PT-2024-15532 · Unknown · Mholt/Archiver

Name of the Vulnerable Software and Affected Versions: mholt/archiver affected versions not specified Description: A flaw was discovered in the mholt/archiver package, allowing an attacker to create a specially crafted tar file. When unpacked, this file may allow access to restricted files or...

Amazon Linux 2023 : runc (ALAS2023-2024-501)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-501 advisory. 2024-02-01: CVE-2023-39326 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from...

CVE-2024-21626

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges

Open Automation Software recently released patches for multiple vulnerabilities in their OAS Engine. Cisco Talos publicly disclosed these issues after working with Open Automation Software to ensure that patches were available for users. Now that a fix has been released with Version 19, we want t...

URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite

GitLab once again released fixes to address a critical security flaw in its Community Edition CE and Enterprise Edition EE that could be exploited to write arbitrary files while creating a workspace. Tracked as CVE-2024-0402, the vulnerability has a CVSS score of 9.9 out of a maximum of 10. "An...

python: tarfile module directory traversal

A flaw was found in the Python tarfile module. Extracting a crafted TAR archive with the tarfile.extract or tarfile.extractall functions could lead to a directory traversal vulnerability, resulting in overwrite of arbitrary files...

RHEL 8 : python-pip (RHSA-2024:0587)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0587 advisory. pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to the formDataToJSON method within lib/helpers/formDataToJSON.js improperly filtering the proto attribute from the FormData object, allowing an attacker to overwrite critical JavaScript Object attributes...

PT-2024-13325

Name of the Vulnerable Software and Affected Versions Sane version 1.2.1 Description The issue is related to a heap bounds overwrite in the init options function from backend/test.c via a long init mode string in a configuration file. This is disputed because there is no expectation that test.c...

python: tarfile module directory traversal

A flaw was found in the Python tarfile module. Extracting a crafted TAR archive with the tarfile.extract or tarfile.extractall functions could lead to a directory traversal vulnerability, resulting in overwrite of arbitrary files...

RHEL 8 : python-pip (RHSA-2024:0374)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0374 advisory. pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package...

CVE-2023-27859

IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database. IBM X-Force ID:...

CVE-2022-45790

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic...

Authentication flaw

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic...

CVE-2022-45792 Directory Traversal in Project File Format allows overwrite (Zip Slip)

Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user...

CVE-2022-45790 Omron FINS memory protection susceptible to bruteforce

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic...

CVE-2022-45790 Omron FINS memory protection susceptible to bruteforce

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic...

CVE-2024-0646 Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system...

Creditcoin Code Issues Vulnerabilities

Creditcoin is a network that supports credit transactions across the blockchain. Creditcoin suffers from a code issue vulnerability that stems from the ability to execute arbitrary code if a malicious user has the right to overwrite the program file directory...

EulerOS 2.0 SP11 : python3 (EulerOS-SA-2023-2663)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote...