact@wpscan.com
Unknown--UnGallery	The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack	2024-05-14	not yet calculated	CVE-2024-3582 contact@wpscan.com
Unknown--VikBooking Hotel Booking Engine & PMS	The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.	2024-05-14	not yet calculated	CVE-2024-2441 contact@wpscan.com
Unknown--VikBooking Hotel Booking Engine & PMS	The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.	2024-05-14	not yet calculated	CVE-2024-2749 contact@wpscan.com
Unknown--WP Prayer	The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack	2024-05-15	not yet calculated	CVE-2024-3405 contact@wpscan.com
Unknown--WP Prayer	The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack	2024-05-15	not yet calculated	CVE-2024-3406 contact@wpscan.com
Unknown--WP Prayer	The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks	2024-05-15	not yet calculated	CVE-2024-3407 contact@wpscan.com
Unknown--WP Shortcodes Plugin Shortcodes Ultimate	The WP Shortcodes Plugin - Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	2024-05-15	not yet calculated	CVE-2024-3548 contact@wpscan.com
Unknown--month name translation benaceur	The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-05-15	not yet calculated	CVE-2024-3634 contact@wpscan.com
Unknown--reCAPTCHA Jetpack	The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack	2024-05-14	not yet calculated	CVE-2024-3940 contact@wpscan.com
Unknown--reCAPTCHA Jetpack	The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.	2024-05-14	not yet calculated	CVE-2024-3941 contact@wpscan.com
Unknown--socialdriver-framework	The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.	2024-05-17	not yet calculated	CVE-2024-2697 contact@wpscan.com
Veeam--Service Provider Console	Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.	2024-05-14	not yet calculated	CVE-2024-29212 support@hackerone.com
Xen--Xen	Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so involves putting (perhaps updated) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall. When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash.	2024-05-16	not yet calculated	CVE-2023-46842 security@xen.org
Xen--Xen	Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: https://xenbits.xen.org/xsa/advisory-407.html https://xenbits.xen.org/xsa/advisory-434.html	2024-05-16	not yet calculated	CVE-2024-31142 security@xen.org
Xpdf--Xpdf	Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.	2024-05-15	not yet calculated	CVE-2024-4976 xpdf@xpdfreader.com
alpitronic--Hypercharger EV Charger	If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator.	2024-05-15	not yet calculated	CVE-2024-4622 ics-cert@hq.dhs.gov
berriai--berriai/litellm	A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` function unsafely in the `litellm.get_secret()` method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the `eval` function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the `/config/update` endpoint, which allows for the update of settings in `proxy_server_config.yaml`.	2024-05-18	not yet calculated	CVE-2024-4264 security@huntr.dev
gaizhenbiao--gaizhenbiao/chuanhuchatgpt	A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker can exploit this vulnerability by intercepting requests and manipulating the 'name' parameter to specify arbitrary file paths. This allows the attacker to read sensitive files on the server, leading to information leakage, including API keys and private information. The issue affects version 20240310 of the application.	2024-05-16	not yet calculated	CVE-2024-4321 security@huntr.dev
imartinez--imartinez/privategpt	imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.	2024-05-16	not yet calculated	CVE-2024-3403 security@huntr.dev
imartinez--imartinez/privategpt	A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads. Attackers can exploit this vulnerability by uploading malicious HTML files, such as those containing JavaScript payloads, which are then executed in the context of the victim's session when accessed. This could lead to the execution of arbitrary JavaScript code in the context of the user's browser session, potentially resulting in phishing attacks or other malicious actions. The vulnerability affects the latest version of the repository.	2024-05-16	not yet calculated	CVE-2024-3851 security@huntr.dev
mlflow--mlflow/mlflow	A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.	2024-05-16	not yet calculated	CVE-2024-3848 security@huntr.dev security@huntr.dev
mlflow--mlflow/mlflow	A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them.	2024-05-16	not yet calculated	CVE-2024-4263 security@huntr.dev security@huntr.dev
n/a--n/a	Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges.	2024-05-14	not yet calculated	CVE-2020-18305 cve@mitre.org
