SUSE CVE-2024-26878

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquotfreeinode quotaoff dropdquotref removedquotref dquots = idquotinode dquots = idquotinode srcureadlock dquotscnt != NULL 1...

PT-2024-6572

Name of the Vulnerable Software and Affected Versions: Ffmpeg version N113007-g8d24a28d06 Description: The issue is related to a buffer overflow in the libavcodec/jpegxl parser.c file, specifically in the gen alias map function. This can allow a local attacker to execute arbitrary code, potential...

The vulnerability of the Java framework for securing industrial applications using Spring Security lies in the incomplete cleanup of temporary or auxiliary resources. This allows attackers to access confidential data or cause service failures.

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data or cause service failure...

PT-2024-13451 · Unknown · Hexo-Theme-Matery

Name of the Vulnerable Software and Affected Versions: hexo-theme-matery version 2.0.0 Description: The issue lies in the verifyPassword function, allowing attackers to bypass authentication and access password-protected pages. Recommendations: For hexo-theme-matery version 2.0.0, as a temporary...

PT-2024-24598 · Tolgee · Tolgee

Name of the Vulnerable Software and Affected Versions: Tolgee versions 3.57.2 through 3.57.3 Description: Tolgee is an open-source localization platform. When an API key created by an admin user is used, it bypasses the permission check at all. Recommendations: For Tolgee versions 3.57.2 through...

DEBIAN-CVE-2024-26878

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquotfreeinode quotaoff dropdquotref removedquotref dquots = idquotinode dquots = idquotinode srcureadlock dquotscnt != NULL 1...

UBUNTU-CVE-2024-26878

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquotfreeinode quotaoff dropdquotref removedquotref dquots = idquotinode dquots = idquotinode srcureadlock dquotscnt != NULL 1...

CVE-2024-26882 net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: make sure to pull inner header in iptunnelrcv Apply the same fix than ones found in : 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" 1ca1ba465e55 "geneve: make sure to pull inner header in...

PT-2024-23700 · Unknown · Cyber Cafe Management System

Name of the Vulnerable Software and Affected Versions: Cyber Cafe Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the compname parameter in the "edit-computer-details.php" API endpoint. Recommendations: For Cyber Cafe...

PT-2024-24522 · Boidcms · Boidcms

Name of the Vulnerable Software and Affected Versions: Boid CMS version 2.1.0 Description: A cross-site scripting XSS vulnerability in the Create Page of Boid CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter. Recommendations:...

PT-2024-22883 · Cskefu · Cskefu

Name of the Vulnerable Software and Affected Versions: cskefu version 7 Description: The issue is related to Insufficient Session Expiration, which allows attackers to exploit old sessions for malicious activity. Recommendations: For cskefu version 7, consider implementing proper session expirati...

PT-2024-3222 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: The issue is related to the class FileTransfer in Brocade SANnav, which uses the ssh-rsa signature scheme with a SHA-1 hash. This could allow a remote,...

PT-2024-24063 · Favicon · Favicon

Name of the Vulnerable Software and Affected Versions: Favicon versions 1.3.29 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-24403 · Unknown · Advanced Page Visit Counter

Name of the Vulnerable Software and Affected Versions: Advanced Page Visit Counter versions n/a through 8.0.6 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This vulnerability affects the...

PT-2024-24578 · Unknown · Ads.Txt Admin

Name of the Vulnerable Software and Affected Versions: Ads.Txt Admin versions 1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Ads.Txt Admin. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the...

The vulnerability of the Jenkins automation server relates to the creation of temporary files with insecure permissions, allowing a malicious actor to gain read, modify, or delete access to these files.

The vulnerability of the Jenkins automation server relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow a remote attacker to gain read, modify, or delete access to these files...

The vulnerability of the Jenkins automation server lies in its ability to allow unlimited loading of dangerous files, enabling a hacker to gain access to read, modify, or delete these files.

The vulnerability of the Jenkins automation server relates to the loading of files using the Stapler web platform. Stapler creates temporary files in a temporary directory system, with default permissions for newly created files. Exploiting this vulnerability allows an attacker to gain read,...

PT-2024-24434 · Unknown · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher versions through 4.0.12 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This allows for potential exploitation ...

PT-2024-3328 · Maccms · Maccms

Name of the Vulnerable Software and Affected Versions: Macs CMS version 1.1.4f Description: The issue is related to a lack of protection against SQL injection attacks when handling certain parameters, including resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole,...

PT-2024-27180 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.112-UTF8 Description: A critical issue was found in DedeCMS, affecting an unknown function of the file stepselect main.php. The manipulation of the ids argument leads to SQL injection. This issue can be exploited remotely...