Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

...

Misskey 输入验证错误漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. An input validation error vulnerability exists in Misskey versions 2024.8.0-rc.3 through prior to 2024.11.0-alpha.3, which stems from a lack of validation that could allow an attacker to create a...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2024-9624 WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

CVE-2024-9624

WP All Import Pro (WordPress) FIXED: SSRF in pmxi_curl_download affects all versions ≤ 4.9.3, exploitable by authenticated (Administrator+) users to issue web requests from the app to arbitrary locations, including internal service endpoints and cloud instance metadata. CVSS 3.1 vector: NETWORK/L...

CVE-2024-53960

creationtimestamp| type| source ---|---|--- 2024-12-11 00:11:03+00:00| seen| https://t.me/cvedetector/12591 2025-09-16 23:16:37+00:00| seen| MISP/be792712-f638-4d7d-b62d-4f5032e86764 2025-09-18 16:44:31+00:00| seen| MISP/be792712-f638-4d7d-b62d-4f5032e86764...

The vulnerability of the instance_create() method in the program for monitoring and adaptive configuration of system devices allows attackers to perform spoofing attacks.

The vulnerability of the instancecreate method in the program for monitoring and adaptive configuration of system devices related to insufficient validation of input data when processing the instancename parameter. Exploiting this vulnerability allows attackers to perform spoofing attacks...

Upgrade to Veeam Backup & Replication 12.3 Fails During "Step 1 of 7: Installing PostgreSQL server 15.10-1..."

Article Applicability The issue described in this article only occurred when using the initial Veeam Backup & Replication 12.3 ISO named VeeamBackup&Replication12.3.0.31020241201.iso. On 2024-12-16, a new ISO VeeamBackup&Replication12.3.0.31020241211.iso was made available, which contains a check...

SUSE CVE-2024-52336

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

AZL-53600 CVE-2024-52336 affecting package tuned for versions less than 2.21.0-2

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

AZL-53696 CVE-2024-52336 affecting package tuned for versions less than 2.15.0-5

A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with scriptpre or scriptpost options that permit arbitrary...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

tuned 安全漏洞

tuned is tuned open source server-side program for a dynamic system tuning tool. The program is mainly used to monitor and collect data from various system components, and dynamically adjust system settings based on the information provided by the data. tuned has a security vulnerability that...

Important: tuned security update

The tuned packages provide a service that tunes system settings according to a selected profile. Security Fixes: tuned: scriptpre and scriptpost options allow to pass arbitrary scripts executed by root CVE-2024-52336 tuned: improper sanitization of instancename parameter of the instancecreate...

Malicious code in cloud-functions-schedule-instance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d10678b76e1cf601f3ff31de7642b60bd56df7c7899eb2c23808c2ef0ebf778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-50183

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DAID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforeha...

"No Such Instance currently exists at this OID" retuned even the OID is correct

"No Such Instance currently exists at this OID" retuned even the OID is correct like nsCPUusage OID: 1.3.6.1.4.1.5951.4.1.1.41.6.1.2 sysHealthDiskPerusage OID: 1.3.6.1.4.1.5951.4.1.1.41.8.1.5 etc...

CVE-2024-9476

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizatio...

kernel: nouveau: fix instmem race condition around ptr stores

A flaw was found in the nouveau module in the Linux kernel. In some conditions, a race condition can cause a NULL pointer dereference, resulting in a denial of service...

kernel: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance

A flaw was found in the Linux kernel's HDA driver before initialization. This issue occurs when a user unloads and then reloads the module, and could allow a local user to crash the system...