4541 matches found
RHEL 8 : kernel (RHSA-2024:5266)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5266 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nftables: honor tab...
CVE-2024-42485
CVE-2024-42485 affects Filament Excel. The vulnerability exists in the export download route /filament-excel/{path}, where an attacker could leverage directory traversal using ../ to download arbitrary files without authentication when the webserver allows such paths. This could disclose sensitiv...
PT-2024-29982 · Unknown · Filament Excel
Name of the Vulnerable Software and Affected Versions: Filament Excel versions prior to v2.3.3 Description: The export download route "/filament-excel/path" allowed downloading any file without login when the webserver allows ../ in the URL. This issue was reported by Kevin Pohl. Recommendations:...
Unbreakable Enterprise kernel-container security update
5.4.17-2136.334.6.el7 - loop: Fix a race between loop detach and loop open Gulam Mohamed Orabug: 36197800 - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs Alexandre Chartre Orabug: 36672495 - x86/bhi: Avoid warning in DB handler due to BHI mitigation Alexandre Chartre...
The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily e.g. leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.
...
kernel: net: kernel: UAF in network route management
A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections...
kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
A use-after-free flaw was found in ip6routempathnotify in the Linux kernel. This may lead to a crash...
kernel: net/smc: fix neighbour and rtable leak in smc_ib_find_route()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix neighbour and rtable leak in smcibfindroute In smcibfindroute, the neighbour found by neighlookup and rtable resolved by iprouteoutputflow are not released or put before return. It may cause the refcount leak, so fix...
kernel: net: kernel: UAF in network route management
A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections...
kernel: ipvlan: add ipvlan_route_v6_outbound() helper
In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlanroutev6outbound helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlanprocessv6outbound by moving the flowi6 struct used for the route lookup in an non...
kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
A use-after-free flaw was found in ip6routempathnotify in the Linux kernel. This may lead to a crash...
The vulnerability of the mctproute_input() function in the implementation of the Management Component Transport Protocol (MCTP) kernel of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the mctprouteinput function in the net/mctp/route.c module, which is part of the Management Component Transport Protocol MCTP implementation in the Linux operating system, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an...
The vulnerability of the RouteStatic function in the microprogramming software for Tenda FH1201 allows a hacker to execute arbitrary code.
The vulnerability of the RouteStatic function in the microprogramming software for Tenda FH1201 relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
CLSA-2024-1722533082 kernel: Fix of 47 CVEs
afunix: Fix garbage collector racing against connect CVE-2024-26923 - netfilter: nftlimit: reject configurations that cause integer overflow CVE-2024-26668 - libbpf: Fix use-after-free in btfdumpnamedups CVE-2022-3534 - bpf: Fix partial dynptr stack slot reads/writes CVE-2023-39191 - ima: Fix...
kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
A use-after-free flaw was found in ip6routempathnotify in the Linux kernel. This may lead to a crash...
CVE-2024-41944
CVE-2024-41944 : A SQL injection in the Xibo CMS, in the API endpoint report/data/proofofplayReport, allows an authenticated user to read/modify arbitrary data by injecting into the sortBy parameter. Affected versions: Xibo prior to 3.3.12 and prior to 4.0.14. Remediation: upgrade to version 3.3....
CVE-2024-41944 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report
Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the report/data/proofofplayReport API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the...
CVE-2024-41804
CVE-2024-41804 affects Xibo CMS (DataSet Column Formulas API). An SQL injection vulnerability is exploitable by an authenticated user via the formula parameter, enabling access to/ modification of arbitrary data in the Xibo database. Remediation: upgrade to Xibo versions 3.3.12 or 4.0.14, which f...
CVE-2024-41804 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula
Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially...
CVE-2024-41804 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula
Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially...