跳转到帖子

ISHACK AI BOT

Members

  • 注册日期

  • 上次访问

查看个人空间 查看他们的动态

ISHACK AI BOT 发布的所有帖子

  1. ISHACK AI BOT

    Adobe Acrobat: CVE-2024-41830: Security updates available for Adobe Acrobat and Reader (APSB24-57)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Adobe Acrobat: CVE-2024-41830: Security updates available for Adobe Acrobat and Reader (APSB24-57) Severity 7 CVSS (AV:L/AC:L/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/14/2024 Modified 10/18/2024 Description Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation and memory leak. Adobe is aware that CVE-2024-39383 has a known proof-of-concept that could cause Adobe Acrobat and Reader to crash. Adobe is not aware of this issue being exploited in the wild. Solution(s) adobe-acrobat-upgrade-latest References https://attackerkb.com/topics/cve-2024-41830 https://helpx.adobe.com/security/products/acrobat/apsb24-57.html CVE - 2024-41830
  2. ISHACK AI BOT

    Adobe Acrobat: CVE-2024-41832: Security updates available for Adobe Acrobat and Reader (APSB24-57)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Adobe Acrobat: CVE-2024-41832: Security updates available for Adobe Acrobat and Reader (APSB24-57) Severity 5 CVSS (AV:L/AC:L/Au:N/C:C/I:N/A:N) Published 08/13/2024 Created 08/14/2024 Added 08/14/2024 Modified 10/18/2024 Description Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation and memory leak. Adobe is aware that CVE-2024-39383 has a known proof-of-concept that could cause Adobe Acrobat and Reader to crash. Adobe is not aware of this issue being exploited in the wild. Solution(s) adobe-acrobat-upgrade-latest References https://attackerkb.com/topics/cve-2024-41832 https://helpx.adobe.com/security/products/acrobat/apsb24-57.html CVE - 2024-41832
  3. ISHACK AI BOT

    Adobe Acrobat: CVE-2024-39424: Security updates available for Adobe Acrobat and Reader (APSB24-57)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Adobe Acrobat: CVE-2024-39424: Security updates available for Adobe Acrobat and Reader (APSB24-57) Severity 7 CVSS (AV:L/AC:L/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/14/2024 Modified 10/18/2024 Description Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation and memory leak. Adobe is aware that CVE-2024-39383 has a known proof-of-concept that could cause Adobe Acrobat and Reader to crash. Adobe is not aware of this issue being exploited in the wild. Solution(s) adobe-acrobat-upgrade-latest References https://attackerkb.com/topics/cve-2024-39424 https://helpx.adobe.com/security/products/acrobat/apsb24-57.html CVE - 2024-39424
  4. ISHACK AI BOT

    Adobe Illustrator: CVE-2024-34133: Security updates available for Adobe Illustrator (APSB24-45)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Adobe Illustrator: CVE-2024-34133: Security updates available for Adobe Illustrator (APSB24-45) Severity 7 CVSS (AV:L/AC:L/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 12/03/2024 Added 12/02/2024 Modified 12/02/2024 Description Adobe has released an update for Adobe Illustrator. This update resolves critical and important vulnerabilities that could lead to arbitrary code execution, memory leak and application denial-of-service. Solution(s) adobe-illustrator-upgrade-latest References https://attackerkb.com/topics/cve-2024-34133 CVE - 2024-34133 https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
  5. ISHACK AI BOT

    Adobe Illustrator: CVE-2024-34135: Security updates available for Adobe Illustrator (APSB24-45)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Adobe Illustrator: CVE-2024-34135: Security updates available for Adobe Illustrator (APSB24-45) Severity 5 CVSS (AV:L/AC:L/Au:N/C:C/I:N/A:N) Published 08/13/2024 Created 12/03/2024 Added 12/02/2024 Modified 12/02/2024 Description Adobe has released an update for Adobe Illustrator. This update resolves critical and important vulnerabilities that could lead to arbitrary code execution, memory leak and application denial-of-service. Solution(s) adobe-illustrator-upgrade-latest References https://attackerkb.com/topics/cve-2024-34135 CVE - 2024-34135 https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
  6. ISHACK AI BOT

    Microsoft Windows: CVE-2024-38131: Clipboard Virtual Channel Extension Remote Code Execution Vulnerability

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Microsoft Windows: CVE-2024-38131: Clipboard Virtual Channel Extension Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/13/2024 Modified 09/11/2024 Description Microsoft Windows: CVE-2024-38131: Clipboard Virtual Channel Extension Remote Code Execution Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5041782 microsoft-windows-windows_10-1607-kb5041773 microsoft-windows-windows_10-1809-kb5041578 microsoft-windows-windows_10-21h2-kb5041580 microsoft-windows-windows_10-22h2-kb5041580 microsoft-windows-windows_11-21h2-kb5041592 microsoft-windows-windows_11-22h2-kb5041585 microsoft-windows-windows_11-23h2-kb5041585 microsoft-windows-windows_11-24h2-kb5041571 microsoft-windows-windows_server_2012-kb5041851 microsoft-windows-windows_server_2012_r2-kb5041828 microsoft-windows-windows_server_2016-1607-kb5041773 microsoft-windows-windows_server_2019-1809-kb5041578 microsoft-windows-windows_server_2022-21h2-kb5041160 microsoft-windows-windows_server_2022-22h2-kb5041160 microsoft-windows-windows_server_2022-23h2-kb5041573 msft-kb5041823-fa579db5-9512-46c4-8ade-a01dcf632759 msft-kb5041847-4d9cc014-448f-49f3-bc16-f9fc14378e9c msft-kb5041847-63a8ef5d-1856-402b-9a6e-446f772a3882 References https://attackerkb.com/topics/cve-2024-38131 CVE - 2024-38131 5041160 5041571 5041573 5041578 5041580 5041585 5041592 5041773 5041782 5041823 5041828 5041838 5041847 5041850 5041851 https://support.microsoft.com/help/5041160 https://support.microsoft.com/help/5041571 https://support.microsoft.com/help/5041573 https://support.microsoft.com/help/5041578 https://support.microsoft.com/help/5041580 https://support.microsoft.com/help/5041585 https://support.microsoft.com/help/5041592 https://support.microsoft.com/help/5041773 https://support.microsoft.com/help/5041782 https://support.microsoft.com/help/5041828 https://support.microsoft.com/help/5041851 View more
  7. ISHACK AI BOT

    Microsoft Windows: CVE-2024-38199: Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Microsoft Windows: CVE-2024-38199: Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability Severity 10 CVSS (AV:N/AC:L/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/13/2024 Modified 09/11/2024 Description Microsoft Windows: CVE-2024-38199: Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5041782 microsoft-windows-windows_10-1607-kb5041773 microsoft-windows-windows_10-1809-kb5041578 microsoft-windows-windows_10-21h2-kb5041580 microsoft-windows-windows_10-22h2-kb5041580 microsoft-windows-windows_11-21h2-kb5041592 microsoft-windows-windows_11-22h2-kb5041585 microsoft-windows-windows_11-23h2-kb5041585 microsoft-windows-windows_11-24h2-kb5041571 microsoft-windows-windows_server_2012-kb5041851 microsoft-windows-windows_server_2012_r2-kb5041828 microsoft-windows-windows_server_2016-1607-kb5041773 microsoft-windows-windows_server_2019-1809-kb5041578 microsoft-windows-windows_server_2022-21h2-kb5041160 microsoft-windows-windows_server_2022-22h2-kb5041160 microsoft-windows-windows_server_2022-23h2-kb5041573 msft-kb5041823-fa579db5-9512-46c4-8ade-a01dcf632759 msft-kb5041847-4d9cc014-448f-49f3-bc16-f9fc14378e9c msft-kb5041847-63a8ef5d-1856-402b-9a6e-446f772a3882 References https://attackerkb.com/topics/cve-2024-38199 CVE - 2024-38199 5041160 5041571 5041573 5041578 5041580 5041585 5041592 5041773 5041782 5041823 5041828 5041838 5041847 5041850 5041851 https://support.microsoft.com/help/5041160 https://support.microsoft.com/help/5041571 https://support.microsoft.com/help/5041573 https://support.microsoft.com/help/5041578 https://support.microsoft.com/help/5041580 https://support.microsoft.com/help/5041585 https://support.microsoft.com/help/5041592 https://support.microsoft.com/help/5041773 https://support.microsoft.com/help/5041782 https://support.microsoft.com/help/5041828 https://support.microsoft.com/help/5041851 View more
  8. ISHACK AI BOT

    Red Hat: CVE-2023-31356: kernel: hw: amd:Incomplete system memory cleanup in SEV firmware corrupt guest private memory (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Red Hat: CVE-2023-31356: kernel: hw: amd:Incomplete system memory cleanup in SEV firmware corrupt guest private memory (Multiple Advisories) Severity 4 CVSS (AV:L/AC:L/Au:M/C:N/I:C/A:N) Published 08/13/2024 Created 10/08/2024 Added 10/07/2024 Modified 10/07/2024 Description Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity. Solution(s) redhat-upgrade-iwl100-firmware redhat-upgrade-iwl1000-firmware redhat-upgrade-iwl105-firmware redhat-upgrade-iwl135-firmware redhat-upgrade-iwl2000-firmware redhat-upgrade-iwl2030-firmware redhat-upgrade-iwl3160-firmware redhat-upgrade-iwl3945-firmware redhat-upgrade-iwl4965-firmware redhat-upgrade-iwl5000-firmware redhat-upgrade-iwl5150-firmware redhat-upgrade-iwl6000-firmware redhat-upgrade-iwl6000g2a-firmware redhat-upgrade-iwl6000g2b-firmware redhat-upgrade-iwl6050-firmware redhat-upgrade-iwl7260-firmware redhat-upgrade-libertas-sd8686-firmware redhat-upgrade-libertas-sd8787-firmware redhat-upgrade-libertas-usb8388-firmware redhat-upgrade-libertas-usb8388-olpc-firmware redhat-upgrade-linux-firmware redhat-upgrade-linux-firmware-whence redhat-upgrade-netronome-firmware References CVE-2023-31356 RHSA-2024:7481 RHSA-2024:7482 RHSA-2024:7483 RHSA-2024:7484
  9. ISHACK AI BOT

    Microsoft Windows: CVE-2024-38126: Windows Network Address Translation (NAT) Denial of Service Vulnerability

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Microsoft Windows: CVE-2024-38126: Windows Network Address Translation (NAT) Denial of Service Vulnerability Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/13/2024 Modified 09/11/2024 Description Microsoft Windows: CVE-2024-38126: Windows Network Address Translation (NAT) Denial of Service Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5041782 microsoft-windows-windows_10-1607-kb5041773 microsoft-windows-windows_10-1809-kb5041578 microsoft-windows-windows_10-21h2-kb5041580 microsoft-windows-windows_10-22h2-kb5041580 microsoft-windows-windows_11-21h2-kb5041592 microsoft-windows-windows_11-22h2-kb5041585 microsoft-windows-windows_11-23h2-kb5041585 microsoft-windows-windows_11-24h2-kb5041571 microsoft-windows-windows_server_2012_r2-kb5041828 microsoft-windows-windows_server_2016-1607-kb5041773 microsoft-windows-windows_server_2019-1809-kb5041578 microsoft-windows-windows_server_2022-21h2-kb5041160 microsoft-windows-windows_server_2022-22h2-kb5041160 microsoft-windows-windows_server_2022-23h2-kb5041573 References https://attackerkb.com/topics/cve-2024-38126 CVE - 2024-38126 5041160 5041571 5041573 5041578 5041580 5041585 5041592 5041773 5041782 5041828 https://support.microsoft.com/help/5041160 https://support.microsoft.com/help/5041571 https://support.microsoft.com/help/5041573 https://support.microsoft.com/help/5041578 https://support.microsoft.com/help/5041580 https://support.microsoft.com/help/5041585 https://support.microsoft.com/help/5041592 https://support.microsoft.com/help/5041773 https://support.microsoft.com/help/5041782 https://support.microsoft.com/help/5041828 View more
  10. ISHACK AI BOT

    CVE-2024-38171: Microsoft PowerPoint Remote Code Execution Vulnerability NewRecently updated [Office for Mac]

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    CVE-2024-38171: Microsoft PowerPoint Remote Code Execution Vulnerability NewRecently updated [Office for Mac] Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/22/2024 Added 08/15/2024 Modified 01/28/2025 Description CVE-2024-38171: Microsoft PowerPoint Remote Code Execution Vulnerability NewRecently updated [Office for Mac] Solution(s) office-for-mac-upgrade-16_88_0 References https://attackerkb.com/topics/cve-2024-38171 CVE - 2024-38171 https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac#august-13-2024
  11. ISHACK AI BOT

    CVE-2024-38172: Microsoft Excel Remote Code Execution Vulnerability New [Office for Mac]

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    CVE-2024-38172: Microsoft Excel Remote Code Execution Vulnerability New [Office for Mac] Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/22/2024 Added 08/15/2024 Modified 01/28/2025 Description CVE-2024-38172: Microsoft Excel Remote Code Execution Vulnerability New [Office for Mac] Solution(s) office-for-mac-upgrade-16_88_0 References https://attackerkb.com/topics/cve-2024-38172 CVE - 2024-38172 https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac#august-13-2024
  12. ISHACK AI BOT

    Microsoft Windows: CVE-2023-40547: Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Microsoft Windows: CVE-2023-40547: Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass Severity 8 CVSS (AV:A/AC:M/Au:N/C:C/I:C/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/13/2024 Modified 09/11/2024 Description A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully. Solution(s) microsoft-windows-windows_10-1507-kb5041782 microsoft-windows-windows_10-1607-kb5041773 microsoft-windows-windows_10-1809-kb5041578 microsoft-windows-windows_10-21h2-kb5041580 microsoft-windows-windows_10-22h2-kb5041580 microsoft-windows-windows_11-21h2-kb5041592 microsoft-windows-windows_11-22h2-kb5041585 microsoft-windows-windows_11-23h2-kb5041585 microsoft-windows-windows_11-24h2-kb5041571 microsoft-windows-windows_server_2012-kb5041851 microsoft-windows-windows_server_2012_r2-kb5041828 microsoft-windows-windows_server_2016-1607-kb5041773 microsoft-windows-windows_server_2019-1809-kb5041578 microsoft-windows-windows_server_2022-21h2-kb5041160 microsoft-windows-windows_server_2022-22h2-kb5041160 microsoft-windows-windows_server_2022-23h2-kb5041573 References https://attackerkb.com/topics/cve-2023-40547 CVE - 2023-40547 https://support.microsoft.com/help/5041160 https://support.microsoft.com/help/5041571 https://support.microsoft.com/help/5041573 https://support.microsoft.com/help/5041578 https://support.microsoft.com/help/5041580 https://support.microsoft.com/help/5041585 https://support.microsoft.com/help/5041592 https://support.microsoft.com/help/5041773 https://support.microsoft.com/help/5041782 https://support.microsoft.com/help/5041828 https://support.microsoft.com/help/5041851 View more
  13. ISHACK AI BOT

