Security Warnings — Week: 2024-W15

Palo Alto Networks PAN-OS Command Injection Vulnerability

2024-04-12 CVE-2024-3400

criticalPalo Alto Networks CVE 2024-W15

D-Link Multiple NAS Devices Command Injection Vulnerability

2024-04-11 CVE-2024-3273

highD-Link CVE 2024-W15

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

2024-04-11 CVE-2024-3272

highD-Link CVE 2024-W15

Red Hat Enterprise Linux (libmaxminddb): Schwachstelle ermöglicht Denial of Service

2024-04-11 CVE-2020-28241

mediumBSI 2024-W15

Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix

2024-04-09 CVE-2024-2756

mediumMicrosoft MSRC 2024-W15

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

2024-04-09 CVE-2024-21409

highMicrosoft MSRC 2024-W15

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave so

2024-04-09 CVE-2024-27983

highMicrosoft MSRC 2024-W15

aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts

2024-04-09 CVE-2024-26898

highMicrosoft MSRC 2024-W15

Apache HTTP Server: HTTP response splitting

2024-04-09 CVE-2023-38709

highMicrosoft MSRC 2024-W15

Apache HTTP Server: HTTP Response Splitting in multiple modules

2024-04-09 CVE-2024-24795

mediumMicrosoft MSRC 2024-W15

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

2024-04-09 CVE-2024-27316

highMicrosoft MSRC 2024-W15

Arbitrary code injection vulnerability in Keras framework < 2.13

2024-04-09 CVE-2024-3660

criticalMicrosoft MSRC 2024-W15

Azure AI Search Information Disclosure Vulnerability

2024-04-09 CVE-2024-29063

highMicrosoft MSRC 2024-W15

Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

2024-04-09 CVE-2024-28917

mediumMicrosoft MSRC 2024-W15

Azure Compute Gallery Elevation of Privilege Vulnerability

2024-04-09 CVE-2024-21424

mediumMicrosoft MSRC 2024-W15

Azure CycleCloud Elevation of Privilege Vulnerability

2024-04-09 CVE-2024-29993

highMicrosoft MSRC 2024-W15

Azure Identity Library for .NET Information Disclosure Vulnerability

2024-04-09 CVE-2024-29992

mediumMicrosoft MSRC 2024-W15

Azure Migrate Remote Code Execution Vulnerability

2024-04-09 CVE-2024-26193

mediumMicrosoft MSRC 2024-W15

Azure Monitor Agent Elevation of Privilege Vulnerability

2024-04-09 CVE-2024-29989

highMicrosoft MSRC 2024-W15

Azure Private 5G Core Denial of Service Vulnerability

2024-04-09 CVE-2024-20685

mediumMicrosoft MSRC 2024-W15

BitLocker Security Feature Bypass Vulnerability

2024-04-09 CVE-2024-20665

mediumMicrosoft MSRC 2024-W15

blk-mq: fix IO hang from sbitmap wakeup race

2024-04-09 CVE-2024-26671

mediumMicrosoft MSRC 2024-W15

Bluetooth: af_bluetooth: Fix deadlock

2024-04-09 CVE-2024-26886

mediumMicrosoft MSRC 2024-W15

Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security

2024-04-09 CVE-2024-26903

mediumMicrosoft MSRC 2024-W15

bpf: Fix DEVMAP_HASH overflow check on 32-bit arches

2024-04-09 CVE-2024-26885

highMicrosoft MSRC 2024-W15

bpf: Fix hashtab overflow check on 32-bit arches

2024-04-09 CVE-2024-26884

highMicrosoft MSRC 2024-W15

bpf: Fix stackmap overflow check on 32-bit arches

2024-04-09 CVE-2024-26883

highMicrosoft MSRC 2024-W15

btrfs: don't drop extent_map for free space inode on write error

2024-04-09 CVE-2024-26726

mediumMicrosoft MSRC 2024-W15

Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

2024-04-09 CVE-2024-3177

lowMicrosoft MSRC 2024-W15

cifs: fix underflow in parse_server_interfaces()

2024-04-09 CVE-2024-26828

mediumMicrosoft MSRC 2024-W15

Command injection via array-ish $command parameter of proc_open()

2024-04-09 CVE-2024-1874

criticalMicrosoft MSRC 2024-W15

Cri-o: arbitrary command injection via pod annotation

2024-04-09 CVE-2024-3154

highMicrosoft MSRC 2024-W15

crypto: arm64/neonbs - fix out-of-bounds access on short input

2024-04-09 CVE-2024-26789

highMicrosoft MSRC 2024-W15

DHCP Server Service Denial of Service Vulnerability

2024-04-09 CVE-2024-26212

highMicrosoft MSRC 2024-W15

DHCP Server Service Denial of Service Vulnerability

2024-04-09 CVE-2024-26215

highMicrosoft MSRC 2024-W15

DHCP Server Service Remote Code Execution Vulnerability

2024-04-09 CVE-2024-26195

highMicrosoft MSRC 2024-W15

DHCP Server Service Remote Code Execution Vulnerability

2024-04-09 CVE-2024-26202

highMicrosoft MSRC 2024-W15

dm-crypt, dm-verity: disable tasklets

2024-04-09 CVE-2024-26718

mediumMicrosoft MSRC 2024-W15

do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak

2024-04-09 CVE-2024-26901

mediumMicrosoft MSRC 2024-W15

drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

2024-04-09 CVE-2024-26661

mediumMicrosoft MSRC 2024-W15

drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

2024-04-09 CVE-2024-26662

mediumMicrosoft MSRC 2024-W15

drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr

2024-04-09 CVE-2024-26699

highMicrosoft MSRC 2024-W15

drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue

2024-04-09 CVE-2024-26913

highMicrosoft MSRC 2024-W15

drm/amd/display: Fix disable_otg_wa logic

2024-04-09 CVE-2023-52634

mediumMicrosoft MSRC 2024-W15

drm/amd/display: fix incorrect mpc_combine array size

2024-04-09 CVE-2024-26914

mediumMicrosoft MSRC 2024-W15

drm/amd/display: fixed integer types and null check locations

2024-04-09 CVE-2024-26767

mediumMicrosoft MSRC 2024-W15

drm/amdgpu: fix use-after-free bug

2024-04-09 CVE-2024-26656

mediumMicrosoft MSRC 2024-W15

drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'

2024-04-09 CVE-2024-26672

highMicrosoft MSRC 2024-W15

drm/amdkfd: Fix lock dependency warning with srcu

2024-04-09 CVE-2023-52632

mediumMicrosoft MSRC 2024-W15

drm/gma500: Fix WARN_ON(lock->magic != lock) error

2024-04-09 CVE-2022-48633

lowMicrosoft MSRC 2024-W15

Excessive time spent checking invalid RSA public keys

2024-04-09 CVE-2023-6237

mediumMicrosoft MSRC 2024-W15

f2fs: fix to truncate meta inode pages forcely

2024-04-09 CVE-2024-26869

mediumMicrosoft MSRC 2024-W15

firmware: arm_scmi: Fix double free in SMC transport cleanup path

2024-04-09 CVE-2024-26893

mediumMicrosoft MSRC 2024-W15

fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

2024-04-09 CVE-2024-26686

mediumMicrosoft MSRC 2024-W15

fsdax: Fix infinite loop in dax_iomap_rw()

2024-04-09 CVE-2022-48635

mediumMicrosoft MSRC 2024-W15

gix-transport indirect code execution via malicious username

2024-04-09 CVE-2024-32884

mediumMicrosoft MSRC 2024-W15

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free con

2024-04-09 CVE-2024-2312

mediumMicrosoft MSRC 2024-W15

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

2024-04-09 CVE-2024-3817

criticalMicrosoft MSRC 2024-W15

HID: nvidia-shield: Add missing null pointer checks to LED initialization

2024-04-09 CVE-2024-26770

mediumMicrosoft MSRC 2024-W15

HTTP.sys Denial of Service Vulnerability

2024-04-09 CVE-2024-26219

highMicrosoft MSRC 2024-W15