PT-2024-4183 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.2.4 through 16.10.5 GitLab CE/EE versions 16.11 through 16.11.2 GitLab CE/EE versions 17.0 through 17.0.0 Description: A denial of service DoS condition was discovered in GitLab CE/EE. This issue is related to...

grub2: grub2-set-bootflag can be abused by local (pseudo-)users

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not ...

PT-2024-26544 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/ca deal.php" with parameters mudi and nohrefStr. This allows for unauthorized requests. Recommendations: For idccms version 1.35,...

PT-2024-26539 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/infoMove deal.php?mudi=add&nohrefStr=close". This issue allows for unauthorized requests to be made on behalf of the user...

PT-2024-26537 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/infoWeb deal.php?mudi=add". This issue allows for malicious requests to be made on behalf of the user. Recommendations: For idccm...

CVE-2021-47368 enetc: Fix illegal access when reading affinity_hint

In the Linux kernel, the following vulnerability has been resolved: enetc: Fix illegal access when reading affinityhint irqsetaffinityhit stores a reference to the cpumaskt parameter in the irq descriptor, and that reference can be accessed later from irqaffinityhintprocshow. Since the cpumask...

PT-2024-26265 · Likeshop · Likeshop

Name of the Vulnerable Software and Affected Versions: Likeshop versions prior to 2.5.7 Description: The issue allows attackers to run arbitrary SQL commands via the OrderLogic::getOrderList function, which can be exploited at the "/admin/order/lists.html" endpoint. Recommendations: For versions...

CVE-2022-44581

Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2...

CVE-2022-44581

Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2...

The vulnerability of the FortiClient for MAC protection mechanism lies in improper external management of file names or paths, allowing attackers to execute arbitrary code.

The vulnerability of the FortiClient for MAC protection tool is related to incorrect external manipulation of the file name or file path. Exploiting this vulnerability allows an attacker to execute arbitrary code by writing the malicious file to the /tmp directory...

PT-2024-25655 · Unknown · Imartinez/Privategpt

Name of the Vulnerable Software and Affected Versions: imartinez/privategpt version 0.2.0 Description: The issue allows attackers to read arbitrary files from the filesystem by exploiting a local file inclusion vulnerability. This can be achieved by manipulating file upload functionality to inges...

PT-2024-3700 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions 2024.03 through 2024.03.1 Description: The issue exists due to inadequate protection of the web page structure in the CI/CD system, allowing a remote attacker to conduct a cross-site scripting XSS attack. Several...

PT-2024-26271 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in idccms via the component admin/sysImages deal.php?mudi=infoSet. This allows for unauthorized actions to be performed on behalf of a user...

CVE-2023-5936

On Unix systems Linux, MacOS, Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges...

CVE-2023-5936

CVE-2023-5936 affects Arc on Unix (Linux/macOS) where Arc uses a temporary file with unsafe permissions. The underlying root cause is insecure temporary data privileges, which a local attacker can tamper with to trigger arbitrary code execution with root privileges. Affected versions are Arc prio...

CVE-2023-5936 Unsafe temporary data privileges on Unix systems in Arc before v1.6.0

On Unix systems Linux, MacOS, Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges...

Unsafe temporary data privileges on Unix systems in Arc before v1.6.0

Summary On Unix systems Linux, MacOS, Arc uses a temporary file with unsafe privileges. Impact By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges. Mitigation N/A Solution Upgrade to v1.6.0 or later...

PT-2024-14845 · Arc · Arc

Name of the Vulnerable Software and Affected Versions: Arc affected versions not specified Description: The issue concerns the use of a temporary file with unsafe privileges on Unix systems, including Linux and MacOS. A malicious local user may be able to tamper with this file, potentially...

PT-2024-26270 · Unknown · Code-Projects Budget Management

Name of the Vulnerable Software and Affected Versions: Code-projects Budget Management version 1.0 Description: The issue is related to SQL Injection, which occurs via the delete parameter. This allows for potential manipulation of database queries. Recommendations: For Code-projects Budget...

Arc 安全漏洞

ARC is a software package for creating and maintaining file archives. A security vulnerability exists in versions prior to Arc v1.6.0 that stems from the use of temporary files with insecure permissions, where a local user on the system may be able to trigger arbitrary code execution with root...