-
CVE-2024-39309: prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. (3-Jul-2024)
Preface: Parse was founded in 2011 by Tikhon Bernstam, Ilya Sukhar, James Yu, and Kevin Lacker, previously at Google and Y Combinator. An open source backend-as-a-service (BaaS) framework originally developed by Facebook. On January 28, 2016, Facebook open sourced the Parse Platform and announced that it would shut down the Parse hosting service. However, the…
-
CVE-2024-20081: Out-of-bounds write in gnss, response by Mediatek security advisory. (2nd July 2024)
Preface: GPS traditionally refers to the North American Global Positioning System, or satellite positioning system. GNSS is the term for the international multi-constellation satellite system. Therefore, GNSS typically includes GPS, GLONASS, Baidu, Galileo, and any other constellation system. Background: GNSS positioning modules or chips, as the core component of In-vehicle Infotainment systems, provide position, speed,…
-
CVE-2024-37371: About MIT Kerberos 5 (2nd July 2024)
Preface: Kerberos is built into all major operating systems, including those from Microsoft, Apple, Red Hat, and Sun. Kerberos is the authentication mechanism for some devices like Microsoft Active Directory and even X-Box. LDAP is primarily used for managing and accessing directories, while Kerberos is designed to provide security authentication for client/server applications. Background: MIT…
-
About CVE-2024-37571: SAS: Data and AI Solutions (SAS Broker – V9.2, build 1495) 26-June-2024
Preface: What’s required to create good machine learning systems? -Data preparation capabilities. -Algorithms – basic and advanced. -Automation and iterative processes. -Scalability. -Ensemble modeling. Did you know? -In machine learning, a target is called a label. -In statistics, a target is called a dependent variable. -A variable in statistics is called a feature in machine…
-
About CVE-2024-38952 on PX4-Autopilot v1.14.3 (27 June 2024)
Preface: The PX4 is a professional autopilot. Developed by world-class developers from industry and academia and supported by an active worldwide community, it powers a variety of vehicles from racing and cargo drones to ground vehicles and submersibles. Background: What is needed to control a drone using PX4 flight controller? -A computer with Internet Access.…
-
CVE-2024-38663: blk-cgroup – fix list corruption from resetting io stat (25-June-2024)
Preface: Android uses cgroups to control and account for system resources such as CPU and memory usage and allocation, with support for Linux kernel cgroups v1 and cgroups v2. Background: New IO stats are stored in the percpu iostat_cpu within blkcg_gq (blkg). There are multiple blkg’s (one for each block device) attached to each blkcg.…
-
About LoLLMS WebUI: CVE-2024-5443 design flaw related to CVE-2024-4320 (NVD Last Modified: 06/24/2024)
Preface: Large language models (LLM) are very large deep learning models that are pre-trained on vast amounts of data. The underlying transformer is a set of neural networks that consist of an encoder and a decoder with self-attention capabilities. The key feature of a multimodal model is its ability to integrate and interpret information from…
-
CVE-2024-36532: Insecure permissions in kruise v1.6.2 (21 June 2024)
Preface: CNCF (Cloud Native Computing Foundation) is the open source, vendor-neutral hub of cloud native computing, hosting projects like Kubernetes and Prometheus to make cloud native universal and sustainable. Background: OpenKruise is a suite of extension components for Kubernetes that focuses on automated management of large-scale applications, such as deployment, upgrades, maintenance, and availability protection.…
-
CVE-2024-36680: Improper neutralization of SQL parameter in Promokit[.]eu – Facebook module for PrestaShop (20-June-2024)
Preface: PrestaShop is an open source e-commerce platform that emerged in 2007. It’s still widely used today—more than 250,000 devices are powered by it. The goal of PrestaShop Facebook is to promote e-commerce sales on Facebook and Instagram social networks. Background: E-commerce web designers need to create our modules folder in the root directory of…
-
CVE-2024-36977: usb: dwc3: Wait unconditionally after issuing EndXfer command (19 June 2024)
Preface: The DWC3 is Synopsys IP providing a SuperSpeed USB 3.0 controller. This Synopsys DesignWare USB3 controller IP has proved to be very popular and is in use ranging from various Arm SoCs from Samsung and TI to Qualcomm platforms. DWC3 is also used by various platforms from both Intel and AMD. Background: EN_ENDXFER_ON_RJCT_STRM: Enable…