CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6258 – BT: Missing length checks of net_buf in rfcomm_handle_data
https://notcve.org/view.php?id=CVE-2024-6258
BT: Missing length checks of net_buf in rfcomm_handle_data • https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7833-fcpm-3ggm • CWE-20: Improper Input Validation CWE-122: Heap-based Buffer Overflow CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-43816 – scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages
https://notcve.org/view.php?id=CVE-2024-43816
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages On big endian architectures, it is possible to run into a memory out of bounds pointer dereference when FCP targets are zoned. In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is referencing a little endian formatted sgl->sge_len value. • https://git.kernel.org/stable/c/af20bb73ac2591631d504f3f859f073bcdb7e11e https://git.kernel.org/stable/c/9fd003f344d502f65252963169df3dd237054e49 https://git.kernel.org/stable/c/8bc7c617642db6d8d20ee671fb6c4513017e7a7e •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32038 – Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-32038
Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2. Wazuh es una plataforma gratuita y de código abierto que se utiliza para la prevención, detección y respuesta a amenazas. • https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327 • CWE-122: Heap-based Buffer Overflow •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23818 – GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format
https://notcve.org/view.php?id=CVE-2024-23818
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap OpenLayers Output Format. Access to the WMS OpenLayers Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Versions 2.23.3 and 2.24.1 contain a patch for this issue. GeoServer es un servidor de software de código abierto escrito en Java que permite a los usuarios compartir y editar datos geoespaciales. • https://github.com/geoserver/geoserver/commit/4557a832eed19ec18b9753cb97e8aa85269741d2 https://github.com/geoserver/geoserver/commit/a26c32a469ee4c599236380452ffb4260361bd6f https://github.com/geoserver/geoserver/pull/7174 https://github.com/geoserver/geoserver/security/advisories/GHSA-fcpm-hchj-mh72 https://osgeo-org.atlassian.net/browse/GEOS-11153 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25811 – Persistent Cross site scripting (XSS) in Uptime Kuma
https://notcve.org/view.php?id=CVE-2023-25811
Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/louislam/uptime-kuma/security/advisories/GHSA-553g-fcpf-m3wp • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •