An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r4p0 through r32p0, Bifrost r1p0 through r40p0, and Valhall r19p0 through r40P0.
Вольный перевод статьи на ресурсе threedots.tech от Robert Laszczak - главного инженера в SlashID, сооснователя Three Dots Labs и создателя популярной Golang-библиотеки Watermill.На протяжении некоторого времени я занимался руководством группы Go-разработчиков и одним из самых распространенных вопросов от начинающих специалистов был - "Какой фреймворк мне следует использовать?". Читать далее
Всем привет! Я - Kekovsky, инженер-любитель, до этого публиковался на некоторых других платформах. Решил попробовать себя здесь, если статья понравится, будет продолжение. В этой статье мы изучим работу с микросхемой EEPROM 93C76, рассмотрим обращение к ней по шине SPI, напишем функции чтения, стирания и записи данных. Читать далее
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.
Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.
The WooCommerce Shipping WordPress plugin through 1.2.11 does not have authorisation and CRSF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin's Twilio integration to send SMSes to arbitrary phone numbers.
The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.