CVE-2024-20361: Undefined Security Weakness

A vulnerability in the Object Groups for Access Control Lists ACLs feature of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense FTD Software. This...

PT-2024-4159

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center FMC Software affected versions not specified Description A vulnerability in the Object Groups for Access Control Lists ACLs feature could allow an unauthenticated, remote attacker to bypass configured access...

SUSE CVE-2023-52667

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fsanycreategroups When kcalloc for ft-g succeeds but kvzalloc for in fails, fsanycreategroups will free ft-g. However, its caller fsanycreatetable will free ft-g again through calling...

SUSE CVE-2024-35835

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...

SUSE CVE-2024-35956

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Create subvolume, create snapshot and delete subvolume all use btrfssubvolumereservemetadata to reserve metadata for the changes done to the parent subvolume's f...

AZL-67700 CVE-2024-35956 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Create subvolume, create snapshot and delete subvolume all use btrfssubvolumereservemetadata to reserve metadata for the changes done to the parent subvolume's f...

DEBIAN-CVE-2024-35835

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...

UBUNTU-CVE-2024-35835

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...

GitLab 11.3 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39876)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. CVE-2021-39876 Note that Nessus has not tested for this issue but...

GitLab 12.2 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13275)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 CVE-2020-13275 Note that Nessus has not tested for this issue but...

Imported Citrix Policy lists Delivery Group names from source site in the policy filter

If Citrix Policies are exported from a site and imported to a different site, the export caries Delivery Groups from source site in Assign Policy filter. Command to export & import policy Export-BrokerDesktopPolicy | Out-File -FilePath C:\Temp\PolicyExport.txt Import-BrokerDesktopPolicy Get-Conte...

Secrecy Concerns Mount Over Spy Powers Targeting US Data Centers

A coalition of digital rights groups is demanding the US declassify records that would clarify just how expansive a major surveillance program really is...

Web-School ERP SQL注入漏洞

Web-School ERP is an application from Web-School India. An ERP application. A SQL injection vulnerability exists in Web-School ERP version 1.0, which originates from a SQL injection vulnerability in the groupsid, examname, classesid, esvoucherid, esclass, etc parameters on the...

Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control C&C infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of...

CVE-2024-3606: Missing Authorization

The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pmuploadcoverimage function in all versions up to, and including, 5.8.3. This makes it possible for authenticated...

PT-2024-24463

Name of the Vulnerable Software and Affected Versions LOGINT LoMag Inventory Management versions 1.0.20.120 and before Description The issue allows an attacker to execute arbitrary code via the ArticleGetGroups, DocAddDocument, ClassClickShop, and frmSettings components. This is a SQL Injection...

kernel: virtio_vdpa: build affinity masks conditionally

A flaw was found in the Linux kernel's virtio vDPA driver. When the number of device queues exceeds the number of CPUs, the createaffinitymasks function triggers a kernel warning in groupcpusevenly. This occurs because the affinity logic assumes CPUs are not fewer than queue groups, which doesn't...

ProfileGrid – User Profiles, Memberships, Groups and Communities < 5.8.0 - Insecure Direct Object Reference

Description The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.7.9 due to missing validation on a user controlled key in the pgshowmsgpanel function. This makes it...

RHEL 8 : OpenShift Serverless Client kn 1.29.0 (Moderate) (RHSA-2023:3450)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3450 advisory. Red Hat OpenShift Serverless Client kn 1.29.0 provides a CLI to interact with Red Hat OpenShift Serverless 1.29.0. The kn CLI is delivered a...

RHEL 8 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...