ROS-20240716-01

OpenSearch software package vulnerability related to unintentional access to resources of of users in the Dashboards Reports plugin. Exploitation of the vulnerability could allow an attacker to compromise the integrity of data. impact data integrity OpenSearch software package vulnerability relat...

PT-2024-41486 · Gnu · Linux

Уязвимость функции udmabuf vm fault драйвера udmabuf drivers/dma-buf/udmabuf.c ядра операционных систем Linux связана с нарушением подсчёта количества ссылок на страницы, отображённые в памяти. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на целостность данных или вызват...

ROS-20240709-01

Vulnerability of the function UnicodeString::doAppend unistr.cpp of the International Components for Unicode library is related to integer overflow of the data structure. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to sensitive data, cause...

ChuanhuChatGPT Resource Management Error Vulnerability

ChuanhuChatGPT is a lightweight and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and many other LLMs. A resource management error vulnerability exists in ChuanhuChatGPT version 20240410, which originates from allowing any user to arbitrarily restart the server by sending a specific...

Siemens SIPROTEC 5 devices weak encryption vulnerability

SIPROTEC 5 devices offer a range of integrated protection, control, measurement and automation functions for substations and other applications. A weak cryptography vulnerability exists in Siemens SIPROTEC 5 devices due to affected devices supporting weak cryptography on multiple ports 443/tcp fo...

The vulnerability of the Mozilla Firefox browser for Android, related to deficiencies in access control, allows attackers to bypass security restrictions and compromise the integrity of protected information.

The vulnerability of the Mozilla Firefox browser for Android is related to deficiencies in access control, resulting from incorrect processing of the Principal object when opening new tabs. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and compromise the...

ROS-20240704-08

A vulnerability in the curl program line utility is related to the storage of HSTS data in a file with a too long name, curl can delete the entire contents, causing subsequent requests using the file to be unaware of the HSTS status they should have used. file will be unaware of the status of the...

ROS-20240704-28

A vulnerability in the curl program line utility is related to the storage of HSTS data in a file with a too long name, curl can delete the entire contents, causing subsequent requests that use the file to be unaware of the HSTS status they should have used. file will be unaware of the status of...

CVE-2024-5712

A Cross-Site Request Forgery CSRF vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows attackers to perform unauthorized actions in the context of a victim's browser, such as deleting projects or changing application settings,...

The vulnerability of the App component of application management tools and Flatpak environments allows attackers to compromise data integrity.

The vulnerability of the App tool component for managing applications and Flatpak environments is related to the elevation and concealment of permissions. Exploiting this vulnerability can allow a remote attacker to compromise data integrity...

The vulnerability of the Share component in the cloud software for creating and using Nextcloud Server’s data storage system allows a attacker to compromise the integrity of the data or cause service failures.

The vulnerability of the Share component in the cloud software for creating and using Nextcloud Server storage involves the sending of requests to delete old versions of files that could only be accessed with read permissions. Exploiting this vulnerability allows a malicious actor to compromise...

The vulnerability of the SpiceDB database management system, related to improper storage of permissions, allows a perpetrator to compromise data integrity.

The vulnerability of the SpiceDB database management system is related to the improper storage of permissions. Exploiting this vulnerability allows a malicious actor to influence data integrity through the CheckPermission parameter...

ROS-20240627-04

A vulnerability in the ioctl component of the Flatpak application and environment management tool is related to copying text from the virtual console and pasting it into the command buffer, from which the command can be run after exiting the Flatpak application. Exploitation of the vulnerability...

The vulnerability of the get_ne64 function in the bele.h file of the UPX executable file packager allows a attacker to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the getne64 function in the bele.h file of the executable packaging tool by UPX is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerability of the _imagingcms.c file in the Python Pillow image library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the imagingcms.c file in the Pillow image processing library is due to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Dawn component in Microsoft Edge and Google Chrome browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Dawn component in Microsoft Edge and Google Chrome lies in the improper security checks for standard elements. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a special...

The vulnerability in the web interface of microprogramming software for devices for remote control of lighting and energy consumption from Schneider Electric Sage allows a perpetrator to compromise the integrity of protected information and cause service interruptions.

The vulnerability of the web interface of microprogramming software for devices for remote control of lighting and energy consumption in Schneider Electric Sage is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a...

The vulnerability of the liteuartremove() function in the LiteUART driver of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the liteuartremove function in the drivers/tty/serial/liteuart.c file of the Linux kernel’s LiteUART driver is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the disable_{show,store}() functions in the Linux kernel USB driver allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the disableshow,store functions in the drivers/usb/core/port.c file of the Linux kernel’s USB driver is related to an infinite waiting loop for resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the f2fs_read_multi_pages() function in the f2fs file system of Linux kernels allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the f2fsreadmultipages function in the fs/f2fs/data.c file of the Linux kernel’s file system f2fs is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...