CVE-2024-45593

Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...

CVE-2024-45593

CVE-2024-45593 affects the Nix package manager. A bug in Nix 2.24 prior to 2.24.6 lets a substituter or malicious user craft a NAR that, when unpacked by Nix, writes to arbitrary filesystem locations accessible to the Nix process, with root privileges when using the Nix daemon. Multiple connected...

CVE-2024-0067

Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer...

APSB24-55 : Security update available for Adobe After Effects

Adobe has released an update for Adobe After Effects for Windows and macOS. This update addresses critical, important and moderate security vulnerabilities. Successful exploitation could lead to arbitrary code execution, memory leak and arbitrary file system write in the context of the current us...

PT-2024-9884

Name of the Vulnerable Software and Affected Versions: Nix versions 2.24 through 2.24.5 Nix version 2.24 prior to 2.24.6 Description: A bug in Nix allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the...

Adobe After Effects < 23.6.9 / 24.0 < 24.6 Multiple Vulnerabilities (APSB24-55)

The version of Adobe After Effects installed on the remote Windows host is prior to 23.6.9, 24.6. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB24-55 advisory. - After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability...

PT-2024-29993 · Hewlett Packard · Hpe Hp-Ux

Name of the Vulnerable Software and Affected Versions: HPE HP-UX affected versions not specified Description: A denial of service vulnerability has been identified in HPE HP-UX System's Network File System NFSv4 services. This issue makes HPE HP-UX susceptible to Denial-Of-Service attacks. Over...

SUSE CVE-2023-52909

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of cached open files in nfsd4open codepath Commit fb70bf124b05 "NFSD: Instantiate a struct file when creating a regular NFSv4 file" added the ability to cache an open fd over a compound. There are a couple of...

CVE-2023-30583

fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...

CVE-2023-30583

fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...

CVE-2023-30583

fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...

PT-2024-10148 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.8.2823 build 20240712 QTS versions prior to 5.2.0.2802 build 20240620 QuTS hero versions prior to h5.1.8.2823 build 20240712 QuTS hero versions prior to h5.2.0.2802 build 20240620 Description: The issue is related to...

Veeam Kasten GSB backups fail with the error "mkdir /tmp/kopia-log: read-only file system"

Challenge The backup for the workloads that uses Generic Storage Backup GSB fails with the error: mkdir /tmp/kopia-log: read-only file system\r\nUnable to create logs directory: mkdir /tmp/kopia-log: read-only file system Cause Veeam Kasten for Kubernetes 's datamover needs write access to the /t...

The vulnerability of the dispose_list function in the vfs component of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the disposelist function in the vfs component of the Linux operating system’s kernel is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2024-44972

A flaw was found in the btrfs module in the Linux kernel. A specific workload can cause a data leak when unmounting a btrfs file system, causing leak detection warnings, potentially impacting system stability, and resulting in a denial of service...

CVE-2024-45003

In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming processSee function pruneicachesb collects all reclaimable inodes and mark them with IFREEING flag at first, at that time, other processes will be...

AZL-49924 CVE-2024-44963 affecting package kernel for versions less than 6.6.64.2-9

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUGON when freeing tree block after error When freeing a tree block, at btrfsfreetreeblock, if we fail to create a delayed reference we don't deal with the error and just do a BUGON. The error most likely to happen ...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

Remote Code Execution

mlflow is vulnerable to Remote Code Execution. The vulnerability is caused due to a defect where mflow allows to write/overwrite any file on the file system. A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...

Directory Traversal

github.com/opencontainers/runc is vulnerable to Directory Traversal. The vulnerability is due to the race condition with os.MkdirAll in runc when sharing a volume between two containers, allowing an attacker to create empty files or directories in arbitrary locations on the host file system...