1739 matches found
Ubuntu 16.04 LTS / 18.04 LTS : Git vulnerabilities (USN-7023-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7023-1 advisory. Maxime Escourbiac and Yassine Bengana discovered that Git incorrectly handled some gettext machinery. An attacker could possibly use this iss...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2024:3306-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3306-1 advisory. - Update to version 0.103.12 - CVE-2024-20506: Disable symlinks following to prevent an attacker...
SUSE-SU-2024:3305-1 Security update for clamav
This update for clamav fixes the following issues: - Update to version 0.103.12 - CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. bsc1230162 - CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. bsc1230161...
CVE-2024-44132
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox...
CVE-2024-44132
CVE-2024-44132 is a macOS sandbox escape issue resolved in macOS Sequoia 15. The vulnerability arises from improper handling of symlinks, enabling a sandboxed app to break out of its confinement. Public references (NVD, NCSC advisories, Red Hat RH security) corroborate the same description and fi...
Fedora: Security Advisory (FEDORA-2024-05d7ee197e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2024:3228-1 Security update for clamav
This update for clamav fixes the following issues: - Update to version 0.103.12 - CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. bsc1230162 - CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. bsc1230161...
USN-6991-1 python-aiohttp vulnerability
It was discovered that AIOHTTP did not properly restrict file access when the 'followsymlinks' option was set to True. A remote attacker could possibly use this issue to access unauthorized files on the system...
GO-2022-0304 Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd
Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd...
EulerOS Virtualization 2.11.1 : python3 (EulerOS-SA-2024-2172)
According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18...
EulerOS Virtualization 2.11.0 : python3 (EulerOS-SA-2024-2198)
According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18...
CVE-2024-42367 In aiohttp, compressed files as symlinks are not protected from path traversal
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants .gz or .br extension are vulnerable to path traversal outside the root directory if those variants are...
CVE-2024-42367
The CVE-2024-42367 issue affects aiohttp (Python) on the 3.10 branch prior to 3.10.2. It describes a path traversal vulnerability in static routes that serve files with compressed variants (.gz, .br) when those variants are symbolic links. The root cause is that, although the server normally prot...
CVE-2024-42367 In aiohttp, compressed files as symlinks are not protected from path traversal
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants .gz or .br extension are vulnerable to path traversal outside the root directory if those variants are...
CVE-2023-33206
Diebold Nixdorf Vynamic Security Suite VSS before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlinks during the Pre-Boot Authorization PBA process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk...
EulerOS 2.0 SP11 : git (EulerOS-SA-2024-2081)
According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be...
PT-2024-12422 · Diebold Nixdorf · Vynamic Security Suite
Name of the Vulnerable Software and Affected Versions: Diebold Nixdorf Vynamic Security Suite VSS versions prior to 3.3.0 SR16 Diebold Nixdorf Vynamic Security Suite VSS versions prior to 4.0.0 SR06 Diebold Nixdorf Vynamic Security Suite VSS versions prior to 4.1.0 SR04 Diebold Nixdorf Vynamic...
CVE-2024-27872
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data...