CVE-2024-38531

Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assu...

CVE-2024-38531 Nix sandbox escape

Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assu...

[SECURITY] [DLA 3845-1] dlt-daemon security update

Debian LTS Advisory DLA-3845-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany June 27, 2024 https://wiki.debian.org/LTS Package : dlt-daemon Version : 2.18.0-1+deb10u2 CVE ID : CVE-2022-39836 CVE-2022-39837 CVE-2023-26257 CVE-2023-36321 Several flaws were...

CVE-2024-6388

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext...

CVE-2024-6388

CVE-2024-6388 affects the Ubuntu Advantage Desktop Daemon before version 1.12. The issue is that the Pro token is leaked to unprivileged users by being passed as a plaintext argument, which could enable an attacker to gain unauthorized access to an Ubuntu Pro subscription. The vulnerability is do...

CVE-2024-6388

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext...

Canonical Ubuntu Advantage Desktop Daemon Security Vulnerability

Canonical Ubuntu Advantage Desktop Daemon is a daemon from Canonical UK that allows desktop applications to interact with Ubuntu Advantage. A security vulnerability exists in Canonical Ubuntu Advantage Desktop Daemon versions prior to 1.12, which originated from passing the Pro token as a paramet...

CVE-2024-6388

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext...

PT-2024-37585 · Canonical +1 · Ubuntu Advantage Desktop Daemon +2

Name of the Vulnerable Software and Affected Versions: Ubuntu Advantage Desktop Daemon versions prior to 1.12 Description: The Ubuntu Advantage Desktop Daemon leaks the Pro token to unprivileged users by passing the token as an argument in plaintext. Recommendations: For versions prior to 1.12,...

Debian dla-3845 : dlt-daemon - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3845 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3845-1 [email protected]...

Astra Linux – Vulnerability in liblivemedia

Live555 version 1.08 does not handle Matroska and Ogg files properly. Sending two consecutive RTSP SETUP commands for the same track causes a Use-After-Free error and results in a crash of the daemon...

Ubuntu 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6819-4)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6819-4 advisory. Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference...

CVE-2024-35526

An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory...

PT-2024-5567 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.4R3-S8 Junos OS versions from 22.2 before 22.2R3-S4 Junos OS versions from 22.3 before 22.3R3-S3 Junos OS versions from 22.4 before 22.4R3-S3 Junos OS versions from 23.2 before 23.2R2-S1 Junos OS versions from 23...

CVE-2024-35527

FarCry Core framework (Daemon PTY Limited) vulnerable to arbitrary code execution via fileupload/upload.cfm in versions prior to 7.2.14. The flaw allows uploading a crafted .cfm file to achieve remote code execution. Impact is asserted as high (C, I, A) with CVSS v3.1 base score 9.8. Affected pro...

CVE-2024-35526

An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory...

PT-2024-5569 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S10 Junos OS versions 21.2 prior to 21.2R3-S7 Junos OS versions 21.4 prior to 21.4R3-S6 Junos OS versions 22.1 prior to 22.1R3-S5 Junos OS versions 22.2 prior to 22.2R3-S3 Junos OS versions 22.3 prior to...

SUSE: Security Advisory (SUSE-SU-2024:2170-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-6532 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 21.4R3 through 21.4R3-S5 Junos OS versions 22.1R3 through 22.1R3-S4 Junos OS versions 22.2R2 through 22.2R3 Junos OS versions 22.3R1 through 22.3R2-S2, 22.3R3 Junos OS versions 22.4R1 through 22.4R2 Description: An Improper...

PT-2024-6540 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S10 Junos OS versions from 21.2 before 21.2R3-S7 Junos OS versions from 21.4 before 21.4R3-S6 Junos OS versions from 22.1 before 22.1R3-S5 Junos OS versions from 22.2 before 22.2R3-S3 Junos OS versions from...