Misskey 输入验证错误漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. An input validation error vulnerability exists in Misskey versions 2024.8.0-rc.3 through prior to 2024.11.0-alpha.3, which stems from a lack of validation that could allow an attacker to create a...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2024-9624

WP All Import Pro (WordPress) FIXED: SSRF in pmxi_curl_download affects all versions ≤ 4.9.3, exploitable by authenticated (Administrator+) users to issue web requests from the app to arbitrary locations, including internal service endpoints and cloud instance metadata. CVSS 3.1 vector: NETWORK/L...

CVE-2024-9624 WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

CVE-2024-9624: Server-Side Request Forgery (SSRF)

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

PT-2024-39725

Name of the Vulnerable Software and Affected Versions WP All Import Pro plugin for WordPress versions up to, and including, 4.9.3 Description The issue is related to Server-Side Request Forgery due to missing SSRF protection on the pmxi curl download function. This allows authenticated attackers...

Malware in cloud-functions-schedule-instance

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-53960

creationtimestamp| type| source ---|---|--- 2024-12-11 00:11:03+00:00| seen| https://t.me/cvedetector/12591 2025-09-16 23:16:37+00:00| seen| MISP/be792712-f638-4d7d-b62d-4f5032e86764 2025-09-18 16:44:31+00:00| seen| MISP/be792712-f638-4d7d-b62d-4f5032e86764...

The vulnerability of the instance_create() method in the program for monitoring and adaptive configuration of system devices allows attackers to perform spoofing attacks.

The vulnerability of the instancecreate method in the program for monitoring and adaptive configuration of system devices related to insufficient validation of input data when processing the instancename parameter. Exploiting this vulnerability allows attackers to perform spoofing attacks...

Upgrade to Veeam Backup & Replication 12.3 Fails During "Step 1 of 7: Installing PostgreSQL server 15.10-1..."

Article Applicability The issue described in this article only occurred when using the initial Veeam Backup & Replication 12.3 ISO named VeeamBackup&Replication12.3.0.31020241201.iso. On 2024-12-16, a new ISO VeeamBackup&Replication12.3.0.31020241211.iso was made available, which contains a check...

SUSE CVE-2024-52336

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

AZL-53696 CVE-2024-52336 affecting package tuned for versions less than 2.15.0-5

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

AZL-53600 CVE-2024-52336 affecting package tuned for versions less than 2.21.0-2

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

tuned 安全漏洞

tuned is tuned open source server-side program for a dynamic system tuning tool. The program is mainly used to monitor and collect data from various system components, and dynamically adjust system settings based on the information provided by the data. tuned has a security vulnerability that...

PT-2024-8833

Name of the Vulnerable Software and Affected Versions: Tuned affected versions not specified Description: A script injection vulnerability was identified in the Tuned package. The instance create D-Bus function can be called by locally logged-in users without authentication, allowing a local...

Important: tuned security update

The tuned packages provide a service that tunes system settings according to a selected profile. Security Fixes: tuned: scriptpre and scriptpost options allow to pass arbitrary scripts executed by root CVE-2024-52336 tuned: improper sanitization of instancename parameter of the instancecreate...

Malicious code in cloud-functions-schedule-instance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d10678b76e1cf601f3ff31de7642b60bd56df7c7899eb2c23808c2ef0ebf778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-50183

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DAID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforeha...

"No Such Instance currently exists at this OID" retuned even the OID is correct

"No Such Instance currently exists at this OID" retuned even the OID is correct like nsCPUusage OID: 1.3.6.1.4.1.5951.4.1.1.41.6.1.2 sysHealthDiskPerusage OID: 1.3.6.1.4.1.5951.4.1.1.41.8.1.5 etc...