n/a--n/a	The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data.	2024-05-14	not yet calculated	CVE-2022-28132 cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.	2024-05-14	not yet calculated	CVE-2022-32502 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and bypass both hardware and software security protections. This affects Nuki Keypad before 1.9.2 and Nuki Fob before 1.8.1.	2024-05-14	not yet calculated	CVE-2022-32503 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.	2024-05-14	not yet calculated	CVE-2022-32504 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the functionality and reboot the device. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.	2024-05-14	not yet calculated	CVE-2022-32505 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash memory. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Smart Lock 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.	2024-05-14	not yet calculated	CVE-2022-32506 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were implemented for the different BLE commands across the different accounts. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.	2024-05-14	not yet calculated	CVE-2022-32507 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.	2024-05-14	not yet calculated	CVE-2022-32508 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper data. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Bridge v1 before 1.22.0 and Nuki Bridge v2 before 2.13.2.	2024-05-14	not yet calculated	CVE-2022-32509 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.	2024-05-14	not yet calculated	CVE-2022-32510 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the company or query parameter(s).	2024-05-14	not yet calculated	CVE-2023-24203 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parameter in get-quote.php.	2024-05-14	not yet calculated	CVE-2023-24204 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API.	2024-05-14	not yet calculated	CVE-2023-26566 cve@mitre.org
n/a--n/a	phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.	2024-05-14	not yet calculated	CVE-2023-29881 cve@mitre.org cve@mitre.org
n/a--n/a	Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.	2024-05-15	not yet calculated	CVE-2023-40297 cve@mitre.org
n/a--n/a	extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, and 4.1.1 have set incorrect file permission, which allows attackers to do code execution via modified bash and python scripts.	2024-05-14	not yet calculated	CVE-2023-46870 cve@mitre.org
n/a--n/a	Shrubbery tac_plus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tac_plus.cfg configuration file. These are executed when a client sends an authorization request with a username that has pre-authorization directives configured. However, it is possible to inject additional commands into these checks because strings from TACACS+ packets are used as command-line arguments. If the installation lacks a a pre-shared secret (there is no pre-shared secret by default), then the injection can be triggered without authentication. (The attacker needs to know a username configured to use a pre-authorization command.) NOTE: this is related to CVE-2023-45239 but the issue is in the original Shrubbery product, not Meta's fork.	2024-05-16	not yet calculated	CVE-2023-48643 cve@mitre.org
n/a--n/a	The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.	2024-05-17	not yet calculated	CVE-2023-52424 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exe component.	2024-05-14	not yet calculated	CVE-2024-22774 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.	2024-05-14	not yet calculated	CVE-2024-22910 cve@mitre.org
n/a--n/a	Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via board.py.	2024-05-14	not yet calculated	CVE-2024-24157 cve@mitre.org
n/a--n/a	A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, kernel 5.5: IB19130163 in 05.54.07, and kernel 5.6: IB19130163 in 05.61.07 could lead to escalating privileges in SMM.	2024-05-15	not yet calculated	CVE-2024-25078 cve@mitre.org cve@mitre.org
n/a--n/a	A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.	2024-05-15	not yet calculated	CVE-2024-25079 cve@mitre.org cve@mitre.org
n/a--n/a	Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs.	2024-05-14	not yet calculated	CVE-2024-25662 cve@mitre.org
n/a--n/a	In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.	2024-05-17	not yet calculated	CVE-2024-25742 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler in userspace applications. This affects AMD SEV-SNP and AMD SEV-ES.	2024-05-15	not yet calculated	CVE-2024-25743 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.	2024-05-14	not yet calculated	CVE-2024-26306 cve@mitre.org cve@mitre.org
n/a--n/a	Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-* Build 1467, evEDGE-EO-* Build 0029, MMA10G-* Build 0498, 570IPG-X19-10G Build 0691 allows a remote attacker to execute arbitrary code via a crafted payload to the login parameters.	2024-05-14	not yet calculated	CVE-2024-26367 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the delete-task.php component.	2024-05-14	not yet calculated	CVE-2024-26517 cve@mitre.org cve@mitre.org
n/a--n/a	A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.	2024-05-14	not yet calculated	CVE-2024-27280 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.	2024-05-14	not yet calculated	CVE-2024-27281 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.	2024-05-14	not yet calculated	CVE-2024-27282 cve@mitre.org cve@mitre.org
n/a--n/a	A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.	2024-05-15	not yet calculated	CVE-2024-27353 cve@mitre.org cve@mitre.org
n/a--n/a	A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the filter name field. This vulnerability has been fixed in version 3.23.0.	2024-05-15	not yet calculated	CVE-2024-27593 cve@mitre.org
