6358 matches found
CVE-2022-49373 watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
In the Linux kernel, the following vulnerability has been resolved: watchdog: ts4800wdt: Fix refcount leak in ts4800wdtprobe ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput in some error paths...
CVE-2022-49212 mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: atmel: fix refcount issue in atmelnandcontrollerinit The reference counting issue happens in several error handling paths on a refcounted object "nc-dmac". In these paths, the function simply returns the error code,...
CVE-2022-49103 NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()
In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix reference count leaks in nfs42proccopynotify You don't often get email from [email protected]. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification. The reference counting issue happens in...
Pen testing avionics under ED-203a
The aviation industry realised some time ago that taking a standard approach to the cyber security of its products was needed and that this was a specialist discipline. A family of documents was produced to help with this: ED-202A / DO-326A – what should be certified ED-203A / DO-356A – how these...
Slackware: Security Advisory (SSA:2025-051-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[slackware-security] ark
New ark packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/ark-21.12.1-i586-2slack15.0.txz: Rebuilt. The ark archive tool in KDE was found to extract to absolute paths if they are present in the...
CVE-2025-25284
The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS Web Processing Service implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the GdalTranslate service, whe...
The vulnerability of the Xerox Workplace Suite print server, related to incorrect path name restrictions for restricted access directories, allows attackers to gain read, modify, or delete access to data.
The vulnerability of the Xerox Workplace Suite print management server is related to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to gain read, modify, or delete access to data...
SUSE CVE-2024-38475
Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...
CPython 安全漏洞
CPython is a Python interpreter implemented in C from the Python Foundation. A security vulnerability exists in CPython that stems from the default use of user-writable file paths on Windows platforms, which could lead to memory errors or file type misclassification...
PT-2025-6780 · Schneider Electric · Ecostruxure Process Expert
Name of the Vulnerable Software and Affected Versions: EcoStruxure Process Expert version 2020R2 Description: The issue is related to improper privilege management, affecting two services, one of which manages audit trail data and the other acts as a server managing client requests. This could le...
cri-o: CRI-O Path Traversal in Log Handling Functions Allows Arbitrary Unmounting
A vulnerability was found in CRI-O. A path traversal issue in the log management functions UnMountPodLogs and LinkContainerLogs may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system...
Astra Linux – Vulnerability in Apache2
Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL. This enables the attacker to execute code or disclose...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an out-of-bounds write in triegetnextkey The triegetnextkey function allocates a node stack with a size of trie-maxprefixlen. However, it writes trie-maxprefixlen + 1 nodes to the stack when the stack is full. For...
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to insecure initialization of the DEFAULTCACHEDIR in app.py, using of user input...
[SECURITY] [DLA 4046-1] ark security update
Debian LTS Advisory DLA-4046-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany February 08, 2025 https://wiki.debian.org/LTS Package : ark Version : 4:20.12.2-1+deb11u1 CVE ID : CVE-2024-57966 A flaw was discovered in ark, an archive utility for the KDE platform...
CVE-2022-41158
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...
CVE-2024-1511
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various...
CVE-2024-2746
Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit...