UBUNTU-CVE-2024-42367

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants .gz or .br extension are vulnerable to path traversal outside the root directory if those variants are...

PT-2024-29970 · Streamlit · Streamlit

Name of the Vulnerable Software and Affected Versions: Streamlit versions prior to 1.37.0 Description: The issue is related to a path traversal vulnerability in the static file sharing feature of Streamlit. This vulnerability allows an attacker to leak the password hash of the Windows user runnin...

CVE-2024-42367 In aiohttp, compressed files as symlinks are not protected from path traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants .gz or .br extension are vulnerable to path traversal outside the root directory if those variants are...

In aiohttp, compressed files as symlinks are not protected from path traversal

Summary Static routes which contain files with compressed variants .gz or .br extension were vulnerable to path traversal outside the root directory if those variants are symbolic links. Details The server protects static routes from path traversal outside the root directory when...

GHSA-JWHX-XCG6-8XHJ In aiohttp, compressed files as symlinks are not protected from path traversal

Summary Static routes which contain files with compressed variants .gz or .br extension were vulnerable to path traversal outside the root directory if those variants are symbolic links. Details The server protects static routes from path traversal outside the root directory when...

Open WebUI 0.1.105 File Upload / Path Traversal Vulnerabilities

Title: Open WebUI Arbitrary File Upload + Path Traversal Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-006.txt 1. Vulnerability Details Affected Vendor: Open WebUI Affected Product: Open WebUI Affected Version: 0.1.105 Platform: Debian 12 CWE Classification: CWE-22:...

MAL-2024-7958 Malicious code in frontend-static-props-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb3f52abf232df0db4fc9cbe55d6234cff445cff215bbeb3e5a26a4f26b843a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-10350 · Unknown · Opigno Learning Path

Name of the Vulnerable Software and Affected Versions: Opigno Learning path versions 0.0.0 through 3.1.2 Description: The issue is related to improper neutralization of directives in statically saved code, also known as 'static code injection', which allows for PHP Local File Inclusion. This can...

PT-2024-10353 · Opigno · Opigno

Name of the Vulnerable Software and Affected Versions: Opigno module versions 0.0.0 through 3.1.2 Description: The issue is related to improper neutralization of directives in statically saved code, also known as 'Static Code Injection', which can lead to PHP Local File Inclusion. This allows a...

Ciphertext Leakage

Netbird is vulnerable to Ciphertext Leakage. The vulnerability is due to the use of a static initialization vector IV in the Encrypt function within the crypt.go file, which does not change for different encryption operations and allows attackers to expose the sensitive information through...

Nuxt Icon affected by a Server-Side Request Forgery (SSRF)

Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...

The vulnerability of the RouteStatic function in the microprogramming software for Tenda FH1201 allows a hacker to execute arbitrary code.

The vulnerability of the RouteStatic function in the microprogramming software for Tenda FH1201 relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

GHSA-9V35-4XCR-W9PH NetBird uses a static initialization vector (IV)

A static initialization vector IV in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information email addresses when in possession of the audit events database...

NetBird uses a static initialization vector (IV)

A static initialization vector IV in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information email addresses when in possession of the audit events database...

CVE-2024-41260

A static initialization vector IV in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information email addresses when in possession of the audit events database...

PT-2024-29338

Name of the Vulnerable Software and Affected Versions netbird version 0.28.4 Description The issue concerns a static initialization vector IV used in the encrypt function, allowing attackers to obtain sensitive information. This static IV is utilized in the github.com/netbirdio/netbird code...

CVE-2024-41260

CVE-2024-41260 : NetBird’s netbird management service (versions 0.23.2–0.29.1) uses a static initialization vector (IV) in the encrypt function, enabling an attacker with access to the audit events database to obtain sensitive information (email addresses). Root cause: static IV in the encryption...

CVE-2024-41260

A static initialization vector IV in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information email addresses when in possession of the audit events database...

NetBird 安全漏洞

NetBird is an open source network security platform open sourced by netbirdio. A security vulnerability exists in NetBird version 0.28.4, which stems from a static initialization vector IV in the encryption function that allows an attacker to obtain sensitive information...

CVE-2024-42090

A deadlock flaw was found in the Linux kernel’s pinctrl subsystem. This flaw allows a local user to crash the system. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and...