CVE-2024-36925

CVE-2024-36925 affects the Linux kernel SWIOTLB path. When CONFIG_DMA_RESTRICTED_POOL=y and CONFIG_SWIOTLB_DYNAMIC=y, initialising restricted pool memory could crash due to a NULL mem->pools during add_mem_pool() in rmem_swiotlb_device_init(). The crash arises from a NULL pointer dereference i...

CVE-2024-36914 drm/amd/display: Skip on writeback when it's not applicable

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip on writeback when it's not applicable WHY dynamic memory safety error detector KASAN catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as writeback connector does not support certain...

CVE-2024-36914 drm/amd/display: Skip on writeback when it's not applicable

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip on writeback when it's not applicable WHY dynamic memory safety error detector KASAN catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as writeback connector does not support certain...

Improper Authorization

Nautobot is vulnerable to Improper Authorization. The vulnerability is due to Nautobot failing to restrict Dynamic Group member listings based on member object permissions, allowing users to view all objects in a Dynamic Group regardless of their specific permissions...

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Impact What kind of vulnerability is it? Who is impacted? A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ to list the...

GHSA-QMJF-WC2H-6X3Q Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Impact What kind of vulnerability is it? Who is impacted? A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ to list the...

CVE-2024-36112

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

PYSEC-2024-166

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

PYSEC-2024-166

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

CVE-2024-36112 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

CVE-2024-36112 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

Nautobot 安全漏洞

Nautobot is a web automation platform by the individual developers of Nautobot. Nautobot has a security vulnerability that stems from a mismanagement of privileges vulnerability in the Nautobot dynamic-group-members UI and REST API. Affected products and versions: Nautobot versions 1.3.0 through...

PT-2024-26899 · Nautobot · Nautobot

Name of the Vulnerable Software and Affected Versions: Nautobot versions 1.3.0 through 1.6.22 Nautobot versions 2.0.0 through 2.2.4 Description: A user with extras.view dynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view...

Apiris Kafeo 安全漏洞

Apiris Kafeo is a software solution from the French company Apiris. A security vulnerability exists in Apiris Kafeo version 6.4.4 that stems from a DLL hijacking issue...

Fedora: Security Advisory for glib2 (FEDORA-2024-635a54eb7e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: rust-tiny-dfr-0.2.0-5.fc40

The most basic dynamic function row daemon possible...

[SECURITY] Fedora 40 Update: rust-scx_rusty-0.5.4-2.fc40

A multi-domain, BPF / user space hybrid scheduler used within schedext, which is a Linux kernel feature which enables implementing kernel thread schedulers in BPF and dynamically loading them. https://github.com/sched-ext/scx/tree/main...

The vulnerability of Siemens Solid Edge’s design and simulation tools relates to buffer overflow in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of Siemens Solid Edge’s design and simulation tools is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created PAR file...

CVE-2024-5242

TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However,...

SUSE CVE-2023-52790

In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix out-of-bounds TLB allocations with CONFIGSWIOTLBDYNAMIC Limit the free list length to the size of the IO TLB. Transient pool can be smaller than IOTLBSEGSIZE, but the free list is initialized with the assumption that...