CVE-2024-23652

CVE-2024-23652 affects BuildKit, where a malicious BuildKit frontend or Dockerfile using RUN --mount could bypass the file-removal safeguards that delete empty files for mountpoints, potentially allowing removal of a host file from inside the container. The issue is fixed in BuildKit v0.12.5. Mit...

CVE-2024-23652

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the...

CVE-2024-23652

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the...

CVE-2024-21626

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

CVE-2024-23652: Improper Limitation of a Pathname to a Restricted Directory

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the...

Kap security breach

Kap is an open source screen recorder from Wulkano Open Source. Kap 3.6.0 version of the previous security vulnerability , the vulnerability stems from the RunAsNode and enableNodeClilnspectArguments settings can execute arbitrary code...

PT-2024-20048 · Kap · Kap

Name of the Vulnerable Software and Affected Versions: Kap for macOS versions 3.6.0 and earlier Description: The issue allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. Recommendations: For Kap for macOS versions 3.6.0 and earlier, at...

PT-2024-20050 · Loom · Loom

Name of the Vulnerable Software and Affected Versions: Loom on macOS version 0.196.1 and before Description: An issue in Loom allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. The vendor disputes this issue because it requires local...

Wiz ❤️ HashiCorp: Wiz’s new integration with Terraform Run Tasks helps customers slash risks and boost developer productivity

Mutual Wiz and HashiCorp customers can leverage this integration to scan their IaC configuration and enforce security best practices to reduce risk...

PT-2024-20056 · Metagpt · Metagpt

Name of the Vulnerable Software and Affected Versions: MetaGPT versions 0.6.4 and earlier Description: The issue allows the QaEngineer role to execute arbitrary code because RunCode.run script passes shell metacharacters to subprocess.Popen. This enables potential exploitation, but specific detai...

CVE-2023-47034

A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors...

PT-2024-13403 · Unknown · Uniswapfrontrunbot

Name of the Vulnerable Software and Affected Versions: UniswapFrontRunBot version 0xdB94c Description: A vulnerability in UniswapFrontRunBot allows attackers to cause financial losses via unspecified vectors. Recommendations: At the moment, there is no information about a newer version that...

The vulnerability in the /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> component of the application for exchanging instant messages with Mattermost allows a hacker to perform a CSRF attack.

The vulnerability of the /plugins/playbooks/api/v0/telemetry/run/ component of the Mattermost instant messaging application is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to perform a CSRF attack remotely...

Evernote Security Breach

Evernote Impression Notes is a suite of note-taking software for the macOS platform from the American company Evernote. The software allows you to create, manage, synchronize, search and share notes anytime, anywhere. A security vulnerability exists in Evernote macOS version v.10.68.2, which...

L1 TO L2 ERC20 TOKEN TRANSFER CAN BE DoS IN THE FxERC20ChildTunnel CONTRACT SINCE A MALICIOUS USER CAN SET THE fxRootTunnel ADDRESS TO AN INVALID ADDRESS

Lines of code Vulnerability details Impact The FxERC20ChildTunnel is a smart contract which is used for the L2 token management. The FxERC20ChildTunnel contract inherits from the FxBaseChildTunnel contract. The FxBaseChildTunnel contract has the validateSender modifier which requires the sender o...

A MALICIOUS USER CAN FRONT RUN AND EXECUTE THE Tokenomics.initializeTokenomics TRANSACTION TO BECOME THE OWNER OF THE Tokenomics CONTRACT

Lines of code Vulnerability details Impact The Tokenomics.initializeTokenomics is an external function which can be called by anyone, Since there is no access control. Hence a malicious user can front-run the valid initialization transaction and become the owner of the Tokenomics contract. This i...

CVE-2023-50027: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run method...

Denial Of Service (DOS)

paddlepaddle is vulnerable to Denial Of Service DoS. The vulnerability is caused due to an uncaught floating point exception which is thrown from the paddle.nanmedian function while evaluating a numel / stride expression when the stride variable has a value of zero. This leads to a run time crash...

VulnCheck KEV: CVE-2020-25499

TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router...

CVE-2023-36485

The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file...