CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions...

CVE-2024-7627

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated...

CVE-2024-7627 Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated...

GO-2024-3089 Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server

Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to enforce permissions which allows a guest user with read access to upload files to a channel...

CVE-2024-43780

A flaw was found in the mattermost package where it fails to properly enforce permissions. This issue allows a guest user with read access to upload files to channels...

Mattermost allows guest user with read access to upload files to a channel

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.0, 9.8.x = 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel...

GHSA-2JHX-W3VC-W59G Mattermost allows guest user with read access to upload files to a channel

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.0, 9.8.x = 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel...

CVE-2024-43780 Unauthorized channel file upload

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.0, 9.8.x = 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel...

CVE-2024-43780

Mattermost Server vulnerability CVE-2024-43780 affects versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x, and 9.8.x

CVE-2024-43780 Unauthorized channel file upload

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.0, 9.8.x = 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel...

CVE-2024-43780 Unauthorized channel file upload

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.0, 9.8.x = 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel...

CVE-2024-5470 Improper Access Control in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with adminpushrules permission may have been able to create project-level deploy tokens...

CVE-2024-5470

GitLab CE/EE CVE-2024-5470 affects all versions from 17.0 up to, but not including, 17.0.4 and from 17.1 up to, but not including, 17.1.2. A Guest user with the admin_push_rules permission may have been able to create project-level deploy tokens. The description explicitly identifies the vulnerab...

CVE-2024-5470

Removed by vendor...

kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva

A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service...

PT-2024-7651

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections table data within RSS becomes controllable. Setting excessively...

CVE-2024-38504

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles...

CVE-2024-38504

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles...

CVE-2024-38504

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles...