DEBIAN-CVE-2024-26862

In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignoreoutgoing ignoreoutgoing is read locklessly from devqueuexmitnit and packetgetsockopt Add appropriate READONCE/WRITEONCE annotations. syzbot reported: BUG: KCSAN: data-race in devqueuexmitn...

CVE-2024-32518

Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0...

CVE-2024-32518

CVE-2024-32518 is a Missing Authorization vulnerability affecting PeproDev Ultimate Invoice (WordPress plugin). Public details indicate impact on PeproDev Ultimate Invoice versions up to 2.0.0. Red Hat and Wordfence entries corroborate the vulnerability and note it has been patched; specific fixe...

SUSE CVE-2024-26791

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

Ubuntu 20.04 LTS / 22.04 LTS : NSS regression (USN-6727-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6727-2 advisory. USN-6727-1 fixed vulnerabilities in NSS. The update introduced a regression when trying to load security modules on Ubuntu 20.04 LTS and Ubuntu 22.04...

PT-2024-24092 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.17-dev Description: The issue is a Server-Side Request Forgery SSRF vulnerability that may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized...

Plane 安全漏洞

Plane is an open source, self-hosted project planning tool from Plane Open Source. A security vulnerability exists in versions prior to Plane 0.17-dev, which stems from a vulnerability that allows an attacker to send arbitrary requests to the server hosting the application, resulting in...

CLSA-2024-1712672279 grub2: Fix of CVE-2023-4001

Fix CVE-2023-4001: add --root-dev-only flag to force only search root dev the grub2 configuration file /boot/efi/EFI/almalinux/grub.cfg should be removed manually BEFORE grub2 updating...

Debian dla-3739 : libjwt-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3739 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3739-1 [email protected] https://www.debian.org/lts/security/...

PT-2024-4072 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: qdrant/qdrant version 1.9.0-dev Description: The issue is related to improper input validation in the "/collections/name/snapshots/upload" endpoint, allowing for path traversal. By manipulating the name parameter through URL encoding, an...

CVE-2024-26791

A vulnerability was found in the Linux kernel's btrfs filesystem related to the dev-replace feature. The issue stems from inadequate validation of device names. This flaw could allow an attacker unauthorized access or manipulation of devices, impacting the system's security. Mitigation Mitigation...

DEBIAN-CVE-2024-26791

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

CVE-2024-26791

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

UBUNTU-CVE-2024-26791

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

CVE-2024-26804

CVE-2024-26804 affects the Linux kernel's IP tunnel infrastructure. The issue arises when packets are routed through a GRE tunnel and then encapsulated again (via ip_tunnel_xmit/ipip_tunnel_xmit), causing gre0 and ipip0 to inflate dev->needed_headroom iteratively. The neigh layer pulls skb wit...

CVE-2024-26791 btrfs: dev-replace: properly validate device names

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

CVE-2024-26791

CVE-2024-26791 — Linux kernel: btrfs dev-replace: properly validate device names. A syzbot report indicated device name buffers passed to device replace could read beyond end (getname_kernel) due to insufficient termination checks. The fix adds a helper that validates both source and target devic...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from btrfs dev-replace not properly validating device names, which could lead to out-of-bounds reads...

USN-6658-1: libxml2 vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libxml2 incorrectly handled certain XML documents. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute...

GHSA-8JHW-289H-JH2G Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...