9198 matches found
Kliqqi CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-37620)
Kliqqi CMS Pligg CMS is Kliqqi open source a content management system . Kliqqi CMS v2.0.2 version of the cross-site request forgery vulnerability , the vulnerability stems from /admin/adminwidgets.php?action=install&widget=akismet does not adequately verify that the request is from a trusted use...
Warehouse Inventory System Cross-Site Request Forgery Vulnerability (CNVD-2024-38217)
Warehouse Inventory System is a Warehouse Inventory Management System by Siamon Hasan Personal Developer. A cross-site request forgery vulnerability exists in Warehouse Inventory System v2.0, which stems from the editcategorie.php component not adequately verifying that a request comes from a...
Warehouse Inventory System Cross-Site Request Forgery Vulnerability (CNVD-2024-38212)
Warehouse Inventory System is a Warehouse Inventory Management System by Siamon Hasan Personal Developer. A cross-site request forgery vulnerability exists in Warehouse Inventory System v2.0, which stems from the deletecategorie.php component not adequately verifying that a request comes from a...
Warehouse Inventory System Cross-Site Request Forgery Vulnerability (CNVD-2024-38218)
Warehouse Inventory System is a Warehouse Inventory Management System by Siamon Hasan Personal Developer. A cross-site request forgery vulnerability exists in Warehouse Inventory System v2.0, which stems from the editgroup.php component not adequately verifying that a request comes from a trusted...
CVE-2024-36441
Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by the device...
CVE-2022-48902
A flaw was found in the btrfs module in the Linux Kernel. Improper error handling can cause a warning, potentially impacting system stability, resulting in a denial of service...
DEBIAN-CVE-2021-4441
In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynqqspiexecmemop In zynqqspiexecmemop, kzalloc is directly used in memset, which could lead to a NULL pointer dereference on failure of kzalloc. Fix this bug by adding a chec...
UBUNTU-CVE-2022-48925
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.srcaddr outside state checks If the state is not idle then resolvepreparesrc should immediately fail and no change to global state should happen. However, it unconditionally overwrites the srcad...
UBUNTU-CVE-2022-48901
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not start relocation until in progress drops are done We hit a bug with a recovering relocation on mount for one of our file systems in production. I reproduced this locally by injecting errors into snapshot delete with...
CVE-2024-36441
Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by the device...
CVE-2024-36441
The Swissphone DiCal-RED 4009 radio module is vulnerable to an improper access control issue (CWE-200) that allows an unauthenticated attacker to gain access to sensitive operation messages received by the device. The vulnerability is exploited via a port-2101 TCP connection . This device is used...
CVE-2024-36441
Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by the device...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not adding a dispatch point to a batch operation...
PT-2024-27001 · Swissphone · Swissphone Dical-Red 4009
Name of the Vulnerable Software and Affected Versions: Swissphone DiCal-RED 4009 devices affected versions not specified Description: The issue allows an unauthenticated attacker to use a port-2101 TCP connection to gain access to operation messages received by the device. Recommendations: At the...
CVE-2024-36441: Improper Access Control
Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by the device...
GO-2023-2055 Terraform allows arbitrary file write during the `init` operation in github.com/hashicorp/terraform
Terraform allows arbitrary file write during the init operation in github.com/hashicorp/terraform...
389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying userPassword using malformed input...
GO-2023-1900 Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation in github.com/hashicorp/vault
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation in github.com/hashicorp/vault...
Capsule tenant owner with "patch namespace" permission can hijack system namespaces
Attack Vector Then, let me briefly explain the reasons for the errors mentioned above: 1. The 'kubectl edit' command was used to patch the namespace, but this operation requires both 'get' and 'patch' permissions, hence the error. One should use methods like 'curl' to directly send a PATCH reques...