CVE-2024-7421: Insertion of Sensitive Information into Log File

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions...

kernel: NFSv4/pnfs: Fix a use-after-free bug in open

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call...

Updated python-tqdm package fixes security vulnerability

Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable...

PT-2024-39161 · WordPress · Wp Simple Booking Calendar

Name of the Vulnerable Software and Affected Versions: WP Simple Booking Calendar plugin for WordPress versions up to, and including, 2.0.10 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without appropriate escaping on the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly initialize args.context before nfsd4encodefattr4, which could result in the release of...

EulerOS 2.0 SP10 : cups (EulerOS-SA-2024-2409)

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the...

Updated libpcap packages fix security vulnerabilities

In affected libpcap versions during the setup of a remote packet capture the internal function sockinitaddress calls getaddrinfo and possibly freeaddrinfo, but does not clearly indicate to the caller function whether freeaddrinfo still remains to be called after the function returns. This makes i...

CVE-2024-8654

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3...

UBUNTU-CVE-2024-8654

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3...

CVE-2024-8654 MongoDB Server may access non-initialized region of memory leading to unexpected behaviour

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3...

mongodb -- MongoDB Server access to non-initialized memory

[email protected] reports: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage...

Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft

IPv6 Vulnerability Packet Sender for Memory Corruption CVE-...

CVE-2024-43910

In the Linux kernel, the following vulnerability has been resolved: bpf: add missing checkfuncargregoff to prevent out-of-bounds memory accesses Currently, it's possible to pass in a modified CONSTPTRTODYNPTR to a global function as an argument. The adverse effects of this is that BPF helpers can...

Exploit for OS Command Injection in Php

Fastest CVE-2024-4577 Exploitation Tool Description: PHP C...

Medium: python-tqdm

Issue Overview: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version...

CVE-2024-27442: Improper Handling of Exceptional Conditions

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of...

kernel: of: Fix double free in of_parse_phandle_with_args_map

In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in ofparsephandlewithargsmap The Linux kernel CVE team has assigned CVE-2023-52679 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051750-CVE-2023-52679-948f@gregkh/T...

PT-2024-6667 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.2.20.0 and earlier Description: The issue is related to an information exposure that allows local attackers with access to system logs to obtain session credentials. This occurs via passwords...

The vulnerability of the Gogs self-managed Git repository creation software lies in the possibility of exploiting or modifying arguments, allowing a perpetrator to disclose protected information.

The vulnerability of the Gogs self-managed Git repository creation software is related to the implementation or modification of arguments. Exploiting this vulnerability can allow a malicious actor, operating remotely, to expose the protected information...

CVE-2024-41129

The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...