CVE-2024-11218

CVE-2024-11218 affects podman build and buildah, enabling container breakout via a race condition when building a malicious Containerfile using --jobs=2. The vulnerability can allow enumeration of host files/directories even with SELinux enabled. Based on connected MARINER entries, patched versio...

CVE-2024-11218

A vulnerability was found in "podman build" and "buildah." This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the...

CVE-2024-11218

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

SUSE-SU-2025:0217-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.61.0: Release notes -...

SUSE-SU-2025:0215-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: Update ...

CVE-2024-43763

In buildreadmultirsp of gattsr.cc, there is a possible denial of service due to a logic error in the code. This could lead to remote proximal/adjacent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-43096

In buildreadmultirsp of gattsr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

@adhd/backlog (>=1.0.0, <=1.0.16), @adhd/dispatch-cli (>=0.1.6, <=0.1.8) +429 more potentially affected by CVE-2025-24010 +1 more via vite (>=5.0.0, <=5.4.11)

vite NPM version =5.0.0, =1.0.0, =0.1.6, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =0.5.5 - @avorati/strapi-plugin-preview 1.0.1 - @beaker-tools/typescript-toolkit 1.3.0 and more Source cves: CVE-2025-24010, CVE-2025-2436...

@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +33 more potentially affected by CVE-2025-24010 +1 more via vite (>=6.0.0, <=6.0.8)

vite NPM version =6.0.0, =0.2.0, =19.1.0-next.0, =19.1.0-next.0, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =2.9.2, =2.9.2, =0.0.1734266056335, =9.0.0, =0.1.0, =7.1.0 and more Source cves: CVE-2025-24010, CVE-2025-24360 Source advisory: OSV:GHSA-VG6X-RCGG-RJX6...

Malicious code in calypso-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b98eff47a4acde03f525440e1a5b4a46bb09d9766422550e449954a95d3cb607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROS-20250121-02

A vulnerability in the koji RPM-based build system is related to insufficient cleansing of data provided by the by the user. Exploitation of the vulnerability could allow a remote attacker to perform cross-site scripting XSS attacks. Cross-site scripting XSS attacks...

PT-2025-1315

Name of the Vulnerable Software and Affected Versions podman versions prior to 5.3.2 buildah versions prior to 1.38.1 Description A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious...

easy-rsa 加密问题漏洞

easy-rsa is a simple shell-based CA utility from the OpenVPN open source. A security vulnerability exists in easy-rsa versions 3.0.5 through 3.1.7, which stems from the fact that when creating a password-protected CA private key using the easyrsa build-ca command, Easy-RSA incorrectly uses the...

Schneider Electric EcoStruxure Power Build Rapsody 缓冲区错误漏洞

Schneider Electric EcoStruxure Power Build Rapsody is a power monitoring platform from Schneider Electric France. Schneider Electric EcoStruxure Power Build Rapsody suffers from a buffer error vulnerability that stems from the inclusion of a memory buffer in-bounds operation improperly restricted...

CVE-2025-22731

Cross-Site Request Forgery CSRF vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site Request Forgery.This issue affects Build Private Store For Woocommerce: from n/a through = 1.0...

CVE-2025-22731 WordPress Build Private Store For Woocommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site Request Forgery.This issue affects Build Private Store For Woocommerce: from n/a through = 1.0...

TOTOLINK X5000R 安全漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R version V9.1.0cu.2350B20230313, which stems from the "pass" parameter in setVpnAccountCfg failing to correctly filter constructor special characters, commands,...

WordPress plugin Build Private Store For Woocommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...

PT-2025-4655 · WordPress · Build Private Store For Woocommerce

Name of the Vulnerable Software and Affected Versions: Build Private Store For Woocommerce versions n/a through 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 1.0, as a temporary...

CVE-2025-22731: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site Request Forgery.This issue affects Build Private Store For Woocommerce: from n/a through = 1.0...