PT-2024-36739 · Social · Sinking Dropdowns

Name of the Vulnerable Software and Affected Versions: Sinking Dropdowns versions n/a through 1.25 Description: A Cross-Site Request Forgery CSRF vulnerability is present in Yonatan Reinberg of Social Ink's Sinking Dropdowns, allowing Privilege Escalation. Recommendations: For versions n/a throug...

CVE-2024-11944

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. T...

CVE-2024-11944

CVE-2024-11944 affects iXsystems TrueNAS CORE (tarfile.extractall). The flaw is lack of validation of a user-supplied path in tarfile.extractall, enabling directory traversal and remote code execution with root privileges on affected installations, exploitable by network-adjacent attacker without...

CVE-2024-11944 iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. T...

CVE-2024-11944 iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. T...

DEBIAN-CVE-2024-56738

GNU GRUB aka GRUB2 through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks...

CVE-2021-22484

Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnerability may cause a server out of memory OOM...

SUSE CVE-2024-53184

In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in release. Let's just use containerof to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blkmqfreetagset+0x1f/0xba RSP:...

PT-2024-30631 · Imagination Technologies · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: No specific software name or versions are mentioned in the provided descriptions. Description: The issue allows software installed and run as a non-privileged user to trigger the GPU kernel driver to write to arbitrary read-only system files...

PT-2024-10859 · Huawei · Huawei Smartphone

Name of the Vulnerable Software and Affected Versions: Huawei smartphones affected versions not specified Description: The issue is related to an improper authorization vulnerability. An attacker could perform a series of operations in a specific mode to exploit this vulnerability, potentially...

PT-2024-32442 · Huawei · Honor

Name of the Vulnerable Software and Affected Versions: Honor products affected versions not specified Description: The issue is related to an information leak vulnerability. Successful exploitation of this vulnerability could cause information to leak. There is no information provided about the...

openSUSE Security Advisory (SUSE-SU-2024:4416-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-35176 · Sharp · Sharp Routers

Name of the Vulnerable Software and Affected Versions: SHARP routers affected versions not specified Description: The issue is related to an improper authentication vulnerability in the configuration backup function of SHARP routers. This vulnerability allows a remote unauthenticated attacker to...

Malicious code in testbyakash2310xxxxxxxnowaympasti (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f7818fe132eec6253859eba4bdf2ae393a02cbcba1e5a1f144411a4de2626bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

CVE-2024-12830

The CVE-2024-12830 entry concerns Arista NG Firewall, where the flaw exists in the custom_handler method and results from insufficient validation of a user-supplied path before file operations. This directory traversal vulnerability allows remote attackers to execute arbitrary code, with no authe...

CVE-2024-12830 Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability

Arista NG Firewall customhandler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2024-9102

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value CSV file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet...

Malicious code in internallib_v871 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69b95724fc9b2d9d8f204a0d94234e4f931f30bcbbb1686d50b026ad54373fa8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grid-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3f459ed60b15a8a5c508fed9f7ebd2f7707ebbb1420e814add93920322749ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...