Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the GET, PUT, DELETE /admins/adminId endpoints, allowing low privileged users to fetch, modify, or delete high privileged users admins, resulting in unauthorize...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a race condition between sockmapclose and skpsockput in the sockmap component...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the GET, PUT, and DELETE endpoints for /services/serviceId, allowing low privileged users to fetch, modify, or delete services of any user, including admin...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization checks in the GET, PUT, and DELETE methods for the /categories/categoryId endpoint. This allows a low-privileged user to fetch, modify, or delete the category...

CVE-2023-38047

A BOLA vulnerability in GET, PUT, DELETE /categories/categoryId allows a low privileged user to fetch, modify or delete the category of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38048

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38055 A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /services/serviceId allows a low privileged user to fetch, modify or delete the services of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38052

CVE-2023-38052 describes a BOLA vulnerability in the EasyAppointments API where GET, PUT, DELETE /admins/{adminId} endpoints permit a low-privileged user to fetch, modify, or delete a high-privileged admin, leading to unauthorized access and data manipulation. Multiple sources associate this with...

CVE-2023-38050 A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38048 A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-38047

CVE-2023-38047 affects Easy!Appointments prior to 1.5.0. The issue is an authorization flaw in GET, PUT, and DELETE on /categories/{categoryId} that lets a low-privileged user fetch, modify, or delete category data for any user (including admins), causing unauthorized access and data manipulation...

podman security update

4.9.4-5.0.1 - Fixes issue of podman execvp error while using podmansh Orabug: 36073625 - Improved saving remote build context to tarfile in Podman daemon Orabug: 36495655 - Add devices on container startup, not on creation - Backport fast gzip for compression Orabug: 36420418 - overlay: Put shoul...

When doing HTTP(S) transfers libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send even when the `CURLOPT_POSTFIELDS` option has been set if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: gfs2: Fixed a slab-use-after-free issue in gfs2qddealloc. In gfs2putsuper, regardless of whether it is withdrawn or not, the quota should be cleaned up using gfs2quotacleanup. Otherwise, the struct gfs2sbd will be freed before...

SUSE CVE-2022-48753

In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in diskregisterindependentaccessranges kobjectinitandadd takes reference even when it fails. According to the doc of kobjectinitandadd If this function returns an error, kobjectput must be called to properl...

SUSE CVE-2022-48758

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Flush destroywork queue before calling bnx2fcinterfaceput The bnx2fcdestroy functions are removing the interface before calling destroywork. This results multiple WARNings from sysfsremovegroup as the controller rpo...

DEBIAN-CVE-2024-38627

In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stmregisterdevice The putdevice&stm-dev call will trigger stmdevicerelease which frees "stm" so the vfreestm on the next line is a double free...

PT-2024-10551 · Unknown · Tftp Server +1

Name of the Vulnerable Software and Affected Versions: Distinct Intranet Servers versions 3.10 and earlier Description: The issue allows remote attackers to read or write arbitrary files via a .. dot dot in the 1 get or 2 put commands. This is due to multiple directory traversal vulnerabilities i...

DEBIAN-CVE-2022-48753

In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in diskregisterindependentaccessranges kobjectinitandadd takes reference even when it fails. According to the doc of kobjectinitandadd If this function returns an error, kobjectput must be called to properl...

UBUNTU-CVE-2022-48753

In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in diskregisterindependentaccessranges kobjectinitandadd takes reference even when it fails. According to the doc of kobjectinitandadd If this function returns an error, kobjectput must be called to properl...