CVE-2024-50259 netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsimnexthopbucketactivitywrite This was found by a static analyzer. We should not forget the trailing zero after copyfromuser if we will further do some string operations,...

CVE-2024-50259 netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()

In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsimnexthopbucketactivitywrite This was found by a static analyzer. We should not forget the trailing zero after copyfromuser if we will further do some string operations,...

CVE-2024-50259

CVE-2024-50259 affects the Linux kernel via the netdevsim component. The issue is caused by missing a trailing NUL after copy_from_user() in nsim_nexthop_bucket_activity_write(), which could affect string handling in that function. A fix adds the trailing zero to ensure proper operation. The CVE ...

CVE-2024-10081

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints includ...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

PYSEC-2024-238

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints includ...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

CVE-2024-10082

Summary (CVE-2024-10082) CodeChecker (Clang Static Analyzer/Tidy tooling) up to version 6.24.1 contains an authentication flaw: an auto-generated built-in root user with superuser permissions that cannot be disabled. An attacker who can create an account on an enabled external authentication serv...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

CVE-2024-10081

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints includ...

BIT-GITLAB-2022-4315

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page...

PT-2024-10165 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.0.0-00 through 11.0.3-00 Hitachi Infrastructure Analytics Advisor versions 2.1.0-00 through 4.4.0-00 Description: The issue is related to an authentication bypass, which may allow a remote attacker to...

This Week in Spring - October 15th, 2024

Hi, Spring fans! Welcome to another rip-roaring and ever-so-riveting installment of This Week in Spring! I'm in Amsterdam, at the moment, rounding out a week between Antwerp, Beglium, and Amsterdam, the Netherlands. Today I'm off to Dubai for the fantastic GITEX/DevSlam event. Then I return back ...

The vulnerability of the MPI process tracing tools Intel Trace Analyzer and Collector lies in the uncontrolled element of the search path, which allows attackers to exploit their privileges.

The vulnerability of the MPI process tracing tools Intel Trace Analyzer and Collector is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20241001-08

Vulnerability of SPRT dissector of Wireshark computer network traffic analyzer related to access to an uninitialized pointer. uninitialized pointer. Exploitation of the vulnerability could allow an attacker to cause a denial of denial of service via packet injection or a specially crafted capture...

[SECURITY] [DLA 3906-1] wireshark security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3906-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 30, 2024 https://wiki.debian.org/LTS -...

Debian dla-3906 : libwireshark-data - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3906 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3906-1 [email protected]...

MAL-2024-9021 Malicious code in algolia-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e9938b498a630cfc9745cf7083809d4bc8477a92664b7f56c0b41b82f0d30e4 The OpenSSF Package Analysis project identified 'algolia-analyzer' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in algolia-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e9938b498a630cfc9745cf7083809d4bc8477a92664b7f56c0b41b82f0d30e4 The OpenSSF Package Analysis project identified 'algolia-analyzer' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

The vulnerability of the SPP analyzer in the software environment of the simulation model for systems and processes in Siemens Tecnomatix Plant Simulation allows a perpetrator to execute arbitrary code.

The vulnerability of the SPP analyzer in the simulation modeling environment of Siemens Tecnomatix Plant Simulation relates to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted SPP file...