CVE-2024-2288 CSRF File Upload Vulnerability in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without thei...

CVE-2024-2288 CSRF File Upload Vulnerability in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without thei...

CVE-2024-5550 Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead...

CVE-2024-5550

CVE-2024-5550 affects h2oai/h2o-3 3.40.0.4. The Typeahead API allows an arbitrary system path lookup, exposing full filesystem paths (e.g., /home, /usr, /bin) to remote users. This is an information-disclosure flaw; exploitation is potentially facilitated when combined with a Local File Inclusion...

Ubuntu 20.04 LTS / 22.04 LTS : QEMU regression (USN-6567-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6567-2 advisory. USN-6567-1 fixed vulnerabilities QEMU. The fix for CVE-2023-2861 was too restrictive and introduced a behaviour change leading to a regression in...

PT-2024-33809

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the ext4 filesystem in the Linux kernel. When mounting the ext4 filesystem, if the default hash version is set to DX HASH SIPHASH but the casefold feature is not set...

h2o Information Disclosure Vulnerability

h2o is a new generation of HTTP server. Not only is it very fast compared to older generation HTTP servers, but it also provides faster response to the end user. An information disclosure vulnerability exists in h2o-3 version 3.40.0.4, which stems from the presence of a sensitive information...

PT-2024-36531

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.40.0.4 Description The issue is caused by an arbitrary system path lookup feature, allowing any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the problem resides in the...

USN-6808-1 atril vulnerability

It was discovered that Atril was vulnerable to a path traversal attack. An attacker could possibly use this vulnerability to create arbitrary files on the host filesystem with user privileges...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

jenkins-2-plugins: git-server plugin arbitrary file read vulnerability

A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system...

kernel: fat: fix uninitialized field in nostale filehandles

In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles The Linux kernel CVE team has assigned CVE-2024-26973 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26973-54a3@gregkh/T...

kernel: fat: fix uninitialized field in nostale filehandles

In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles The Linux kernel CVE team has assigned CVE-2024-26973 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26973-54a3@gregkh/T...

SUSE CVE-2020-14381

A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as...

SUSE CVE-2022-1011

A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write. This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation...

SUSE CVE-2023-2124

An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system...

BIT-NODE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

SUSE CVE-2024-36939

In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpcprocregister in nfsnetinit. syzkaller reported a warning 0 triggered while destroying immature netns. rpcprocregister was called in initnfsfs, but its error has been ignored since at least the initial comm...

EulerOS 2.0 SP11 : grub2 (EulerOS-SA-2024-1799)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a temporary file with...

PT-2024-31339

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically in the btrfs filesystem. The issue occurs when using subpage and zoned cases, which can lead to a data leak at unmount...