ROS-20240521-05

A vulnerability in the Hotspot component of the Oracle Java SE software platform and Oracle GraalVM Virtual Machine Enterprise Edition exists due to insufficient input validation. Exploitation of the vulnerability could Allow a remote attacker to disclose protected information A vulnerability in...

Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. Impact of issue The newly opened malicious page can for example change the window.opener.location...

CVE-2024-4151

An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to...

CVE-2024-4151 Improper Access Control in lunary-ai/lunary

An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to...

Lunary 访问控制错误漏洞

lunary is a production toolkit for LLM. An access control error vulnerability exists in lunary that stems from the presence of incorrect access control and can be exploited by an attacker to manipulate or access sensitive project data, resulting in data integrity and confidentiality issues...

CVE-2023-52682 f2fs: fix to wait on block writeback for post_read case

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait on block writeback for postread case If inode is compressed, but not encrypted, it missed to call f2fswaitonblockwriteback to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fsgc -...

The vulnerability of the QTS and QuTS operating systems affects network storage devices from QNAP, caused by buffer overflows in the stack. This allows attackers to compromise data integrity.

The vulnerability of the QTS and QuTS operating systems affects QNAP network storage devices, due to buffer overflows in the stack. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

The vulnerability of the io_uring subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information, or to enhance their privileges.

The vulnerability of the iouring subsystem in the Linux operating system is related to the reutilization of previously released memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information, or enhance their...

The vulnerability of the mctp_sk_unhash() function in the net/mctp/af_mctp.c module, which is part of the MCTP protocol implementation in the Linux operating system, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mctpskunhash function in the net/mctp/afmctp.c module, which is part of the MCTP protocol implementation in the Linux operating system, is related to the use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

The vulnerability of the lpfc_mbx_cmpl_fc_reg_login() function in the drivers/scsi/lpfc/lpfc_hbadisc.c file of the Linux kernel allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the lpfcmbxcmplfcreglogin function in the drivers/scsi/lpfc/lpfchbadisc.c file of the Linux kernel is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...

The vulnerability of the __f2fs_setxattr() function in the fs/f2fs/xattr.c file of the Linux file system’s f2fs kernel module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the f2fs file system in Linux operating systems is related to the use of an uninitialized buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the context_close() function in the drivers/gpu/drm/i915/gem/i915_gem_context.c file of the Intel 8xx/9xx/G3x/G4x/HD Graphics driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the contextclose function in the drivers/gpu/drm/i915/gem/i915gemcontext.c file of the Intel 8xx/9xx/G3x/G4x/HD Graphics driver for the Linux operating system is related to improper locking of resources. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the __sock_xmit() function in the drivers/block/nbd.c module of the Linux kernel’s nbd driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sockxmit function in the drivers/block/nbd.c module of the Linux kernel’s nbd driver is related to the use of uninitialized fields in the struct msghdr structure. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the tcp_twsk_purge() function in the net/ipv4/tcp_minisocks.c module, which is part of the Linux kernel’s IPv4 protocol implementation, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcptwskpurge function in the net/ipv4/tcpminisocks.c module, which is part of the Linux kernel’s IPv4 protocol implementation, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

PT-2024-29388 · Unknown · Manage Bank Statement Reprocessing Rules

Name of the Vulnerable Software and Affected Versions: Manage Bank Statement ReProcessing Rules affected versions not specified Description: The issue is related to insufficient authorization checks for authenticated users, leading to potential escalation of privileges. An attacker can exploit th...

The vulnerability of the Ruby interpreter, related to buffer overflows in the heap, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Ruby programming language interpreter is related to buffer overflow attacks. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2024-6134 · Аврора · Аврора

Name of the Vulnerable Software and Affected Versions: Аврора affected versions not specified Description: The issue is related to a lack of permission control for applications accessing temporary folders in the "Аврора" operating system isolation component. Exploitation of this issue can lead to...

PT-2024-10299 · Sap +1 · Sap Netweaver As Abap +2

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP and ABAP Platform affected versions not specified Description: The issue is related to the lack of authorization checks when a user executes certain RFC function modules, potentially allowing an attacker with basic user...

RHEL 6 : rpm (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - rpm: Following symlinks to directories when installing packages allows privilege escalation CVE-2017-7500...

RHEL 7 : dpdk (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - dpdk: Information exposure in unchecked guest physical to host virtual address translations CVE-2018-1059...