MGASA-2024-0315 Updated apache-mod_jk packages fix security vulnerability

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing modjk configuration which may lead to information disclosure and/or denial of service. CVE-2024-46544...

CVE-2023-52949

Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors...

CVE-2023-52947

Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logo...

CVE-2022-49039

Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to execute arbitrary commands via unspecified vectors...

CVE-2023-52948

CVE-2023-52948 concerns Synology Active Backup for Business Agent prior to version 2.7.0-3221, where a missing encryption of sensitive data in the settings functionality could allow local users to obtain user credentials via unspecified vectors. The CVSS 3.1 base metrics indicate Local attack vec...

CVE-2022-49039

Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to execute arbitrary commands via unspecified vectors...

CVE-2022-49039

Affected software: Synology Drive Client (backup task management). The issue is an out-of-bounds write vulnerability in the backup task management functionality prior to version 3.4.0-15721. Exploitation requires local access with administrator privileges and can allow arbitrary command execution...

CVE-2022-49039

Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to execute arbitrary commands via unspecified vectors...

CVE-2022-49038

Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 allows local users to execute arbitrary code via unspecified vectors...

CVE-2022-49038

The CVE-2022-49038 vulnerability affects Synology Drive Client, where the OpenSSL DLL component allegedly contains functionality from an untrusted control sphere that enables local users to execute arbitrary code via unspecified vectors. Affected software: Synology Drive Client versions prior to ...

Synology Drive 安全漏洞

Synology Drive is a collaborative office suite from China-based Synology Inc. The product includes document management, collaborative office and file synchronization and backup features. A security vulnerability exists in Synology Drive prior to version 3.3.0-15082, which stems from the inclusion...

Synology Active Backup for Business Agent 安全漏洞

Synology Active Backup for Business Agent is a backup program from China-based Synology Inc. A security vulnerability exists in Synology Active Backup for Business Agent prior to version 2.7.0-3221, which stems from a lack of sensitive data encryption vulnerability in the Settings feature that...

CVE-2023-52947: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logo...

GHSA-F5FW-25GW-5M92 Apache Hadoop: Temporary File Local Information Disclosure

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

CVE-2024-23454

Apache Hadoop's RunJar.run() fails to set default permissions for temporary directories on unix-like systems, where the system temporary directory is shared among all local users. This allows other local users to potentially view sensitive data if it is written to these files without explicit pos...

PT-2024-14786 · Synology · Synology Active Backup For Business Agent

Name of the Vulnerable Software and Affected Versions: Synology Active Backup for Business Agent versions prior to 2.7.0-3221 Description: A missing encryption issue exists in the settings functionality of Synology Active Backup for Business Agent, allowing local users to obtain user credentials...

CVE-2024-23454: Creation of Temporary File With Insecure Permissions

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

mod_jk: information Disclosure / DoS

An Incorrect Default Permissions vulnerability was found in Apache Tomcat Connectors that allows local users to view and modify shared memory containing modjk configuration, which may lead to information disclosure and denial of service...

kernel: ftruncate: pass a signed offset

An unexpected file truncate flaw was found when opening files with specific parameters in the Linux kernel's file-system. This vulnerability allows a local user to corrupt specific files when having access to these files...

CVE-2024-46544

An Incorrect Default Permissions vulnerability was found in Apache Tomcat Connectors that allows local users to view and modify shared memory containing modjk configuration, which may lead to information disclosure and denial of service. Mitigation Mitigation for this issue is either not availabl...