EulerOS 2.0 SP12 : grub2 (EulerOS-SA-2024-1871)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a temporary file with...

CVE-2024-3017 Denial of service in multi-protocol gateway - Zigbee + Thread

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

PT-2024-28360 · Zziplib +1 · Zziplib +1

Name of the Vulnerable Software and Affected Versions: zziplib version 0.13.77 Description: A Heap Buffer Overflow issue allows attackers to cause a denial of service. This is achieved through the zzip parse root directory function located at /zzip/zip.c. Recommendations: For zziplib version...

CVE-2024-38271

There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiF...

CVE-2024-29177

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the reuse of disclosed information to gain...

Imagestream Export or Restore Fails With "error writing layer: no space left on device"

Challenge Export Action or Restore Action of OpenShift Imagestream fails with the following error: Failed to exec command in pod: command terminated with exit code 1.stdout: error writing layer: write/var/lib/image//blobs/sha256/: no space left on device Cause During the export or restore of an...

PT-2024-34936 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.14.0 Description: A command injection issue exists due to the application's handling of the backend parameter in the configuration file. This parameter is used in the name of the initialized process, allowing an...

python: Path traversal on tempfile.TemporaryDirectory

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...

PT-2024-5800 · Openvpn +6 · Openvpn +6

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.0 through 2.6.10 Description: The issue is related to OpenVPN's handling of exit notifications from authenticated clients in a server role. When multiple exit notifications are accepted, it can extend the validity of a...

PT-2024-28271 · H3C · H3C Magic R230

Name of the Vulnerable Software and Affected Versions: H3C Magic R230 version V100R002 Description: The issue allows attackers to execute arbitrary commands due to the udpserver opening port 9034. Recommendations: For H3C Magic R230 version V100R002, consider restricting access to port 9034 as a...

OESA-2024-1742 python-pyinstaller security update

PyInstaller bundles a Python application and all its dependencies into a single package. The user can run the packaged app without installing a Python interpreter or any modules. Security Fixes: PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller...

PT-2024-11501 · Unknown · Classgraph

Name of the Vulnerable Software and Affected Versions: ClassGraph versions prior to 4.8.112 Description: The issue concerns the susceptibility of ClassGraph to XML eXternal Entity XXE attacks. This means that an attacker could potentially exploit the software by injecting malicious XML code,...

CVE-2024-37343 Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with valid tunnel credentials can pass a limited-length script to the administrative console which is then temporarily stored where an administrato...

Insecure Temporary File

salt is vulnerable to Insecure Temporary File. The vulnerability is caused by insecure permissions of /tmp within state.py, which could allow an attacker on the system to read arbitrary files created by salt...

PT-2024-13678 · Unknown · Kiuwan Sast

Name of the Vulnerable Software and Affected Versions: Kiuwan SAST version Description: The issue concerns an API endpoint "/saas/rest/v1/info/application" that allows access to information about any application, using the application parameter. This endpoint lacks proper access control, enabling...

PT-2024-32622 · WordPress · Youzify – Buddypress Community

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions 1.2.5 and earlier Description: The issue allows authenticated attackers with Contributor-level access and above to perform SQL Injecti...

PT-2024-5694

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M20 Apache Tomcat versions 10.1.0-M1 through 10.1.24 Apache Tomcat versions 9.0.0-M1 through 9.0.89 Description The issue is related to the improper handling of exceptional conditions and...

PT-2024-27077 · Unknown · Akbr Update

Name of the Vulnerable Software and Affected Versions: akbr update version 1.0.0 Description: The issue is related to Prototype Pollution, which occurs via the update/index.js file. Recommendations: For akbr update version 1.0.0, consider restricting access to the update/index.js file as a...

PT-2024-26945 · Freefrom · Freefrom

Name of the Vulnerable Software and Affected Versions: FreeFrom - the nostr client versions prior to 1.3.5 Description: The issue is related to improper verification of cryptographic signatures. This means the affected app cannot detect event data with invalid signatures, potentially allowing...

PT-2024-12303 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions 2.7.0 through 2.7.13 Rancher versions 2.8.0 through 2.8.4 Description: A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplate objects when external=true, which in...