kernel: ovl: fix warning in ovl_create_real()

In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovlcreatereal Syzbot triggered the following warning in ovlworkdircreate - ovlcreatereal: if !err && WARNON!newdentry-dinode The reason is that the cgroup2 filesystem returns from mkdir without instantiating t...

kernel: ext4: fix corruption during on-line resize

A vulnerability was found in the ext4 filesystem in the Linux kernel during on-line resizing operations. When an ext4 filesystem is resized while mounted, it could lead to data corruption...

kernel: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpcremovepipedir workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel...

PT-2024-12021 · Diebold Nixdorf · Vynamic Security Suite

Name of the Vulnerable Software and Affected Versions: Diebold Nixdorf Vynamic Security Suite VSS versions prior to 3.3.0 SR12 Diebold Nixdorf Vynamic Security Suite VSS versions prior to 4.0.0 SR04 Diebold Nixdorf Vynamic Security Suite VSS versions prior to 4.1.0 SR02 Diebold Nixdorf Vynamic...

Diebold Nixdorf Vynamic Security Suite security vulnerabilities

Diebold Nixdorf Vynamic Security Suite Diebold Nixdorf VSS is a security access suite from Diebold Nixdorf, USA. A security vulnerability exists in Diebold Nixdorf Vynamic Security Suite, which originates from the inability to validate the directory structure of the root file system during pre-bo...

CVE-2024-6707

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability...

CVE-2024-6707 Open WebUI Arbitrary File Upload + Path Traversal

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability...

CVE-2024-6707 Open WebUI Arbitrary File Upload + Path Traversal

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability...

CVE-2024-6707

Open WebUI suffers a path traversal and arbitrarily uploaded file vulnerability in version 0.1.105. The flaw arises when uploading files through the HTTP interface (via the + sign in the message input) to a static UPLOAD_DIR; the filename is taken from the request without validation, enabling tra...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), com.castlemon.hudson:cucumber-perf (>=1.1, <=2.0.6) +28 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.24)

org.jenkins-ci.main:remoting MAVEN version 2.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.1, =1.519, =1.519, =1.519, =1.519,...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.5, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0, <=2.0) +173 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.60)

org.jenkins-ci.main:remoting MAVEN version 2.60 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.5, =1.0, =0.1.1, =1.4, =3.2.2, =1.2, =0.0....

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), org.jenkins-ci.main:jenkins-test-harness (1.520) +24 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.520)

org.jenkins-ci.main:jenkins-core MAVEN version 1.520 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.0.4, =1.0.4, =1.0.4, =2.0,...

kernel: ext4: regenerate buddy after block freeing failed if under fc replay

A flaw was found in the Linux kernel's ext4 filesystem related to the fast commit replay process. During this process, blocks that are already marked as free can be incorrectly marked as free again, leading to the corruption of the buddy bitmap, which is used to track free and allocated blocks...

kernel: tcp: add sanity checks to rx zerocopy

A vulnerability was found in Linux Kernel where rx zerocopy feature allowed mapping of pages owned by the filesystem, leading to potential system panic which is caused by the lack of sanity checks to rx zerocopy. A local authenticated attacker could exploit this vulnerability to cause a denial of...

kernel: ext4: regenerate buddy after block freeing failed if under fc replay

A flaw was found in the Linux kernel's ext4 filesystem related to the fast commit replay process. During this process, blocks that are already marked as free can be incorrectly marked as free again, leading to the corruption of the buddy bitmap, which is used to track free and allocated blocks...

Linux cachefiles_ondemand_daemon_read() Buffer Overflow

The vulnerability of the cachefilesondemanddaemonread function in the fs/cachefiles/ondemand.c file of the Linux kernel’s cachefile file system is related to the reutilization of previously freed memory due to competitive access to resources race condition. Exploiting this vulnerability could all...

FreeBSD-SA-24:07.nfsclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:07.nfsclient Security Advisory The FreeBSD Project Topic: NFS client accepts file names containing path separators Category: core Module: NFS client...

Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2024-2069)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2024-41015

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2checkdirentry This adds sanity checks for ocfs2direntry to make sure all members of ocfs2direntry don't stray beyond valid memory region...

SUSE CVE-2024-42091

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Check pat.ops before dumping PAT settings We may leave pat.ops unset when running on brand new platform or when running as a VF. While the former is unlikely, the latter is valid future use case and will cause NPD when...