CVE-2024-3135

Technical details (affected products/versions, root cause, fixes) are not publicly provided in the supplied documents. Monitor for updates from official advisories; current sources reiterate CSRF risk but lack version-specific remediation information.

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

...

LocalAI 跨站请求伪造漏洞

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. LocalAI suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF tokens on the web server, which allows an attacker to host malicious JavaScript on a host that coul...

The vulnerability of the smart.disk.get component in the universal monitoring system Zabbix allows a attacker to execute arbitrary code.

The vulnerability of the smart.disk.get component in the universal monitoring system of Zabbix is related to the introduction of malicious code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-42913

This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions...

CVE-2023-42913

This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions...

CVE-2023-42913

This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions...

CVE-2023-42913

CVE-2023-42913 affects macOS Sonoma 14.2 where remote Login sessions may obtain full disk access due to an issue in state management. Apple and Red Hat/NVD references indicate the vulnerability is addressed in macOS Sonoma 14.2 (with fixes applied to Remote Login/session handling). The root cause...

CVE-2023-42913

This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sessions may be able to obtain full disk access permissions...

Apple macOS Sonoma 安全漏洞

Apple macOS Sonoma is a desktop operating system from Apple, Inc. A security vulnerability exists in Apple macOS Sonoma version 14.2, which stems from a remote login session that may be able to gain full disk access...

PT-2024-8692

Name of the Vulnerable Software and Affected Versions Apache Kafka Clients versions 2.3.0 through 3.7.1 Description The issue is related to improper privilege management in Apache Kafka Clients, allowing attackers to access arbitrary contents of the disk and environment variables. This can be...

Security information for Hitachi Disk Array Systems

Overview Log files of Hitachi Disk Array Systems have the CVE-2022-36407 Plaintext Storage of Passwords vulnerability. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure a...

UBUNTU-CVE-2021-47176

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: add missing discipline function Fix crash with illegal operation exception in dasddevicetasklet. Commit b72949328869 "s390/dasd: Prepare for additional path event handling" renamed the verifypath function for ECKD but...

CVE-2022-36407 Information Exposure Vulnerability in Hitachi Disk Array Systems

Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual Storage Platform G1000, G1500, Hitachi Virtual Storage Platform F1500, Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, Hitachi...

CVE-2022-36407 Information Exposure Vulnerability in Hitachi Disk Array Systems

Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual Storage Platform G1000, G1500, Hitachi Virtual Storage Platform F1500, Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, Hitachi...

SUSE CVE-2024-1727

A Cross-Site Request Forgery CSRF vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete...

GHSA-WR3J-PWJ9-HQQ6 Path traversal in webpack-dev-middleware

Summary The webpack-dev-middleware middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. Details The middleware can either work with the physical filesystem when reading the files or it can...

PT-2024-18255

Name of the Vulnerable Software and Affected Versions gradio versions prior to 4.19.2 Description A Cross-Site Request Forgery CSRF issue allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an...

PT-2024-3876

Name of the Vulnerable Software and Affected Versions: webpack-dev-middleware versions prior to 7.1.0 webpack-dev-middleware versions prior to 6.1.2 webpack-dev-middleware versions prior to 5.3.4 Description: The webpack-dev-middleware does not sufficiently validate the supplied URL address befor...

Cisco IP Phones 8800 Series File Upload Denial of Service (CVE-2019-1766)

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service DoS condition. The vulnerability exists because the...