USN-7011-1 clamav vulnerabilities

It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. CVE-2024-20505 It was discovered that ClamAV incorrectly handled logfile privileges. A local attacker could use this iss...

VulnCheck KEV: CVE-2024-6396

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated...

[SECURITY] [DSA 5769-1] git security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5769-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 13, 2024 https://www.debian.org/security/faq -...

CVE-2024-8311

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template...

CVE-2024-8311

Removed by vendor...

CVE-2024-8311

CVE-2024-8311 affects GitLab Enterprise/Community Edition pipeline execution policies. The issue allows an authenticated user to bypass variable overwrite protections by including a CI/CD template in versions: GitLab EE 17.2 up to 17.2.5 (exclusive) and 17.3 up to 17.3.2 (exclusive). Root cause: ...

CVE-2024-8311 Improper Protection of Alternate Path in GitLab

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template...

PT-2024-38933 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.2 through 17.2.4 GitLab EE versions 17.3 through 17.3.1 Description: An issue was discovered with pipeline execution policies in GitLab EE, allowing authenticated users to bypass variable overwrite protection via inclusi...

NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities: - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow...

PT-2024-9884

Name of the Vulnerable Software and Affected Versions: Nix versions 2.24 through 2.24.5 Nix version 2.24 prior to 2.24.6 Description: A bug in Nix allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the...

CVE-2024-7634

NGINX Agent's "configdirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory...

CVE-2024-27387

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsirxrangedoneind, there is no input validation check on rttid coming from userspace, which can lead to a heap overwrite...

CVE-2024-27383

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsigetscanextraies, there is no input validation check on defaulties coming from userspace, which can lead to a heap overwrite...

Path Traversal

Stripe-CLI is vulnerable to path traversal. The vulnerability is due to improper validation of plugin shortnames in the manifest when installing plugins using the --archive-url or --archive-path flags, allowing an attacker to overwrite arbitrary files on the system by exploiting the path traversa...

SAMSUNG Mobile Processor 安全漏洞

SAMSUNG Mobile Processor is a family of mobile processors from Samsung South Korea. A security vulnerability exists in SAMSUNG Mobile Processor, which stems from the function slsirxrangedoneind not performing an input validation check on rttid from userspace, resulting in a heap overwrite. The...

CVE-2024-27383

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsigetscanextraies, there is no input validation check on defaulties coming from userspace, which can lead to a heap overwrite...

CVE-2024-27387

CVE-2024-27387 affects Samsung Mobile Processor Exynos 980, 850, 1280, 1380, and 1330. The issue arises in the function slsi_rx_range_done_ind() , where there is no input validation for rtt_id sourced from userspace, enabling a potential heap overwrite. Documents do not provide exploitation detai...

CVE-2024-27387

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsirxrangedoneind, there is no input validation check on rttid coming from userspace, which can lead to a heap overwrite...

PT-2024-21871 · Samsung · Exynos

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor Exynos versions 980, 850, 1280, 1380, and 1330 Description: An issue was discovered in the function slsi get scan extra ies, where there is no input validation check on default ies coming from userspace, which can lea...

CVE-2024-27383

An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsigetscanextraies, there is no input validation check on defaulties coming from userspace, which can lead to a heap overwrite...