CVE-2024-4337
published 2024-04-30CVE-2024-4337: Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the…
PriorityP432high7.4CVSS 3.1
AVNACLPRNUIRSCCHINAN
EPSS
0.38%
30.1th percentile
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adive | adive_framework | — | — |
| adive | framework | — | — |
| linux | linux_kernel | >= 0 < 6.1.90-1 | 6.1.90-1 |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-35928: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
Thi
osv·2024-05-19
CVE-2024-35928 CVE-2024-35928: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
Thi
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
This ensures that the memory mapped by ioremap for adev->rmmio, is
properly handled in amdgpu_device_init(). If the function exits early
due to an error, the memory is unmapped. If the function completes
successfully, the memory remains mapped.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn: 'adev->rmmio' from ioremap() not released on lines: 4035,4045,4051,4058,4068,4337
GHSA
GHSA-qrx5-m699-v9jg: Adive Framework 2
ghsa_unreviewed·2024-04-30
CVE-2024-4337 [HIGH] CWE-79 GHSA-qrx5-m699-v9jg: Adive Framework 2
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-30
Published