Azure File Sync Agent v19.1 Release – August 2024 (KB5040924)

Update Rollup for Azure File Sync agent version 19.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

CVE-2024-47818

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the "sync/cleansyncdir" endpoint. The "dirname" POST parameter is not validated/sanitized and is used to construct the "syncDir" tha...

GHSA-43F3-H63W-P6F6 Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability

Summary A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm. Details - file:...

CVE-2024-47818: Improper Limitation of a Pathname to a Restricted Directory

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is...

PT-2024-32829

Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 1.0.0-beta16 Description A logged-in user with any role can delete arbitrary files on the filesystem by calling the /sync/clean sync dir endpoint. The dir name POST parameter is not validated/sanitized and is used to...

CVE-2024-44013: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through = 2.4.0...

PT-2024-7604

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to a use-after-free vulnerability in the hci enhanced setup sync function in the Linux kernel's Bluetooth module. This vulnerability can be exploited to impact the...

io.fabric8.jenkins.plugins:openshift-sync (>=1.0.43, <=1.0.45), org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute (1.0.6) potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (2.2.0)

org.jenkins-ci.plugins:credentials MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =1.0.43, =1.0.45 -...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +15 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.651.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.aliyun.www:aliyun-container-service-deploy =0.1.0, =y, =1.0.4, =1.004, =1.0, =1.0.6,...

ROS-20241001-12

QEMU hardware emulator vulnerability is related to synchronization errors. Exploitation The vulnerability could allow an attacker acting remotely to cause a denial of service...

PT-2024-35591

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.11.5 Description A vulnerability has been resolved in the Linux kernel where the sync linked regs function must preserve subreg def. Range propagation must not affect subreg def marks. If this issue is not...

[SECURITY] Fedora 41 Update: nextcloud-29.0.6-1.fc41

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

[SECURITY] Fedora 39 Update: nextcloud-29.0.6-2.fc39

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

[SECURITY] Fedora 40 Update: nextcloud-29.0.6-2.fc40

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

net/mlx5: Fix missing lock on sync reset reload

...

dm-raid: really frozen sync_thread during suspend

...

md/dm-raid: don't call md_reap_sync_thread() directly

...

BIT-MATTERMOST-2024-39839

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the...

BIT-MATTERMOST-2024-41926

Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...

AZL-49980 CVE-2024-44962 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel ca...