n/a--n/a	Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.	2024-05-18	not yet calculated	CVE-2024-28063 cve@mitre.org
n/a--n/a	Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).	2024-05-18	not yet calculated	CVE-2024-28064 cve@mitre.org
n/a--n/a	In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.	2024-05-15	not yet calculated	CVE-2024-28087 cve@mitre.org
n/a--n/a	Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task_name=.	2024-05-14	not yet calculated	CVE-2024-28276 cve@mitre.org cve@mitre.org
n/a--n/a	In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject_name= parameter, enabling Stored Cross-Site Scripting (XSS) attacks. This vulnerability allows attackers to manipulate the subject's name, potentially leading to the execution of malicious JavaScript payloads.	2024-05-14	not yet calculated	CVE-2024-28277 cve@mitre.org cve@mitre.org
n/a--n/a	Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=.	2024-05-14	not yet calculated	CVE-2024-28279 cve@mitre.org cve@mitre.org
n/a--n/a	A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.	2024-05-14	not yet calculated	CVE-2024-28285 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a heap buffer overflow in H5HG_read, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29157 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a stack buffer overflow in H5FL_arr_malloc, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29158 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_scaleoffset, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29159 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a heap buffer overflow in H5HG__cache_heap_deserialize, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29160 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29161 cve@mitre.org
n/a--n/a	HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HG_read, resulting in denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29162 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a heap buffer overflow in H5T__bit_find, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29163 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a stack buffer overflow in H5R__decode_heap, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29164 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_fletcher32, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29165 cve@mitre.org
n/a--n/a	HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.	2024-05-14	not yet calculated	CVE-2024-29166 cve@mitre.org
n/a--n/a	An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code within the driver and create a local denial-of-service condition due to an improper DACL being applied to the device the driver creates.	2024-05-14	not yet calculated	CVE-2024-29513 cve@mitre.org
n/a--n/a	An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.	2024-05-14	not yet calculated	CVE-2024-29857 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.	2024-05-14	not yet calculated	CVE-2024-30171 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.	2024-05-14	not yet calculated	CVE-2024-30172 cve@mitre.org
n/a--n/a	SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload to Login.asp component.	2024-05-14	not yet calculated	CVE-2024-30801 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component.	2024-05-14	not yet calculated	CVE-2024-30802 cve@mitre.org
n/a--n/a	An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function.	2024-05-14	not yet calculated	CVE-2024-31556 cve@mitre.org
n/a--n/a	Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file	2024-05-14	not yet calculated	CVE-2024-31771 cve@mitre.org
n/a--n/a	Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT::read_pre_data128_from_file function.	2024-05-14	not yet calculated	CVE-2024-31803 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.	2024-05-14	not yet calculated	CVE-2024-31810 cve@mitre.org
n/a--n/a	The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. com.solarized.firedown.IntentActivity uses a WebView component to display web content and doesn't adequately sanitize the URI or any extra data passed in the intent by any installed application (with no permissions).	2024-05-17	not yet calculated	CVE-2024-31974 cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.	2024-05-14	not yet calculated	CVE-2024-32349 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary.	2024-05-14	not yet calculated	CVE-2024-32350 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the "cstecgi.cgi" binary.	2024-05-14	not yet calculated	CVE-2024-32351 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable" parameter in the "cstecgi.cgi" binary.	2024-05-14	not yet calculated	CVE-2024-32352 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.	2024-05-14	not yet calculated	CVE-2024-32353 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.	2024-05-14	not yet calculated	CVE-2024-32354 cve@mitre.org cve@mitre.org
n/a--n/a	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function.	2024-05-14	not yet calculated	CVE-2024-32355 cve@mitre.org cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a heap-based buffer over-read in H5VM_memcpyvv in H5VM.c (called from H5D__compact_readvv in H5Dcompact.c).	2024-05-14	not yet calculated	CVE-2024-32605 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).	2024-05-14	not yet calculated	CVE-2024-32606 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a SEGV in H5A__close in H5Aint.c, resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32607 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c.	2024-05-14	not yet calculated	CVE-2024-32609 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a SEGV in H5T_close_real in H5T.c, resulting in a corrupted instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32610 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.	2024-05-14	not yet calculated	CVE-2024-32611 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5HL__fl_deserialize in H5HLcache.c, resulting in the corruption of the instruction pointer, a different vulnerability than CVE-2024-32613.	2024-05-14	not yet calculated	CVE-2024-32612 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer over-read in the function H5HL__fl_deserialize in H5HLcache.c, a different vulnerability than CVE-2024-32612.	2024-05-14	not yet calculated	CVE-2024-32613 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a SEGV in H5VM_memcpyvv in H5VM.c.	2024-05-14	not yet calculated	CVE-2024-32614 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer.	2024-05-14	not yet calculated	CVE-2024-32615 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5O__dtype_encode_helper in H5Odtype.c.	2024-05-14	not yet calculated	CVE-2024-32616 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer over-read caused by the unsafe use of strdup in H5MM_xstrdup in H5MM.c (called from H5G__ent_to_link in H5Glink.c).	2024-05-14	not yet calculated	CVE-2024-32617 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__get_native_type in H5Tnative.c, resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32618 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T_copy_reopen in H5T.c, resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32619 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5F_addr_decode_len in H5Fint.c, resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32620 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blob.c), resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32621 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a out-of-bounds read operation in H5FL_arr_malloc in H5FL.c (called from H5S_set_extent_simple in H5S.c).	2024-05-14	not yet calculated	CVE-2024-32622 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5VM_array_fill in H5VM.c (called from H5S_select_elements in H5Spoint.c).	2024-05-14	not yet calculated	CVE-2024-32623 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__ref_mem_setnull in H5Tref.c (called from H5T__conv_ref in H5Tconv.c), resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-32624 cve@mitre.org
n/a--n/a	An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268(Leo) and SRS/4.0.195(Leo) allows a remote attacker to execute arbitrary code via a crafted request.	2024-05-14	not yet calculated	CVE-2024-33250 cve@mitre.org
n/a--n/a	QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c.	2024-05-14	not yet calculated	CVE-2024-33263 cve@mitre.org
n/a--n/a	Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the Wireless Page.	2024-05-14	not yet calculated	CVE-2024-33433 cve@mitre.org
n/a--n/a	Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component.	2024-05-14	not yet calculated	CVE-2024-33454 cve@mitre.org
n/a--n/a	SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the login.php component	2024-05-14	not yet calculated	CVE-2024-33485 cve@mitre.org
n/a--n/a	A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via goform/formWPS, allows remote authenticated users to trigger a denial of service (DoS) through the parameter "webpage."	2024-05-14	not yet calculated	CVE-2024-33771 cve@mitre.org
n/a--n/a	A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formTcpipSetup allows remote authenticated users to trigger a denial of service (DoS) through the parameter "curTime."	2024-05-14	not yet calculated	CVE-2024-33772 cve@mitre.org
n/a--n/a	A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanGuestSetup allows remote authenticated users to trigger a denial of service (DoS) through the parameter "webpage."	2024-05-14	not yet calculated	CVE-2024-33773 cve@mitre.org
n/a--n/a	A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanSetup_Wizard allows remote authenticated users to trigger a denial of service (DoS) through the parameter "webpage."	2024-05-14	not yet calculated	CVE-2024-33774 cve@mitre.org
n/a--n/a	Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference (IDOR) via the userID parameter.	2024-05-14	not yet calculated	CVE-2024-33818 cve@mitre.org
n/a--n/a	Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Save Query function.	2024-05-14	not yet calculated	CVE-2024-33819 cve@mitre.org
n/a--n/a	An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion.	2024-05-14	not yet calculated	CVE-2024-33863 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript.	2024-05-14	not yet calculated	CVE-2024-33864 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints.	2024-05-14	not yet calculated	CVE-2024-33865 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS.	2024-05-14	not yet calculated	CVE-2024-33866 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.	2024-05-14	not yet calculated	CVE-2024-33867 cve@mitre.org cve@mitre.org
n/a--n/a	An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.	2024-05-14	not yet calculated	CVE-2024-33868 cve@mitre.org cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5D__scatter_mem in H5Dscatgath.c.	2024-05-14	not yet calculated	CVE-2024-33873 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c.	2024-05-14	not yet calculated	CVE-2024-33874 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5O__layout_encode in H5Olayout.c, resulting in the corruption of the instruction pointer.	2024-05-14	not yet calculated	CVE-2024-33875 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a heap buffer overflow in H5S__point_deserialize in H5Spoint.c.	2024-05-14	not yet calculated	CVE-2024-33876 cve@mitre.org
n/a--n/a	HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5T__conv_struct_opt in H5Tconv.c.	2024-05-14	not yet calculated	CVE-2024-33877 cve@mitre.org
n/a--n/a	The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message).	2024-05-17	not yet calculated	CVE-2024-34058 cve@mitre.org
n/a--n/a	htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request.	2024-05-14	not yet calculated	CVE-2024-34191 cve@mitre.org
n/a--n/a	Totolink AC1200 Wireless Dual Band Gigabit Router A3002RU_V3 Firmware V3.0.0-B20230809.1615 is vulnerable to Buffer Overflow. The "boa" program allows attackers to modify the value of the "vwlan_idx" field via "formMultiAP". This can lead to a stack overflow through the "formWlEncrypt" CGI function by constructing malicious HTTP requests and passing a WLAN SSID value exceeding the expected length, potentially resulting in command execution or denial of service attacks.	2024-05-14	not yet calculated	CVE-2024-34196 cve@mitre.org
n/a--n/a	TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements in the request line.	2024-05-14	not yet calculated	CVE-2024-34199 cve@mitre.org
n/a--n/a	TOTOLINK CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function.	2024-05-14	not yet calculated	CVE-2024-34200 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function.	2024-05-14	not yet calculated	CVE-2024-34201 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setMacFilterRules function.	2024-05-14	not yet calculated	CVE-2024-34202 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setLanguageCfg function.	2024-05-14	not yet calculated	CVE-2024-34203 cve@mitre.org
n/a--n/a	TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter.	2024-05-14	not yet calculated	CVE-2024-34204 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function.	2024-05-14	not yet calculated	CVE-2024-34205 cve@mitre.org
n/a--n/a	TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter.	2024-05-14	not yet calculated	CVE-2024-34206 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setStaticDhcpConfig function.	2024-05-14	not yet calculated	CVE-2024-34207 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function.	2024-05-14	not yet calculated	CVE-2024-34209 cve@mitre.org
n/a--n/a	TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileName parameter.	2024-05-14	not yet calculated	CVE-2024-34210 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.	2024-05-14	not yet calculated	CVE-2024-34211 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function.	2024-05-14	not yet calculated	CVE-2024-34212 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the SetPortForwardRules function.	2024-05-14	not yet calculated	CVE-2024-34213 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function.	2024-05-14	not yet calculated	CVE-2024-34215 cve@mitre.org
n/a--n/a	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the addWlProfileClientMode function.	2024-05-14	not yet calculated	CVE-2024-34217 cve@mitre.org
n/a--n/a	TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter.	2024-05-14	not yet calculated	CVE-2024-34218 cve@mitre.org
n/a--n/a	TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.	2024-05-14	not yet calculated	CVE-2024-34219 cve@mitre.org
n/a--n/a	Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter.	2024-05-14	not yet calculated	CVE-2024-34220 cve@mitre.org
n/a--n/a	Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation.	2024-05-14	not yet calculated	CVE-2024-34221 cve@mitre.org
n/a--n/a	Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter.	2024-05-14	not yet calculated	CVE-2024-34222 cve@mitre.org
n/a--n/a	Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approve or reject leave ticket.	2024-05-14	not yet calculated	CVE-2024-34223 cve@mitre.org
n/a--n/a	Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters.	2024-05-14	not yet calculated	CVE-2024-34224 cve@mitre.org
n/a--n/a	Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the name, shortname parameters.	2024-05-14	not yet calculated	CVE-2024-34225 cve@mitre.org
n/a--n/a	SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters.	2024-05-14	not yet calculated	CVE-2024-34226 cve@mitre.org
n/a--n/a	A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter.	2024-05-14	not yet calculated	CVE-2024-34230 cve@mitre.org
n/a--n/a	A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Short Name parameter.	2024-05-14	not yet calculated	CVE-2024-34231 cve@mitre.org
