CVE-2024-1010
published 2024-01-29CVE-2024-1010: A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.57%
43.4th percentile
A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file edit-profile.php. The manipulation of the argument fullname/phone/date of birth/address/date of appointment leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252279.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| employee_management_system_project | employee_management_system | — | — |
| sourcecodester | employee_management_system | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Kernel
Merge branch 'tap-tun-harden-by-dropping-short-frame'
kernel_security·2024-07-25·CVSS 7.1
CVE-2024-41090 [HIGH] Merge branch 'tap-tun-harden-by-dropping-short-frame'
Merge branch 'tap-tun-harden-by-dropping-short-frame'
Dongli Zhang says:
tap/tun: harden by dropping short frame
This is to harden all of tap/tun to avoid any short frame smaller than the
Ethernet header (ETH_HLEN).
While the xen-netback already rejects short frame smaller than ETH_HLEN ...
914 static void xenvif_tx_build_gops(struct xenvif_queue *queue,
915 int budget,
916 unsigned *copy_ops,
917 unsigned *map_ops)
918 {
... ...
1007 if (unlikely(txreq.size vif->dev,
1009 "Bad packet size: %d\n", txreq.size);
1010 xenvif_tx_err(queue, &txreq, extra_count, idx);
1011 break;
1012 }
... the short frame may not be dropped by vhost-net/tap/tun.
This fixes CVE-2024-41090 and CVE-2024-41091.
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jaku
GHSA
GHSA-c822-34mg-g7p6: A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1
ghsa_unreviewed·2024-01-29
CVE-2024-1010 [MEDIUM] CWE-79 GHSA-c822-34mg-g7p6: A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1
A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file edit-profile.php. The manipulation of the argument fullname/phone/date of birth/address/date of appointment leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252279.
Red Hat
kernel: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2024-49919 [MEDIUM] CWE-476 kernel: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
kernel: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
This commit addresses a potential null pointer dereference issue in the
`dcn201_acquire_free_pipe_for_layer` function. The issue could occur
when `head_pipe` is null.
The fix adds a check to ensure `head_pipe` is not null before asserting
it. If `head_pipe` is null, the function returns NULL to prevent a
potential null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016 dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe' could be null (see line 1010)
Pack
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/jomskiller/Employee-Management-System---Stored-XSShttps://github.com/jomskiller/Employee-Management-System---Stored-XSS/https://vuldb.com/?ctiid.252279https://vuldb.com/?id.252279https://github.com/jomskiller/Employee-Management-System---Stored-XSShttps://github.com/jomskiller/Employee-Management-System---Stored-XSS/https://vuldb.com/?ctiid.252279https://vuldb.com/?id.252279
2024-01-29
Published