CVE-2024-50272

In the Linux kernel, the following vulnerability has been resolved: filemap: Fix bounds checking in filemapread If the caller supplies an iocb-kipos value that is close to the filesystem upper limit, and an iterator with a count that causes us to overflow that limit, then filemapread enters an...

PT-2024-8659

Name of the Vulnerable Software and Affected Versions Versa Director versions prior to 22.1.4 Description The issue is related to the use of default credentials in the configuration with PostgreSQL, allowing an unauthenticated attacker to access and administer the database, read local filesystem...

CVE-2024-41973

A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges...

CVE-2024-41972

A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges...

CVE-2024-41973

CVE-2024-41973 enables a low-privileged remote attacker to specify an arbitrary file on the filesystem, which may lead to arbitrary file writes with root privileges . The vulnerability is documented across multiple sources as affecting WAGO devices (e.g., CC100 0751-9x01, Edge Controller 0752-830...

CVE-2024-41972

CVE-2024-41972 affects multiple WAGO devices (e.g., CC100, PFC100/G1/G2, PFC200/G1/G2, Edge Controller 0752-8303/8000-0002, TP600 series, among others per CNNVD) where a low-privileged remote attacker can overwrite an arbitrary file on the filesystem, potentially enabling reading of arbitrary fil...

CVE-2024-41972 WAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices

A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges...

CVE-2024-41971 WAGO: Arbitrary File Overwrite in Multiple Devices

A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss...

CVE-2024-41971

CVE-2024-41971 affects multiple WAGO devices (e.g., CC100 0751-9x01, Edge Controller 0752-8303/8000, PFC100/200, TP600 series, etc.). A path traversal vulnerability allows a low-privileged remote attacker to overwrite arbitrary files on the filesystem, leading to Denial of Service and data loss. ...

Linux kernel find_desired_extent() Buffer Overflow

The vulnerability of the finddesiredextent function in the fs/btrfs/file.c file of the file system in the Linux kernel relates to the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker to compromise the...

Linux kernel fs/aio DoS

The vulnerability of Linux operating system’s fs/aio kernel components is related to the double allocation of memory slots in the functions aiosetupring and kiocbset CancelFn. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2024-35682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the handling of NONHEAD !delta1 lclusters in the erofs filesystem. The issue was reported by syzbot, which found a WARNI...

JFS File System Heap Buffer Overflow DoS

The vulnerability of the jfsioctrim function in the fs/jfs/jfsdiscard.c file of the Linux operating system’s file system jfs is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Fedora 37 : php-twig (2022-c6fe3ebd94)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c6fe3ebd94 advisory. Version 1.44.7 2022-09-28 Fix a security issue on filesystem loader possibility to load a template outside a configured directory Tenable has extracted the...

Fedora 37 : php-twig2 (2022-73b9fb7a77)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-73b9fb7a77 advisory. Version 2.15.3 2022-09-28 Fix a security issue on filesystem loader possibility to load a template outside a configured directory Tenable has extracted the...

Chromium: CVE-2024-11117 Inappropriate implementation in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Fedora 37 : php-twig3 (2022-42aa6ee852)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-42aa6ee852 advisory. Version 3.4.3 2022-09-28 Fix a security issue on filesystem loader possibility to load a template outside a configured directory Tenable has extracted the...

CVE-2024-49506

Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem...

Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

Summary Missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. Post-authentication, ALLOWADMINCHANGES=true Details Note: This is a sequel to CVE-2023-40035 In src/helpers/FileHelper.phpL106-L137, the function absolutePath...

GHSA-F3CW-HG6R-CHFV Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

Summary Missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. Post-authentication, ALLOWADMINCHANGES=true Details Note: This is a sequel to CVE-2023-40035 In src/helpers/FileHelper.phpL106-L137, the function absolutePath...