SUSE-SU-2024:1807-1 Security update for git

This update for git fixes the following issues: - CVE-2024-32002: Fixed recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion bsc1224168. - CVE-2024-32004: Fixed arbitrary code execution during local clones bsc1224170. - CVE-2024-32020: Fix...

CVE-2024-35374

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sqlcase input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution RCE under certain conditions...

Traversal outside working tree enables arbitrary code execution

Summary During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. Details Although gix-worktree-state checks for collisions with existing files, it does not...

CVE-2023-52704 freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL

In the Linux kernel, the following vulnerability has been resolved: freezer,umh: Fix callusermodehelperexec vs SIGKILL Tetsuo-San noted that commit f5d39b020809 "freezer,sched: Rewrite core freezer logic" broke callusermodehelperexec for the KILLABLE case. Specifically it was missed that the...

SQL Injection

doctrine/orm is vulnerable to SQL Injection. The vulnerability is due to statements in the Where-Clause not being wrapped in brackets due to improper handling of case-insensitive checks, which allows an attacker to execute arbitrary SQL statements...

Exploit for Unrestricted Upload of File with Dangerous Type in Git

CVE-2024-32002: Exploiting Git RCE via git clone This repos...

DEBIAN-CVE-2024-35878

In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf In ofmodalias, we can get passed the str and len parameters which would cause a kernel oops in vsnprintf since it only allows passing a NULL ptr when the length is also 0...

Exploit for Unrestricted Upload of File with Dangerous Type in Git

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating...

CVE-2023-52679

In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in ofparsephandlewithargsmap In ofparsephandlewithargsmap the inner loop that iterates through the map entries calls ofnodeputnew to free the reference acquired by the previous iteration of the inner loop. Thi...

CVE-2023-52682 f2fs: fix to wait on block writeback for post_read case

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait on block writeback for postread case If inode is compressed, but not encrypted, it missed to call f2fswaitonblockwriteback to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fsgc -...

CVE-2023-52679 of: Fix double free in of_parse_phandle_with_args_map

In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in ofparsephandlewithargsmap In ofparsephandlewithargsmap the inner loop that iterates through the map entries calls ofnodeputnew to free the reference acquired by the previous iteration of the inner loop. Thi...

[slackware-security] git

New git packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/git-2.39.4-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Recursive clones on case-insensitive filesystems that suppor...

GHSA-VJRG-WPM8-RHRW doctrine/orm Regression in Query Parenthesis can have Security Implications

An issue identified in doctrine/orm project related to statement in Where-Clause were not wrapped in brackets due to improper hadandling of case insensitive check...

easyadmin-extension-bundle action case insensitivity

In alterphp/easyadmin-extension-bundle, role based access rules do not handle action name case sensitivity which may lead to unauthorized access...

easyadmin-extension-bundle action case insensitivity

In alterphp/easyadmin-extension-bundle, role based access rules do not handle action name case sensitivity which may lead to unauthorized access...

PT-2024-40038 · Unknown · Alterphp/Easyadmin-Extension-Bundle

Name of the Vulnerable Software and Affected Versions: alterphp/easyadmin-extension-bundle affected versions not specified Description: The issue concerns role-based access rules not handling action name case sensitivity, potentially leading to unauthorized access. Recommendations: At the moment,...

CVE-2024-4738

A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument newclient leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to...

CVE-2024-4738

A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument newclient leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to...

CVE-2024-4737

A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vendor. The manipulation of the argument companyname/mobile leads to cross site scripting. It is possible to initiate the attack remotely...

CVE-2024-4737

A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vendor. The manipulation of the argument companyname/mobile leads to cross site scripting. It is possible to initiate the attack remotely...