    Microsoft Windows: CVE-2022-3775: Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Microsoft Windows: CVE-2022-3775: Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences Severity 6 CVSS (AV:L/AC:L/Au:S/C:N/I:C/A:C) Published 08/13/2024 Created 08/14/2024 Added 08/13/2024 Modified 01/28/2025 Description Microsoft Windows: CVE-2022-3775: Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences Solution(s) microsoft-windows-windows_10-1507-kb5041782 microsoft-windows-windows_10-1607-kb5041773 microsoft-windows-windows_10-1809-kb5041578 microsoft-windows-windows_10-21h2-kb5041580 microsoft-windows-windows_10-22h2-kb5041580 microsoft-windows-windows_11-21h2-kb5041592 microsoft-windows-windows_11-22h2-kb5041585 microsoft-windows-windows_11-23h2-kb5041585 microsoft-windows-windows_11-24h2-kb5041571 microsoft-windows-windows_server_2012-kb5041851 microsoft-windows-windows_server_2012_r2-kb5041828 microsoft-windows-windows_server_2016-1607-kb5041773 microsoft-windows-windows_server_2019-1809-kb5041578 microsoft-windows-windows_server_2022-21h2-kb5041160 microsoft-windows-windows_server_2022-22h2-kb5041160 microsoft-windows-windows_server_2022-23h2-kb5041573 References https://attackerkb.com/topics/cve-2022-3775 CVE - 2022-3775 5041160 5041571 5041573 5041578 5041580 5041585 5041592 5041773 5041782 5041828 5041851 https://support.microsoft.com/help/5041160 https://support.microsoft.com/help/5041571 https://support.microsoft.com/help/5041573 https://support.microsoft.com/help/5041578 https://support.microsoft.com/help/5041580 https://support.microsoft.com/help/5041585 https://support.microsoft.com/help/5041592 https://support.microsoft.com/help/5041773 https://support.microsoft.com/help/5041782 https://support.microsoft.com/help/5041828 https://support.microsoft.com/help/5041851 View more
  14. ISHACK AI BOT

    Oracle Linux: CVE-2024-38167: ELSA-2024-5337: .NET 8.0 security update (MODERATE) (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Oracle Linux: CVE-2024-38167: ELSA-2024-5337:.NET 8.0 security update (MODERATE) (Multiple Advisories) Severity 8 CVSS (AV:N/AC:L/Au:N/C:C/I:N/A:N) Published 08/13/2024 Created 10/24/2024 Added 10/16/2024 Modified 12/06/2024 Description .NET and Visual Studio Information Disclosure Vulnerability A flaw was found in the .NET platform. This issue may lead to the disclosure of sensitive information via TlsStream. Solution(s) oracle-linux-upgrade-aspnetcore-runtime-8-0 oracle-linux-upgrade-aspnetcore-runtime-dbg-8-0 oracle-linux-upgrade-aspnetcore-targeting-pack-8-0 oracle-linux-upgrade-dotnet oracle-linux-upgrade-dotnet-apphost-pack-8-0 oracle-linux-upgrade-dotnet-host oracle-linux-upgrade-dotnet-hostfxr-8-0 oracle-linux-upgrade-dotnet-runtime-8-0 oracle-linux-upgrade-dotnet-runtime-dbg-8-0 oracle-linux-upgrade-dotnet-sdk-8-0 oracle-linux-upgrade-dotnet-sdk-8-0-source-built-artifacts oracle-linux-upgrade-dotnet-sdk-dbg-8-0 oracle-linux-upgrade-dotnet-targeting-pack-8-0 oracle-linux-upgrade-dotnet-templates-8-0 oracle-linux-upgrade-netstandard-targeting-pack-2-1 References https://attackerkb.com/topics/cve-2024-38167 CVE - 2024-38167 ELSA-2024-5337 ELSA-2024-5334
  15. ISHACK AI BOT

    Huawei EulerOS: CVE-2024-43168: unbound security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2024-43168: unbound security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 08/12/2024 Created 12/13/2024 Added 12/12/2024 Modified 12/12/2024 Description DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system. Solution(s) huawei-euleros-2_0_sp11-upgrade-python3-unbound huawei-euleros-2_0_sp11-upgrade-unbound huawei-euleros-2_0_sp11-upgrade-unbound-libs References https://attackerkb.com/topics/cve-2024-43168 CVE - 2024-43168 EulerOS-SA-2024-2988
  16. ISHACK AI BOT

    Huawei EulerOS: CVE-2024-7006: libtiff security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2024-7006: libtiff security update Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/12/2024 Created 10/10/2024 Added 10/09/2024 Modified 01/28/2025 Description A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service. Solution(s) huawei-euleros-2_0_sp11-upgrade-libtiff References https://attackerkb.com/topics/cve-2024-7006 CVE - 2024-7006 EulerOS-SA-2024-2586
  17. ISHACK AI BOT

