lakeFS 安全漏洞

lakeFS is an open source tool from Treeverse Open Source that converts your object store into a Git-like repository. A security vulnerability exists in lakeFS version 1.31.1, which stems from the fact that when a new user is created with the username of a deleted user, the new user inherits all t...

CVE-2024-11619 macrozheng mall JWT Token default key

A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The...

The vulnerability of the FASTFAT component of the Windows operating system, related to the issue of buffer out-of-bound operations, allows an attacker to read data from deleted system files.

The vulnerability of the FASTFAT component of the Windows operating system is related to the execution of operations outside the memory buffer. Exploiting this vulnerability allows an attacker to read data from deleted files in the operating system by mounting another file system that contains a...

The vulnerability of the msdosfs driver in the FreeBSD operating system, related to the use of an uninitialized resource, allows a hacker to read data from deleted system files.

The vulnerability of the msdosfs driver in the FreeBSD operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a hacker to read data from deleted system files...

CVE-2024-10668

There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk ...

jenkins: Item creation restriction bypass vulnerability

A flaw was found in Jenkins. When attempting to create an item prohibited by ACLhasCreatePermission2 or TopLevelItemDescriptorisApplicableInItemGroup through the Jenkins CLI or the REST API, if either of these checks fail, Jenkins creates the item in memory and only deletes it from disk. This may...

Security update for the Linux Kernel RT (Live Patch 9 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001330 fixes several issues. The following security issues were fixed: CVE-2024-35905: Fixed int overflow for stack access size bsc1226327. CVE-2021-47598: schcake: do not call cakedestroy from cakeinit bsc1227471. CVE-2024-35863: Fixed potential UAF i...

CVE-2023-22650 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider AP. This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s...

CVE-2023-22650 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider AP. This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s...

CVE-2024-47781 Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWiki

CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user can insert arbitrary HTML that is displayed in the request wiki queue when requesting a wiki. If a wiki creator comes across the XSS...

CreateWiki 跨站脚本漏洞

CreateWiki is an extension to the Miraheze open source. A cross-site scripting vulnerability exists in CreateWiki. An attacker exploiting this vulnerability could retrieve deleted wiki requests, which often contain sensitive information...

Linux kernel resource management error vulnerability (CNVD-2024-39371)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly handle deleted delegates when processing nfsd4cbgetattrrelease, which could lead to...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly handle deleted delegates when processing nfsd4cbgetattrrelease, which could lead to...

Advanced forensic techniques for recovering hidden data in wearable devices

TL;DR A walk-through of forensic data recovery Detailed example of how to retrieve potentially sensitive deleted data Includes location, sleep and activity tracking Understand the security and privacy implications of wearable device data Introduction This blog post covers how forensic skills and...

BIT-GITLAB-2024-6502 Incorrect Provision of Specified Functionality in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag...

GHSA-JG95-R9XH-XW9C Mage AI incorrectly gives privileges to users with deleted accounts

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server...

Mage AI incorrectly gives privileges to users with deleted accounts

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server...

CVE-2024-45187 Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server...

CVE-2024-45187 Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server...

CVE-2024-6502

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag...