SUSE CVE-2024-49880

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off by one issue in allocflexgd Wesley reported an issue: ================================================================== EXT4-fs dm-5: resizing filesystem from 7168 to 786432 blocks ------------ cut here -----------...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Set Background option in the Manage Custom Maps section, by uploading a malicious SV...

Race Condition

Overview terra-notebook-utils is an Utilities for the Terra notebook environment. Affected versions of this package are vulnerable to Race Condition in task submission due to improper thread synchronization. The issue could lead to crashes or inconsistent task states when tasks are submitted from...

PT-2024-32641

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 24.9.0 Description Stored Cross-Site Scripting XSS can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, allowing the upload of SVG files that ca...

Cross-site Scripting (XSS)

Concrete CMS is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper validation in the Image Editor's background color feature, allowing a rogue admin to inject malicious code into the Thumbnails/Add-Type function...

CVE-2024-8291: Improper Limitation of a Pathname to a Restricted Directory

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the Thumbnails/Add-Type interface in "Image Editor Background Color". An attacker with administrator privileges could add malicious code to the interface by adding a specially crafted background color value...

CVE-2024-8291

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector...

CVE-2024-8291

Concrete CMS stores stored XSS in the Image Editor background color feature (Thumbnails/Add-Type). Affected versions are 9.0.0–9.3.3 and below 8.5.19. The root cause is input that can inject malicious code via the Background Color field, exploitable by a rogue admin (privileges HIGH, UI not requi...

PT-2024-38919 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.3.3 Concrete CMS versions below 8.5.19 Description: The issue concerns Stored XSS in the Image Editor Background Color, where a rogue admin could add malicious code to the Thumbnails/Add-Type. This could...

100 million+ US citizens have records leaked by background check service

A background check left a huge database unprotected online containing 2.2TB of people's data, according to research by Cybernews. The database was left passwordless and easily accessible to anyone on the internet by background check firm MC2 Data. MC2 Data gathers publicly available data to provi...

Security Problem in Web Browser Permission Mechanism

Overview A research team of Waseda University and NTT Social Informatics Laboratories conducted a systematic analysis of the permission mechanisms of 5 different Operating Systems both mobile and desktop OS and 22 major browsers running on each OS. The results show that they have multiple problem...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that stems from the bindAndGetCallIdentification method in the CallScreeningServiceHelper.java file contains a privilege bypass with a possible wa...

PT-2024-9166 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.10 Nextcloud Server versions prior to 29.0.7 Nextcloud Server versions prior to 30.0.0 Description: The issue is related to the use of a reversible one-way hash function in Nextcloud Server, which...

CVE-2024-34637

Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34637: Undefined Security Weakness

Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background...

PT-2024-26055

Name of the Vulnerable Software and Affected Versions Android 12 versions prior to SMR Sep-2024 Release 1 Android 13 versions prior to SMR Jun-2024 Release 1 Android 14 versions prior to SMR Jun-2024 Release 1 Description The issue is related to improper access control in the WindowManagerService...

OpenHarmony 安全漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation OpenAtom Foundation Foundation. A security vulnerability exists in OpenHarmony version v4.0.0 and prior versions, which stems from a background task management privilege bypass vulnerability...

ASB-A-300904123

In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2024-44942

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on F2FSINLINEDATA flag in inode during GC syzbot reports a f2fs bug as below: ------------ cut here ------------ kernel BUG at fs/f2fs/inline.c:258! CPU: 1 PID: 34 Comm: kworker/u8:2 Not tainted...