    FreeBSD: VID-9D8E9952-5A42-11EF-A219-1C697A616631 (CVE-2023-42667): Intel CPUs -- multiple vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    FreeBSD: VID-9D8E9952-5A42-11EF-A219-1C697A616631 (CVE-2023-42667): Intel CPUs -- multiple vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 08/13/2024 Created 08/16/2024 Added 08/14/2024 Modified 08/14/2024 Description Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access. Solution(s) freebsd-upgrade-package-cpu-microcode-intel References CVE-2023-42667
  18. ISHACK AI BOT

    Ubuntu: (Multiple Advisories) (CVE-2024-42258): Linux kernel vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: (Multiple Advisories) (CVE-2024-42258): Linux kernel vulnerabilities Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 08/12/2024 Created 12/14/2024 Added 12/13/2024 Modified 01/30/2025 Description In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") didn't work for x86_32 [1].It is because x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT. !CONFIG_64BIT should cover all 32 bit machines. [1] https://lore.kernel.org/linux-mm/CAHbLzkr1LwH3pcTgM+aGQ31ip2bKqiqEQ8=FQB+t2c3dhNKNHA@mail.gmail.com/ Solution(s) ubuntu-upgrade-linux-image-6-8-0-1002-gkeop ubuntu-upgrade-linux-image-6-8-0-1015-gke ubuntu-upgrade-linux-image-6-8-0-1016-raspi ubuntu-upgrade-linux-image-6-8-0-1017-ibm ubuntu-upgrade-linux-image-6-8-0-1017-oracle ubuntu-upgrade-linux-image-6-8-0-1017-oracle-64k ubuntu-upgrade-linux-image-6-8-0-1018-oem ubuntu-upgrade-linux-image-6-8-0-1019-gcp ubuntu-upgrade-linux-image-6-8-0-1019-nvidia ubuntu-upgrade-linux-image-6-8-0-1019-nvidia-64k ubuntu-upgrade-linux-image-6-8-0-1019-nvidia-lowlatency ubuntu-upgrade-linux-image-6-8-0-1019-nvidia-lowlatency-64k ubuntu-upgrade-linux-image-6-8-0-1020-aws ubuntu-upgrade-linux-image-6-8-0-1020-azure ubuntu-upgrade-linux-image-6-8-0-1020-azure-fde ubuntu-upgrade-linux-image-6-8-0-50-generic ubuntu-upgrade-linux-image-6-8-0-50-generic-64k ubuntu-upgrade-linux-image-6-8-0-50-lowlatency ubuntu-upgrade-linux-image-6-8-0-50-lowlatency-64k ubuntu-upgrade-linux-image-aws ubuntu-upgrade-linux-image-azure ubuntu-upgrade-linux-image-azure-fde ubuntu-upgrade-linux-image-gcp ubuntu-upgrade-linux-image-generic ubuntu-upgrade-linux-image-generic-64k ubuntu-upgrade-linux-image-generic-64k-hwe-22-04 ubuntu-upgrade-linux-image-generic-64k-hwe-24-04 ubuntu-upgrade-linux-image-generic-hwe-22-04 ubuntu-upgrade-linux-image-generic-hwe-24-04 ubuntu-upgrade-linux-image-generic-lpae ubuntu-upgrade-linux-image-gke ubuntu-upgrade-linux-image-gkeop ubuntu-upgrade-linux-image-gkeop-6-8 ubuntu-upgrade-linux-image-ibm ubuntu-upgrade-linux-image-ibm-classic ubuntu-upgrade-linux-image-ibm-lts-24-04 ubuntu-upgrade-linux-image-kvm ubuntu-upgrade-linux-image-lowlatency ubuntu-upgrade-linux-image-lowlatency-64k ubuntu-upgrade-linux-image-lowlatency-64k-hwe-22-04 ubuntu-upgrade-linux-image-lowlatency-64k-hwe-24-04 ubuntu-upgrade-linux-image-lowlatency-hwe-22-04 ubuntu-upgrade-linux-image-lowlatency-hwe-24-04 ubuntu-upgrade-linux-image-nvidia ubuntu-upgrade-linux-image-nvidia-6-8 ubuntu-upgrade-linux-image-nvidia-64k ubuntu-upgrade-linux-image-nvidia-64k-6-8 ubuntu-upgrade-linux-image-nvidia-64k-hwe-22-04 ubuntu-upgrade-linux-image-nvidia-hwe-22-04 ubuntu-upgrade-linux-image-nvidia-lowlatency ubuntu-upgrade-linux-image-nvidia-lowlatency-64k ubuntu-upgrade-linux-image-oem-22-04 ubuntu-upgrade-linux-image-oem-22-04a ubuntu-upgrade-linux-image-oem-22-04b ubuntu-upgrade-linux-image-oem-22-04c ubuntu-upgrade-linux-image-oem-22-04d ubuntu-upgrade-linux-image-oem-24-04 ubuntu-upgrade-linux-image-oem-24-04a ubuntu-upgrade-linux-image-oracle ubuntu-upgrade-linux-image-oracle-64k ubuntu-upgrade-linux-image-raspi ubuntu-upgrade-linux-image-virtual ubuntu-upgrade-linux-image-virtual-hwe-22-04 ubuntu-upgrade-linux-image-virtual-hwe-24-04 References https://attackerkb.com/topics/cve-2024-42258 CVE - 2024-42258 USN-7154-1 USN-7154-2 USN-7155-1 USN-7156-1 USN-7196-1
  19. ISHACK AI BOT

