kernel: ext4: regenerate buddy after block freeing failed if under fc replay

A flaw was found in the Linux kernel's ext4 filesystem related to the fast commit replay process. During this process, blocks that are already marked as free can be incorrectly marked as free again, leading to the corruption of the buddy bitmap, which is used to track free and allocated blocks...

The Road to Agentic AI: Exposed Foundations

Our research into Retrieval Augmented Generation RAG systems uncovered at least 80 unprotected servers. We highlight this problem, which can lead to potential data loss and unauthorized access...

CVE-2024-9852

Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric...

PT-2024-8959

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric FA Connector SCADA-system GENESIS64 versions 10.97.2 through 10.97.3 ICONICS GENESIS64 versions 10.97.2 through 10.97.3 Description The issue is related to the presence of dead code in the GENESIS64 system, which can be...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could result in legitimate data not being processed. This could allow malicious attackers to control a portion of the submitted dat...

PT-2024-10707 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a possible loss of data due to type confusion in the deserialization constructor of NanoAppFilter.java. This could lead to local escalation of privilege in the syste...

CVE-2024-11069

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPressGDPRDataDelete::checkaction' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users...

CVE-2024-11069 WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPressGDPRDataDelete::checkaction' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users...

CVE-2024-11069 WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPressGDPRDataDelete::checkaction' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users...

WordPress plugin WordPress GDPR 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

CVE-2024-41971

A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss...

CVE-2024-41971

CVE-2024-41971 affects multiple WAGO devices (e.g., CC100 0751-9x01, Edge Controller 0752-8303/8000, PFC100/200, TP600 series, etc.). A path traversal vulnerability allows a low-privileged remote attacker to overwrite arbitrary files on the filesystem, leading to Denial of Service and data loss. ...

CVE-2024-41971 WAGO: Arbitrary File Overwrite in Multiple Devices

A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss...

CVE-2024-41971 WAGO: Arbitrary File Overwrite in Multiple Devices

A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss...

WAGO多款产品 路径遍历漏洞

WAGO Edge Controller and others are products of WAGO, Germany.WAGO Edge Controller is an edge controller.WAGO PFC is a compact PLC for modular WAGO-I/O systems.WAGO CC100 0751-9x01 is a compact controller. A path traversal vulnerability exists in various WAGO products, which can be exploited by a...

PT-2024-29671 · Wago · Cc100 0751-9X01 +10

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A low privileged remote attacker can overwrite an arbitrary file on the filesystem, leading to a Denial of Service DoS and data loss. Recommendations: A...

CVE-2024-50386

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker...

CVE-2024-50386 Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker...

CVE-2024-50386

CVE-2024-50386 affects Apache CloudStack where by default, derived KVM-compatible templates can be registered for download to primary storage. The root cause is missing validation checks for KVM templates in CloudStack versions 4.0.0–4.18.2.4 and 4.19.0–4.19.1.2. An attacker able to register temp...

Access control vulnerable to user data deletion by anonynmous users

Impact Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding dataroles = to AccessControl.userfolder.UserFolder. References...