Malicious code in commitlint-config-marketing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a396bd7999449041603f8b1308e46dd3e47939209a438a8ce799dfa3e6406d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 41 : webkitgtk (2024-b142cc07d0)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b142cc07d0 advisory. Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent fi...

Malicious code in item-card-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006fe1ad3ce02c3601d3fc25ac4e132de1092b4bd43cf8011efdfb6aaa0c894c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10672 Malicious code in item-card-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006fe1ad3ce02c3601d3fc25ac4e132de1092b4bd43cf8011efdfb6aaa0c894c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Summary A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads,...

CVE-2024-29211

A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...

CVE-2024-11123

A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/pdf.php. The manipulation of the argument url with the input ../config.inc.php leads to path traversal. It is possible to initiate the...

kernel: iommu: Return right value in iommu_sva_bind_device()

In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommusvabinddevice iommusvabinddevice should return either a sva bond handle or an ERRPTR value in error cases. Existing drivers idxd and uacce only check the return value with ISERR. This could...

kernel: KVM: arm64: Fix circular locking dependency

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix circular locking dependency The rule inside kvm enforces that the vcpu-mutex is taken inside kvm-lock. The rule is violated by the pkvmcreatehypvm which acquires the kvm-lock while already holding the vcpu-mutex...

kernel: regmap-irq: Fix out-of-bounds access when allocating config buffers

An off-by-one style bug exists in regmapaddirqchipfwnode where the allocation loop uses numconfigregs instead of numconfigbases as its termination condition. When numconfigregs exceeds numconfigbases, memory beyond the allocated row pointer array gets overwritten. KASAN caught this corruption...

PT-2024-39080 · Ivanti · Ivanti Secure Access Client

Name of the Vulnerable Software and Affected Versions: Ivanti Secure Access Client versions prior to 22.7R3 Description: The issue concerns improper authorization, allowing a local authenticated attacker to modify sensitive configuration files. Recommendations: For versions prior to 22.7R3, updat...

Brocade Fabric OS before 9.2.2 does not enforce strict host key checking

A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing various remote operations initiated by a...

Malicious code in eslint-config-finance-web-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e725f78fcf3a683c99f793d4f5e9b51d1d8f7a447baa713cab5c5efd8928f6e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-8645 · Ivanti · Ivanti Secure Access Client

Name of the Vulnerable Software and Affected Versions: Ivanti Secure Access Client versions prior to 22.7R4 Description: A race condition in Ivanti Secure Access Client allows a local authenticated attacker to modify sensitive configuration files. This issue is related to synchronization errors...

UBUNTU-CVE-2024-50258

In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small gsomaxsize/gsoipv4maxsize Config a small gsomaxsize/gsoipv4maxsize will lead to an underflow in skdstgsomaxsize, which may trigger a BUGON crash, because sk-skgsomaxsize would be much bigger than...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the wdev-cqmconfig pointer not being cleared after release...

CVE-2024-45759

Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to unauthorized execution of certain commands to overwrite system...

CVE-2024-45759

Summary of CVE-2024-45759 (Dell PowerProtect Data Domain) : A local, low-privileged attacker could exploit an escalation of privilege vulnerability to execute commands that overwrite the application’s system configuration, potentially causing a denial of service. Affected products are Dell PowerP...

CVE-2024-45759

Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to unauthorized execution of certain commands to overwrite system...