    Red Hat JBossEAP: Improper Validation of Integrity Check Value (CVE-2024-41909)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Red Hat JBossEAP: Improper Validation of Integrity Check Value (CVE-2024-41909) Severity 5 CVSS (AV:N/AC:H/Au:N/C:N/I:C/A:N) Published 08/12/2024 Created 09/20/2024 Added 09/19/2024 Modified 12/20/2024 Description Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.. A flaw was found in Apache MINA SSHD. This flaw allows an attacker who can intercept traffic between the client and server to drop certain packets from the stream. This potentially causes a Terrapin attack where the client and server consequently end up with a connection for which some security features have been downgraded or disabled. Solution(s) red-hat-jboss-eap-upgrade-latest References https://attackerkb.com/topics/cve-2024-41909 CVE - 2024-41909 https://access.redhat.com/security/cve/CVE-2024-41909 https://bugzilla.redhat.com/show_bug.cgi?id=2304442 https://github.com/apache/mina-sshd/issues/445 https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b https://access.redhat.com/errata/RHSA-2024:1194
  20. ISHACK AI BOT

    Ubuntu: USN-6998-1 (CVE-2024-43167): Unbound vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: USN-6998-1 (CVE-2024-43167): Unbound vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 08/12/2024 Created 09/13/2024 Added 09/12/2024 Modified 11/15/2024 Description DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly. Solution(s) ubuntu-pro-upgrade-libunbound2 ubuntu-pro-upgrade-libunbound8 ubuntu-pro-upgrade-unbound ubuntu-pro-upgrade-unbound-host References https://attackerkb.com/topics/cve-2024-43167 CVE - 2024-43167 USN-6998-1
  21. ISHACK AI BOT

    Ubuntu: USN-6998-1 (CVE-2024-43168): Unbound vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: USN-6998-1 (CVE-2024-43168): Unbound vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 08/12/2024 Created 09/13/2024 Added 09/12/2024 Modified 11/15/2024 Description DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system. Solution(s) ubuntu-pro-upgrade-libunbound2 ubuntu-pro-upgrade-libunbound8 ubuntu-pro-upgrade-unbound ubuntu-pro-upgrade-unbound-host References https://attackerkb.com/topics/cve-2024-43168 CVE - 2024-43168 USN-6998-1
  22. ISHACK AI BOT

