PT-2024-35443

Name of the Vulnerable Software and Affected Versions Qiwen Netdisk versions up to 1.4.0 Description A vulnerability was found in the File Rename Handler component, which can be exploited to lead to cross-site scripting. The issue can be triggered by manipulating the input with a malicious string...

CVE-2024-5279: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component File Rename Handler. The manipulation with the input leads to cross site scripting. The attack can be launched remotely. The...

grub2: grub2-set-bootflag can be abused by local (pseudo-)users

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not ...

kernel: ext4: init quota for 'old.inode' in 'ext4_rename'

In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4rename' Syzbot found the following issue: ext4parseparam: swantextraisize=128 ext4inodeinfoinit: swantextraisize=32 ext4rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828...

CVE-2024-4154

In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the...

CVE-2024-4154 Incorrect Synchronization in lunary-ai/lunary

In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the...

SUSE CVE-2024-35914

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsdrename Commit a8b0026847b8 "rename: avoid a deadlock in the case of parents having no common ancestor" added an error bail out path. However this path does not drop the remount protection that...

CVE-2024-4154: Authorization Bypass Through User-Controlled Key

In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the...

Lunary security vulnerabilities

Lunary is a production toolkit for LLM that is open sourced by lunary. A security vulnerability exists in Lunary version 1.2.2 that stems from allowing unprivileged users to rename items to which they are not authorized to have access...

DEBIAN-CVE-2024-35996

In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations by default for !X86 architectures Rename x86's to CPUMITIGATIONS, define it in generic code, and force it on for all architectures exception x86. A recent commit to turn mitigations off by default i...

DEBIAN-CVE-2024-35914

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsdrename Commit a8b0026847b8 "rename: avoid a deadlock in the case of parents having no common ancestor" added an error bail out path. However this path does not drop the remount protection that...

UBUNTU-CVE-2024-35914

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsdrename Commit a8b0026847b8 "rename: avoid a deadlock in the case of parents having no common ancestor" added an error bail out path. However this path does not drop the remount protection that...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the nfsdrename function incorrectly cleaning up paths...

SUSE CVE-2024-27063

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...

CVE-2024-27063

A vulnerability was found in the netdevtrignotify function in the Linux Kernel's led ledtrig-netdev.c driver, where a call to the getdevicestate function may lead to a kernel panic. This can occur when the interface is renamed, because the function getdevicestate still uses the old device referen...

DEBIAN-CVE-2024-27063

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...

CVE-2024-27063

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...

UBUNTU-CVE-2024-27063

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...

CVE-2024-27063 leds: trigger: netdev: Fix kernel panic on interface rename trig notify

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...

CVE-2024-27063 leds: trigger: netdev: Fix kernel panic on interface rename trig notify

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 "leds: trigger: netdev: add additional specific link speed mode" in the various changes, reworked the way to set the LINKUP mode in commi...