Session Fixation

github.com/mattermost/mattermost-server is vulnerable to Session Fixation. The vulnerability is due to improper session invalidation when converting a user to a bot, allows the user to retain their previous session and potentially escalate privileges based on the bot’s assigned permissions...

SUSE CVE-2024-58001

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle a symlink read error correctly Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;- So I've redone it as individual patches, and...

SUSE CVE-2025-21717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: add missing cputonode to kvzallocnode in mlx5eopenxdpredirectsq kvzallocnode is not doing a runtime check on the node argument allocpagesnodenoprof does have a VMBUGON, but it expands to nothing on !CONFIGDEBUGVM build...

CVE-2024-58001

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle a symlink read error correctly Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;- So I've redone it as individual patches, and...

DEBIAN-CVE-2024-58001

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle a symlink read error correctly Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;- So I've redone it as individual patches, and...

UBUNTU-CVE-2024-58001

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle a symlink read error correctly Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;- So I've redone it as individual patches, and...

SUSE CVE-2022-49404

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the...

CVE-2025-21717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: add missing cputonode to kvzallocnode in mlx5eopenxdpredirectsq kvzallocnode is not doing a runtime check on the node argument allocpagesnodenoprof does have a VMBUGON, but it expands to nothing on !CONFIGDEBUGVM build...

CVE-2024-58001

Technical details about CVE-2024-58001 are not publicly provided in the supplied documents. Monitor for updates from official advisories; the sources reference related advisories but do not reveal vulnerability specifics, affected products, or fixes.

DEBIAN-CVE-2022-49414

In the Linux kernel, the following vulnerability has been resolved: ext4: fix race condition between ext4write and ext4convertinlinedata Hulk Robot reported a BUGON: ================================================================== EXT4-fs error device loop3: ext4mbgeneratebuddy:805: group 0,...

UBUNTU-CVE-2022-49532

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference in virtiogpuconngetmodes drmcvtmode may return NULL and we should check it. This bug is found by syzkaller: FAULTINJECTION stacktrace: 168.567394 FAULTINJECTION: forcing a failure. name...

CVE-2022-49414 ext4: fix race condition between ext4_write and ext4_convert_inline_data

In the Linux kernel, the following vulnerability has been resolved: ext4: fix race condition between ext4write and ext4convertinlinedata Hulk Robot reported a BUGON: ================================================================== EXT4-fs error device loop3: ext4mbgeneratebuddy:805: group 0,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a possible race condition in ext4 between ext4write and ext4convertinlinedata...

SUSE SLES12 : Feature update for slurm and pdsh (SUSE-SU-SUSE-FU-2025:0661-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-FU-2025:0661-1 advisory. slurm was updated to version 24.11.1 using package slurm2411: - Security issues fixed: CVE-2024-48936: Fixed authentication...

GHSA-RHVR-6W8C-6V7W Mattermost fails to invalidate all active sessions when converting a user to a bot

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

Mattermost fails to invalidate all active sessions when converting a user to a bot

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

CVE-2025-1412

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

CVE-2025-1412 Session Persistence After User-to-Bot Conversion

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

CVE-2025-1412

CVE-2025-1412 affects Mattermost Server 9.11.x (up to 9.11.6) and 10.4.x (up to 10.4.1). The issue: when converting a user to a bot, active sessions are not invalidated, enabling the converted user to escalate privileges depending on the bot’s granted permissions. Documented impact: potential pri...

CVE-2025-1412 Session Persistence After User-to-Bot Conversion

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...