SUSE CVE-2010-2525

A flaw was discovered in gfs2 file system's handling of acls access control lists. An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system...

SUSE CVE-2022-0168

A denial of service DOS issue was found in the Linux kernel's smb2ioctlqueryinfo function in the fs/cifs/smb2ops.c Common Internet File System CIFS due to an incorrect return from the memdupuser function. This flaw allows a local, privileged CAPSYSADMIN attacker to crash the system...

SUSE CVE-2023-4949

An attacker with local access to a system either through a disk or external drive can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub's XFS file system implementation...

Cross-Site Scripting (XSS)

typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of file extensions containing malicious sequences when accessing the server's file system directly or through synchronization, which allows an attacker to execute arbitrary scripts in the...

GHSA-7M75-X27W-R52R qdrant input validation failure

qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the...

CVE-2024-36963

In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's...

CVE-2024-36963 tracefs: Reset permissions on remount if permissions are options

In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's...

CVE-2024-36963 tracefs: Reset permissions on remount if permissions are options

In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's...

RHEL 7 : dosfstools (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - dosfstools: Heap-buffer-overflows in readfat and getfat functions CVE-2016-4804 - The setfat function in...

[SECURITY] Fedora 39 Update: rust-uu_unlink-0.0.23-3.fc39

unlink uutils remove a file system link to FILE...

[SECURITY] Fedora 39 Update: rust-uu_ln-0.0.23-3.fc39

ln uutils create a file system link to TARGET...

[SECURITY] Fedora 39 Update: rust-uu_link-0.0.23-4.fc39

link uutils create a hard file system link to FILE...

[SECURITY] Fedora 39 Update: rust-uu_df-0.0.23-3.fc39

df uutils display file system information...

SUSE CVE-2024-36894

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix race between aiocancel and AIO request complete FFS based applications can utilize the aiocancel callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application...

XML External Entity (XXE) Injection

symfony/serializer is vulnerable to XML External Entity XXE injection. This vulnerability is due to the failure to disable external entities when parsing XML using the XMLEncoder component, which allows an attacker to include arbitrary files from the file system by exploiting the XXE injection fl...

TYPO3 Cross-Site Scripting in Filelist Module

It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the...

GHSA-6XWF-7RFM-4GWC TYPO3 Cross-Site Scripting in Filelist Module

It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the...

UBUNTU-CVE-2024-36958

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4encodefattr4 crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree on the way out of nfsd4encodefattr4...

CVE-2024-36923 fs/9p: fix uninitialized values during inode evict

In the Linux kernel, the following vulnerability has been resolved: fs/9p: fix uninitialized values during inode evict If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to...

Symfony XML decoding attack vector through external entities

The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system...