ROS-20240708-02

A vulnerability in the TPMLPCRSELECTION functions of the source repository for Trusted Platform Module tools TPM2.0 is related to improper mapping of PCR slots, providing a misleading TPM state. Exploitation of the vulnerability could allow an attacker acting remotely to manipulate output data...

The vulnerability of the Meta Model Repository component of the SAP NetWeaver AS for Java software used for creating and deploying web applications allows a attacker to cause a service failure.

The vulnerability of the Meta Model Repository component in the SAP NetWeaver AS for Java software for creating and deploying web applications is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

HuggingFace Git Repo Detection for Linux/UNIX

Binary data huggingfacegitdetectnix.nbin...

The vulnerability of Sonatype Nexus Repository Manager lies in the improper restriction of the path name to the restricted directory. This allows attackers to disclose protected information.

The vulnerability of Sonatype Nexus Repository Manager is related to incorrect restrictions on the path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

GO-2024-2955 Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors

Gin-Gonic CORS middleware mishandles a wildcard at the end of an origin string. Examples: https://example.community/ is accepted by the origin string https://example.com/ and http://localhost.example.com/ is accepted by the origin string http://localhost/...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387-Exploit-POC Este repositorio contiene un Proof...

CVE-2024-36404

creationtimestamp| type| source ---|---|--- 2024-07-02 01:43:04+00:00| published-proof-of-concept| https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w 2024-07-09 08:10:17+00:00| published-proof-of-concept| https://t.me/CNArsenal/2767 2024-07-09 16:34:26+00:00|...

CBL Mariner 2.0 Security Update: git (CVE-2024-32465)

The version of git installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32465 advisory. - Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and...

CVE-2024-5926

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...

CVE-2024-5926 Path Traversal in stitionai/devika

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...

CVE-2024-5926

CVE-2024-5926 involves a path traversal in stitionai/devika’s get-project-files function. The root cause is insufficient path sanitization for the project-name parameter, enabling an attacker to traverse the filesystem and read arbitrary files, potentially causing a Denial of Service across all v...

CVE-2024-38532

The CVE-2024-38532 issue affects the NXP Data Co-Processor (DCP) used in specific NXP SoCs, where the dcp_tool reference implementation selected a test key regardless of the -t argument. This root cause is addressed by patch commit 26a7. Connected sources describe the vulnerability as tied to the...

Malicious code in ethereuim (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b0ffb55c54f64ae4381a989cd33833fe7120cb10f440b31d452004030ad65f5 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...

GO-2024-2516 Grafana XSS via a column style in github.com/grafana/grafana

Grafana XSS via a column style in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...

GO-2024-2430 Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs

Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2024-2434 CubeFS leaks users key in logs in github.com/cubefs/cubefs

CubeFS leaks users key in logs in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit t...

GO-2024-2934 Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder...

CVE-2024-29038

The CVE-2024-29038 issue affects tpm2-tools (TPM2.0 tools). Affected component: quote data generation and verification logic in tpm2-tools; root cause: an attacker could generate arbitrary quote data that is not detected by tpm2_checkquote. Impact: attacker-controlled quotes could bypass detectio...

The vulnerability of the Branch Name Handler component of the PHP Composer dependency manager allows a attacker to execute arbitrary commands.

The vulnerability of the Branch Name Handler component in the PHP Composer dependency manager is related to the use of the composer install command executed within the git/hg repository. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-5548

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'projectname' parameter in a GET request to download arbitrary files from the system. This issue...