CVE-2024-1198
published 2024-02-03CVE-2024-1198: A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file…
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.73%
49.6th percentile
A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbi | openbi | — | — |
| openbi | openbi | — | — |
| openbi | openbi | — | — |
| openbi | openbi | — | — |
| openbi | openbi | 6.0.0 – 6.0.3 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-25c3-4v7x-3hrp: A vulnerability, which was classified as critical, was found in openBI up to 6
ghsa_unreviewed·2024-02-03
CVE-2024-1198 [MEDIUM] CWE-502 GHSA-25c3-4v7x-3hrp: A vulnerability, which was classified as critical, was found in openBI up to 6
A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.
Red Hat
kernel: LoongArch: Disable IRQ before init_fn() for nonboot CPUs
vendor_redhat·2024-04-03·CVSS 5.5
CVE-2024-26765 [MEDIUM] CWE-20 kernel: LoongArch: Disable IRQ before init_fn() for nonboot CPUs
kernel: LoongArch: Disable IRQ before init_fn() for nonboot CPUs
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Disable IRQ before init_fn() for nonboot CPUs
Disable IRQ before init_fn() for nonboot CPUs when hotplug, in order to
silence such warnings (and also avoid potential errors due to unexpected
interrupts):
WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:4503 rcu_cpu_starting+0x214/0x280
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198
pc 90000000048e3334 ra 90000000047bd56c tp 900000010039c000 sp 900000010039fdd0
a0 0000000000000001 a1 0000000000000006 a2 900000000802c040 a3 0000000000000000
a4 0000000000000001 a5 0000000000000004 a6 0000000000000000 a7 90000000048e3f4c
t0 0000000000000001 t1 9000000005c70968 t2 0000000004000000 t3 000000000005e5
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-03
Published