1260 matches found
CVE-2024-43370
gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...
CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using sh -c. An attacker with authenticated...
CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using sh -c. An attacker with authenticated...
PT-2025-4838 · Ambari · Ambari
Name of the Vulnerable Software and Affected Versions: Ambari affected versions not specified Description: A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when...
CVE-2024-57918
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using two different values to define the maximum number of surfaces: MAXSURFACES and MAXSURFACENUM. Consolidate MAXSURFACES as the unique...
CVE-2024-57918
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using two different values to define the maximum number of surfaces: MAXSURFACES and MAXSURFACENUM. Consolidate MAXSURFACES as the unique...
CVE-2024-57918 drm/amd/display: fix page fault due to max surface definition mismatch
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using two different values to define the maximum number of surfaces: MAXSURFACES and MAXSURFACENUM. Consolidate MAXSURFACES as the unique...
PT-2025-7267 · Weeek · Weeek
Name of the Vulnerable Software and Affected Versions: WEEEK affected versions not specified Description: The issue is related to improper restriction of recursive entity references in the DTD of a task and project management service. This could allow a remote attacker to cause a denial of servic...
Path Traversal
github.com/karmada-io/karmada is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths within custom resource definition CRD archives, allowing attackers to exploit a TarSlip vulnerability and write arbitrary files to arbitrary locations in the filesystem...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the ASoC Intel hda-dai module incorrectly releasing the link DMA when STOP is triggered, which could lead to...
The vulnerability of the HDAudBus_DMA driver interface of the Microsoft High Definition Audio Bus allows a hacker to execute arbitrary code or cause a service failure.
The vulnerability of the HDAudBusDMA driver interface of the Microsoft High Definition Audio Bus driver is related to insufficient resource control during its existence. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause service failures...
SUSE CVE-2024-25131
A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...
GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator
The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...
ROS-20241218-01
Vulnerability of the kmallocreserve function in the net/core/skbuff.c module of the network subsystem of the Linux kernel is related to integer overflow. Linux kernel subsystem is related to integer overflow. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
Sensitive Information Disclosure
Rancher Manager is vulnerable to sensitive information disclosure. The vulnerability is due to Helm values being stored directly in the Apps Custom Resource Definition and leaking into audit logs when the audit level is set to 2 or above, allowing users with GET access to read sensitive informati...
ALSA: hda/cs8409: Fix possible NULL dereference
...
Cleartext Storage of Sensitive Information
Overview zhmc-ansible-modules is an Ansible modules managing a IBM Z via the HMC Web Services API. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information through the zhmcpartition, zhmclpar, zhmcuser, and zhmcldapserverdefinition modules. An attacker can...
PT-2024-35963
Name of the Vulnerable Software and Affected Versions: zhmcclient versions prior to 1.18.1 Description: The Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in several cases, including when creating or updating a partition in DPM mode, updating a...
CVE-2024-52056
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file...