Security update for rsync

This update for rsync fixes the following issues: NOTE: This update was retracted as one of the fixes was broken. A new update will be issued. CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. bsc1234101 CVE-2024-12086: leak of a client machine's file...

OESA-2024-2566 arm-trusted-firmware security update

Trusted Firmware-A is a reference implementation of secure world software for Arm A-Profile architectures Armv8-A and Armv7-A, including an Exception Level 3 EL3 Secure Monitor. Security Fixes: Integer Underflow Wrap or Wraparound vulnerability in Renesas arm-trusted-firmware. An integer underflo...

RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4 (RHSA-2024:11529)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11529 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This...

UBUNTU-CVE-2024-55566

ColPack 1.0.10 through 9a7293a has a predictable temporary file located under /tmp with a name derived from an unseeded RNG. The impact can be overwriting files or making ColPack graphing unavailable to other users...

Statamic path traversal vulnerability

Statamic is a powerful flat file Cms built on Laravel by Statamic, Inc. for storing all content, templates, assets, and settings in files instead of a database. A path traversal vulnerability exists in Statamic versions prior to 5.17.0 that stems from the use of carefully constructed filenames...

CVE-2024-44167

The vulnerability CVE-2024-44167 affects several Apple operating systems, including iOS 18 , iPadOS 18 , macOS Sequoia 15 , macOS Sonoma 14.7 , macOS Ventura 13.7 , and visionOS 2 . The root cause involves an improper limitation of a pathname to a restricted directory (Path Traversal), which coul...

CVE-2024-27370

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsinanconfiggetnlparams, there is no input validation check on halreq-numconfigdiscoveryattr coming from userspace, which can lead to a heap overwrite...

PT-2024-21861 · Samsung · Exynos

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor Exynos versions 980, 850, 1280, 1380, and 1330 Description: An issue was discovered in the function slsi nan publish get nl params, where there is no input validation check on hal req-service specific info len coming...

PT-2024-5037

Name of the Vulnerable Software and Affected Versions: mailcow:dockerized versions prior to 2024-04 Description: The issue is related to the rspamd maps function and involves improper path validation, allowing for path traversal and arbitrary code execution. This can enable an authenticated admin...

PT-2024-19257 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 19.00.0057 Description: A file write issue exists in the OAS Engine Save Security Configuration functionality. This can be triggered by a specially crafted series of network requests, leading to...

Open Automation Software OAS Platform security vulnerabilities

Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from US-based Open Automation Software, Inc. Designed to help organizations connect data sources to the OAS Platform. A security vulnerability exists in Open Automation Software OAS Platform version V19.00.0057. A...

PT-2024-19104 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 19.00.0057 Description: A file write issue exists in the OAS Engine Tags Configuration functionality. This can be exploited by sending a specially crafted series of network requests, leading to...

Information disclosure

A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system...

Rockwell Automation SIS Workstation and ISaGRAF Workbench

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Rockwell Automation Equipment : SIS Workstation and ISaGRAF Workbench Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unprivileged local...

Advisory ROSA-SA-2023-2282

Software: dmidecode 3.5 WASP: ROSA-CHROME packageevrstring: dmidecode-3.5-2.src.rpm CVE-ID: CVE-2023-30630 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Dmidecode before version 3.5 allows -dump-bin to overwrite the local file. This has security implications because, for example, it is quite possible to...

CVE-2023-33544

hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite...

SUSE CVE-2017-1000391

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...

PT-2022-16056 · Guarddog · Guarddog

Name of the Vulnerable Software and Affected Versions: GuardDog versions prior to v0.1.8 Description: GuardDog is a CLI tool to identify malicious PyPI packages. The issue arises when extracting files using shutil.unpack archive from a potentially malicious tarball without validating that the...

UBUNTU-CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

DRUPAL-CORE-2022-008

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...