n/a--n/a	A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications.	2024-05-17	not yet calculated	CVE-2024-34241 cve@mitre.org
n/a--n/a	Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.	2024-05-14	not yet calculated	CVE-2024-34243 cve@mitre.org
n/a--n/a	An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtml_js_action.php.	2024-05-14	not yet calculated	CVE-2024-34245 cve@mitre.org
n/a--n/a	OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.	2024-05-14	not yet calculated	CVE-2024-34256 cve@mitre.org
n/a--n/a	njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.	2024-05-16	not yet calculated	CVE-2024-34273 cve@mitre.org
n/a--n/a	TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode.	2024-05-14	not yet calculated	CVE-2024-34308 cve@mitre.org
n/a--n/a	Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.	2024-05-14	not yet calculated	CVE-2024-34310 cve@mitre.org
n/a--n/a	A Blind command injection vulnerability in Tenda O3V2 V1.0.0.12 and earlier allows remote attackers to execute operating system commands via dest parameter in /goform/getTraceroute	2024-05-14	not yet calculated	CVE-2024-34338 cve@mitre.org
n/a--n/a	An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.	2024-05-14	not yet calculated	CVE-2024-34459 cve@mitre.org cve@mitre.org cve@mitre.org
n/a--n/a	Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature.	2024-05-16	not yet calculated	CVE-2024-34582 cve@mitre.org
n/a--n/a	WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).	2024-05-14	not yet calculated	CVE-2024-34899 cve@mitre.org
n/a--n/a	FlyFish v3.0.0 was discovered to contain a buffer overflow via the password parameter on the login page. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.	2024-05-16	not yet calculated	CVE-2024-34905 cve@mitre.org
n/a--n/a	An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file.	2024-05-15	not yet calculated	CVE-2024-34906 cve@mitre.org
n/a--n/a	An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file.	2024-05-15	not yet calculated	CVE-2024-34909 cve@mitre.org
n/a--n/a	An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file.	2024-05-15	not yet calculated	CVE-2024-34913 cve@mitre.org
n/a--n/a	php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked "remember me" when logging in.	2024-05-14	not yet calculated	CVE-2024-34914 cve@mitre.org
n/a--n/a	An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 allows attackers to execute arbitrary code via uploading a crafted file.	2024-05-17	not yet calculated	CVE-2024-34919 cve@mitre.org
n/a--n/a	TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.	2024-05-14	not yet calculated	CVE-2024-34921 cve@mitre.org
n/a--n/a	Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/exeCommand.	2024-05-14	not yet calculated	CVE-2024-34942 cve@mitre.org
n/a--n/a	Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting.	2024-05-14	not yet calculated	CVE-2024-34943 cve@mitre.org
n/a--n/a	Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient.	2024-05-14	not yet calculated	CVE-2024-34944 cve@mitre.org
n/a--n/a	Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPW parameter at ip/goform/WizardHandle.	2024-05-14	not yet calculated	CVE-2024-34945 cve@mitre.org
n/a--n/a	Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient.	2024-05-14	not yet calculated	CVE-2024-34946 cve@mitre.org
n/a--n/a	D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.	2024-05-14	not yet calculated	CVE-2024-34950 cve@mitre.org
n/a--n/a	Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.	2024-05-15	not yet calculated	CVE-2024-34954 cve@mitre.org
n/a--n/a	Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter.	2024-05-15	not yet calculated	CVE-2024-34955 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet.	2024-05-16	not yet calculated	CVE-2024-34957 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add	2024-05-16	not yet calculated	CVE-2024-34958 cve@mitre.org
n/a--n/a	DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.	2024-05-17	not yet calculated	CVE-2024-34959 cve@mitre.org
n/a--n/a	Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter.	2024-05-14	not yet calculated	CVE-2024-34974 cve@mitre.org
n/a--n/a	An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.	2024-05-17	not yet calculated	CVE-2024-34982 cve@mitre.org
n/a--n/a	joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array().	2024-05-17	not yet calculated	CVE-2024-34997 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fieldName2=state&tabName=banner&dataID=6.	2024-05-14	not yet calculated	CVE-2024-35009 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%89%87%E5%B9%BF%E5%91%8A&theme=cs&dataID=6.	2024-05-14	not yet calculated	CVE-2024-35010 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close.	2024-05-14	not yet calculated	CVE-2024-35011 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close.	2024-05-14	not yet calculated	CVE-2024-35012 cve@mitre.org
n/a--n/a	idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys_deal.php?mudi=area.	2024-05-16	not yet calculated	CVE-2024-35039 cve@mitre.org
n/a--n/a	An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.	2024-05-14	not yet calculated	CVE-2024-35048 cve@mitre.org
n/a--n/a	SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.	2024-05-14	not yet calculated	CVE-2024-35049 cve@mitre.org
n/a--n/a	An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.	2024-05-14	not yet calculated	CVE-2024-35050 cve@mitre.org
n/a--n/a	TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth.	2024-05-14	not yet calculated	CVE-2024-35099 cve@mitre.org
n/a--n/a	Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script.	2024-05-15	not yet calculated	CVE-2024-35102 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN.	2024-05-15	not yet calculated	CVE-2024-35108 cve@mitre.org
n/a--n/a	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close.	2024-05-15	not yet calculated	CVE-2024-35109 cve@mitre.org
n/a--n/a	A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker.	2024-05-17	not yet calculated	CVE-2024-35110 cve@mitre.org
n/a--n/a	Veritas System Recovery before 23.2_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks.	2024-05-14	not yet calculated	CVE-2024-35204 cve@mitre.org cve@mitre.org
n/a--n/a	The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aiming to overwrite an existing native library utilized by WPS Office. Successful exploitation could result in the execution of arbitrary commands under the guise of WPS Office's application ID.	2024-05-14	not yet calculated	CVE-2024-35205 cve@mitre.org
n/a--n/a	In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.	2024-05-17	not yet calculated	CVE-2024-35312 cve@mitre.org
n/a--n/a	In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.	2024-05-17	not yet calculated	CVE-2024-35313 cve@mitre.org
n/a--n/a	question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.	2024-05-18	not yet calculated	CVE-2024-36043 cve@mitre.org cve@mitre.org
n/a--n/a	QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.	2024-05-18	not yet calculated	CVE-2024-36048 cve@mitre.org cve@mitre.org
n/a--n/a	Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.	2024-05-18	not yet calculated	CVE-2024-36050 cve@mitre.org cve@mitre.org
parisneo--parisneo/lollms-webui	A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is executed when the file is accessed. This vulnerability is remotely exploitable via Cross-Site Request Forgery (CSRF), allowing attackers to perform actions on behalf of authenticated users and potentially leading to unauthorized access to sensitive information within the Lollms-webui application.	2024-05-14	not yet calculated	CVE-2024-2299 security@huntr.dev
parisneo--parisneo/lollms-webui	A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.	2024-05-16	not yet calculated	CVE-2024-2358 security@huntr.dev
parisneo--parisneo/lollms-webui	A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui.	2024-05-16	not yet calculated	CVE-2024-2361 security@huntr.dev
parisneo--parisneo/lollms-webui	A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/lollms/server/endpoints/lollms_binding_infos.py of the latest version. The vulnerability arises due to insufficient path sanitization, allowing an attacker to exploit path traversal to navigate to arbitrary directories. By manipulating the binding_path to point to a controlled directory and uploading a malicious __init__.py file, an attacker can execute arbitrary code on the server.	2024-05-16	not yet calculated	CVE-2024-2366 security@huntr.dev
parisneo--parisneo/lollms-webui	A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.	2024-05-16	not yet calculated	CVE-2024-3126 security@huntr.dev security@huntr.dev
parisneo--parisneo/lollms-webui	A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities.	2024-05-16	not yet calculated	CVE-2024-3435 security@huntr.dev security@huntr.dev
parisneo--parisneo/lollms-webui	A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure.	2024-05-16	not yet calculated	CVE-2024-4322 security@huntr.dev
parisneo--parisneo/lollms-webui	A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.	2024-05-16	not yet calculated	CVE-2024-4326 security@huntr.dev security@huntr.dev
parisneo--parisneo/lollms	A vulnerability in the parisneo/lollms, specifically in the `/unInstall_binding` endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the `name` parameter in the `unInstall_binding` function, allowing an attacker to traverse directories and execute arbitrary code by loading a malicious `__init__.py` file. This vulnerability affects the latest version of the software. The exploitation of this vulnerability could lead to remote code execution on the system where parisneo/lollms is deployed.	2024-05-16	not yet calculated	CVE-2024-4078 security@huntr.dev security@huntr.dev
run-llama--run-llama/llama_index	A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.	2024-05-16	not yet calculated	CVE-2024-4181 security@huntr.dev security@huntr.dev
wandb--wandb/wandb	A Server-Side Request Forgery (SSRF) vulnerability exists in the wandb/wandb repository due to improper handling of HTTP 302 redirects. This issue allows team members with access to the 'User settings -> Webhooks' function to exploit this vulnerability to access internal HTTP(s) servers. In severe cases, such as on AWS instances, this could potentially be abused to achieve remote code execution on the victim's machine. The vulnerability is present in the latest version of the repository.	2024-05-16	not yet calculated	CVE-2024-4642 security@huntr.dev

Team IT Security - 📰 Alle Kategorien

Datalab Marker v2 vs MinerU, Docling, and Liteparse: Benchmark Breakdown

Datalab’s Marker 2 vs MinerU, Docling and LiteParse: 76.0 on olmOCR-bench at 5× MinerU’s Throughput

The complete guide to Node.js frameworks

Minimalist web frameworks

Express.js

Koa

Fastify

Hono

Nitro.js

Batteries-included frameworks

Nest.js

Adonis.js

Sails

Full-stack frameworks

Next.js

Dog Breed Not Found

Dog Breed Profile

Nuxt.js

{{ error.data.error }}

Dog Breed Profile

SvelteKit

Dog Breed Profile

Conclusion

The FBI letter was top secret. Fighting it rewrote online privacy law. ✉ Darknet Diaries Ep. 176 NSL

Frame - FFmpeg GUI Rust rewrite

Enterprises lost Claude Fable 5 for a few weeks. New data shows two-thirds had already built their hedge

How the Fable 5 export order rewrote enterprise AI risk

The hedge was already built before the blackout hit

Just 1 in 10 enterprises would catch a failing production model automatically

The top governance barrier is organizational: no single owner for AI across platforms

79% have already paid for an agent control failure — led by shadow AI

The bottom line: Replaceability is spreading faster than ownership

Cisco details Live Protect’s real-time threat mitigation capabilities

World Wide Technology on Cisco Live Protect

Read more stories from Cisco Live 2026

Cisco: AI growth is exposing campus network limits

For more Cisco news, see our coverage from Cisco Live 2026:

85% of IT teams claim every AI agent is under control. Only 42% actually know who owns them.

Governance at deploy time, failure at runtime

The 18-month window

Six governance questions for Q3 renewals

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer

How Jeetu Patel made Cisco unrecognizable

From dashboard sprawl to Cloud Control

Cloud Control as an AI harness, not a console

CX and products finally share a brain

Secure Networking as the integration proof point

Multicloud Fabric: networking as a service for AI

What this means for customers

Read more stories from Cisco Live 2026

I built 99 adversarially malformed PE files to test tool robustness - here’s what happened

99 adversarial PE files: exploring malformed‑binary behaviour across major analysis tools

Smashing Security podcast #471: This AI worm just rewrote its own rules

v15.9.0

@oh-my-pi/pi-ai

Fixed

@oh-my-pi/pi-coding-agent

Breaking Changes

Added

Fixed

Changed

Fixed

@oh-my-pi/pi-natives

Fixed

@oh-my-pi/swarm-extension

Fixed

@oh-my-pi/pi-tui

Added

Changed

Fixed

@oh-my-pi/pi-utils

Added

What's Changed

New Contributors

How Cisco IT cut observability costs by 86% and eliminated major network outages

The tool sprawl that made it worse