kernel: dm: call the resume method on internal suspend

A flaw was found in the Linux kernel’s device-mapper dm component. The issue arises during internal suspend operations where the resume method is not correctly called. This issue leads to problems such as list corruption, specifically observed when running the lvm2 test suite. The problem occurs...

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the deleteTransferFile method in the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

CVE-2024-41599

Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method...

CVE-2024-41600

Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component...

CVE-2024-41599

Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method...

CVE-2024-41599

This CVE concerns RuoYi (v4.7.9 and earlier). The issue is described as a Cross Site Scripting vulnerability that enables a remote attacker to execute arbitrary code via the file upload method. Concrete details from connected sources confirm affected software and the basic vulnerability pattern, ...

The vulnerability of the EndUpdate method in the SolarWinds Access Rights Manager software allows a intruder to execute arbitrary code.

The vulnerability of the EndUpdate method in the SolarWinds Access Rights Manager ARM access control software lies in the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2024-29458 · Lin-Cms · Lin-Cms

Name of the Vulnerable Software and Affected Versions: lin-CMS versions 0.2.0 and before Description: The issue allows a remote attacker to obtain sensitive information via the login method in the UserController.java component. Recommendations: For lin-CMS versions 0.2.0 and before, consider...

PT-2024-29457 · Unknown · Lin-Cms Springboot

Name of the Vulnerable Software and Affected Versions: lin-CMS Springboot versions 0.2.1 and before Description: The issue allows a remote attacker to obtain sensitive information via the login method in the UserController.java component. Recommendations: For versions 0.2.1 and before, consider...

The vulnerability of the Connect method of the SolarWinds Access Rights Manager software allows a perpetrator to execute arbitrary code.

The vulnerability of the Connect method in the SolarWinds Access Rights Manager software lies in improper restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

RUSTSEC-2024-0403 op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic...

Authorization Bypass

silverstripe/reports is vulnerable to Authorization Bypass. The vulnerability is due to a flaw in the implementation of access control mechanisms within the ReportAdmin.php. It allows direct URL access to reports by any user who has access to the reports admin section, irrespective of whether the...

SolarWinds Access Rights Manager ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ChangeHumster class. The issue results from an exposed dangerous...

NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getFilterString method. The issue results from the lack of...

SolarWinds Access Rights Manager CreateFile Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CreateFile method. The issue results from the lack of proper...

SolarWinds Access Rights Manager EndUpdate Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EndUpdate method. The issue results from an exposed dangerous metho...

SUSE CVE-2022-48811

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: don't release napi in ibmvnicopen If ibmvnicopen encounters an error such as when setting link state, it calls releaseresources which frees the napi structures needlessly. Instead, have ibmvnicopen only clean up the work...

PT-2024-13796 · Unknown · Purity//Fb

Name of the Vulnerable Software and Affected Versions: Purity//FB affected versions not specified Description: A flaw in the authentication mechanism allows a local account to access the management interface using an unintended method, potentially granting an attacker privileged access to the...

UBUNTU-CVE-2022-48813

In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 "net: dsa: realtek: register the MDIO bus under devres" 5135e96a3dd2 "net: dsa: don't allocate the slavemiibus using devres" mdiobusfree will pan...

UBUNTU-CVE-2024-40627

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...