PT-2024-1515 · Qnap · Qts +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.4.2596 build 20231128 QTS versions prior to 4.5.4.2627 build 20231225 QuTS hero versions prior to h5.1.4.2596 build 20231128 QuTS hero versions prior to h4.5.4.2626 build 20231225 QuTScloud versions prior to...

CVE-2023-46231

In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on...

SUSE-SU-2024:0266-1 Security update for xen

This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851 - CVE-2023-46840: Fixed VT-d: Failure to quarantine devices in !HVM builds XSA-450 bsc1219080...

VT-d: Failure to quarantine devices in !HVM builds

ISSUE DESCRIPTION Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen. IMPACT When a device is removed from a domain, it is not properly quarantined and retains its access to the domain...

kernel: objtool: Fix SEGFAULT

A NULL pointer dereference was found in objtool, a build-time tool used during Linux kernel compilation. When findinsn returns NULL on failure, the code proceeds to dereference the NULL pointer, causing objtool to crash with a segmentation fault during kernel build operations...

Jenkins Plugin GitLab Branch Source Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

python-eventlet: patch regression for CVE-2021-21419 in some Red Hat builds

A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products...

AZL-39556 CVE-2022-36765 affecting package edk2 for versions less than 20230301gitf80f052277c8-40

EDK2 is susceptible to a vulnerability in the CreateHob function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability...

DEBIAN-CVE-2023-35992

An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

UBUNTU-CVE-2023-35992

An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

Design/Logic Flaw

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-4466

A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. Th...

CVE-2023-4466

CVE-2023-4466 affects Poly CCX 400/600, Trio 8800/C60 Web Interface. The vulnerability in the Web Interface enables remote manipulation that causes protection mechanism failure. No explicit patch is provided; remediation involves removing vulnerable builds from public servers. Exploit has been di...

Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

PT-2023-31781 · Unknown · Nbviewer-App

Name of the Vulnerable Software and Affected Versions: nbviewer-app aka Jupyter Notebook Viewer versions prior to 0.1.6 Description: The issue is related to the get-task-allow entitlement for release builds, which can lead to code execution due to an improperly set entitlement. The developer has...

CVE-2023-43116: Improper Link Resolution Before File Access

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43116

Buildkite Elastic CI for AWS is affected by a symbolic link following vulnerability in versions prior to 6.7.1 and 5.22.5. The issue lets the buildkite-agent user change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script. Affecte...