ROS-20240423-03

Vulnerability in the /krb5/src/lib/rpc/pmaprmt.c component of the Kerberos network protocol implementation is related to memory freeing errors. Exploitation of the vulnerability could allow an attacker acting remotely, cause a denial of service Vulnerability in component...

The vulnerability of the System Recovery Bootloader for Windows operating systems allows attackers to circumvent existing security restrictions and enhance their privileges.

The vulnerability of the System Recovery Bootloader for Windows operating systems is related to errors in processing input data. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and gain increased privileges...

The vulnerability of Windows operating system-based Cryptographic Services allows attackers to circumvent existing security restrictions.

The vulnerability of Windows operating system’s Cryptographic Services is related to data encryption errors. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

The vulnerability of the cross-platform FTP server CrushFTP’s web interface allows a hacker to gain access to the virtual file system and system files.

The vulnerability of the cross-platform FTP server CrushFTP lies in errors related to privilege management. Exploiting this vulnerability allows a malicious actor to gain access to the system files by exiting the virtual file system remotely...

ROS-20240422-05

The golang package vulnerability is related to errors returned from MarshalJSON methods containing data, controlled by the user. Exploitation of the vulnerability could allow an attacker acting remotely, exploit these errors to disrupt the contextual behavior of the automatic output of the packag...

The vulnerability in the embedded Jetty server of the CData Connect integration, analysis, and data management platform allows attackers to escalate their privileges.

The vulnerability of the embedded Jetty server in the CData Connect integration, analysis, and data management platform is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges by sending specially...

The vulnerability of the WLAvalancheService component in the Avalanche mobile device management system allows a hacker to trigger a service failure.

The vulnerability of the WLAvalancheService component in the mobile device management system of Avalanche is related to pointer assignment errors. Exploiting this vulnerability could allow a remote attacker to cause service failures...

The vulnerability of the WLAvalancheService component in the Avalanche mobile device management system allows a hacker to trigger a service failure.

The vulnerability of the WLAvalancheService component in the mobile device management system of Avalanche is related to pointer assignment errors. Exploiting this vulnerability could allow a remote attacker to cause service failures...

The vulnerability in the embedded Jetty server of the CData Sync integration and replication tool allows a perpetrator to gain unauthorized access to protected information and perform arbitrary actions within the system.

The vulnerability in the embedded Jetty server of the CData Sync integration and replication tool is related to errors in processing the relative path to the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected...

PT-2024-5137

Name of the Vulnerable Software and Affected Versions: Node.js affected versions not specified Description: The issue is related to the Permission Model in Node.js, which incorrectly assumes that any path starting with two backslashes has a four-character prefix that can be ignored. This subtle b...

CVE-2024-26873

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Fix a deadlock issue related to automatic dump If we issue a disabling PHY command, the device attached with it will go offline, if a 2 bit ECC error occurs at the same time, a hung task may be found: 4613.652388...

AZL-59453 CVE-2024-26841 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Update cpusiblingmap when disabling nonboot CPUs Update cpusiblingmap when disabling nonboot CPUs by defining & calling clearcpusiblingmap, otherwise we get such errors on SMT systems: jump label: negative count!...

The vulnerability of the Kerberos protocol for Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Kerberos protocol for Windows operating systems is related to pointer swapping errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Palo Alto OS Command Injection

CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection send this HTTP request: http POST /ssl-vpn/hipreport.esp HTTP/1.1 Host: 127.0.0.1 Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/hellome1337.txt; Connection: close Content-Type: application/x-www-form-urlencod...

The vulnerability of the ovs_pcap_open() function in the Open vSwitch software-level switch allows a attacker to cause a service failure.

The vulnerability of the ovspcapopen function in the Open vSwitch multi-level switch device is related to memory release errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the USB HID analyzer used by Wireshark, which is used to analyze computer network traffic, allows a hacker to perform a service denial.

The vulnerability of the USB HID analyzer used by Wireshark for analyzing computer network traffic is related to memory release errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of UEFI (BIOS) in HP workstations allows a hacker to elevate their privileges, execute arbitrary code, or cause system failures.

The vulnerability of HP workstation BIOS microprogramming software is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to enhance their privileges, execute arbitrary code, or cause service failures...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to errors in processing the relative path to the directory, allows a hacker to extract data from JAR archives.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity in JetBrains is related to errors in processing the relative path to the directory. Exploiting this vulnerability allows a malicious actor to remotely read data from JAR archives...

The vulnerabilities of Intel PROSet/Wireless WiFi and Intel Killer Wi-Fi network devices, related to initialization errors, allow attackers to trigger service interruptions.

The vulnerability of Intel PROSet/Wireless WiFi and Intel Killer Wi-Fi network device drivers is related to initialization errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerabilities of Intel PROSet/Wireless WiFi and Intel Killer Wi-Fi network devices, related to initialization errors, allow attackers to exploit these vulnerabilities to disclose protected information.

The vulnerability of Intel PROSet/Wireless WiFi and Intel Killer Wi-Fi network device drivers is related to initialization errors. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by these devices...