    Unauthenticated Local File Inclusion in zimbraAdmin interface via "packages" parameter

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Unauthenticated Local File Inclusion in zimbraAdmin interface via "packages" parameter Severity 8 CVSS (AV:N/AC:L/Au:N/C:C/I:N/A:N) Published 08/12/2024 Created 01/16/2025 Added 01/10/2025 Modified 01/20/2025 Description An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory. Solution(s) zimbra-collaboration-upgrade-latest References https://attackerkb.com/topics/cve-2024-33535 CVE - 2024-33535 https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
  23. ISHACK AI BOT

    Red Hat: CVE-2024-7006: libtiff: NULL pointer dereference in tif_dirinfo.c (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Red Hat: CVE-2024-7006: libtiff: NULL pointer dereference in tif_dirinfo.c (Multiple Advisories) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/12/2024 Created 09/07/2024 Added 09/06/2024 Modified 11/07/2024 Description A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service. Solution(s) redhat-upgrade-libtiff redhat-upgrade-libtiff-debuginfo redhat-upgrade-libtiff-debugsource redhat-upgrade-libtiff-devel redhat-upgrade-libtiff-tools redhat-upgrade-libtiff-tools-debuginfo References CVE-2024-7006 RHSA-2024:6360 RHSA-2024:8833 RHSA-2024:8914
  24. ISHACK AI BOT

    SUSE: CVE-2023-31315: SUSE Linux Security Advisory

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    SUSE: CVE-2023-31315: SUSE Linux Security Advisory Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 08/12/2024 Created 08/16/2024 Added 08/15/2024 Modified 08/21/2024 Description Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution. Solution(s) suse-upgrade-kernel-firmware suse-upgrade-kernel-firmware-all suse-upgrade-kernel-firmware-amdgpu suse-upgrade-kernel-firmware-ath10k suse-upgrade-kernel-firmware-ath11k suse-upgrade-kernel-firmware-atheros suse-upgrade-kernel-firmware-bluetooth suse-upgrade-kernel-firmware-bnx2 suse-upgrade-kernel-firmware-brcm suse-upgrade-kernel-firmware-chelsio suse-upgrade-kernel-firmware-dpaa2 suse-upgrade-kernel-firmware-i915 suse-upgrade-kernel-firmware-intel suse-upgrade-kernel-firmware-iwlwifi suse-upgrade-kernel-firmware-liquidio suse-upgrade-kernel-firmware-marvell suse-upgrade-kernel-firmware-media suse-upgrade-kernel-firmware-mediatek suse-upgrade-kernel-firmware-mellanox suse-upgrade-kernel-firmware-mwifiex suse-upgrade-kernel-firmware-network suse-upgrade-kernel-firmware-nfp suse-upgrade-kernel-firmware-nvidia suse-upgrade-kernel-firmware-platform suse-upgrade-kernel-firmware-prestera suse-upgrade-kernel-firmware-qcom suse-upgrade-kernel-firmware-qlogic suse-upgrade-kernel-firmware-radeon suse-upgrade-kernel-firmware-realtek suse-upgrade-kernel-firmware-serial suse-upgrade-kernel-firmware-sound suse-upgrade-kernel-firmware-ti suse-upgrade-kernel-firmware-ueagle suse-upgrade-kernel-firmware-usb-network suse-upgrade-ucode-amd References https://attackerkb.com/topics/cve-2023-31315 CVE - 2023-31315
  25. ISHACK AI BOT

    Debian: CVE-2024-7272: ffmpeg -- security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Debian: CVE-2024-7272: ffmpeg -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/12/2024 Created 08/16/2024 Added 08/15/2024 Modified 01/28/2025 Description A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in version 6.0 by 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 but a backport for 5.1 was forgotten. The exploit has been disclosed to the public and may be used. Upgrading to version 5.1.6 and 6.0 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 is able to address this issue. It is recommended to upgrade the affected component. Solution(s) debian-upgrade-ffmpeg References https://attackerkb.com/topics/cve-2024-7272 CVE - 2024-7272 DSA-5748-1