memcg_write_event_control(): fix a user-triggerable oops

...

CVE-2024-8970

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...

UBUNTU-CVE-2024-8970

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...

CVE-2024-8970 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...

CVE-2024-8970

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab versions 11.6 through 17.2.9 prior,...

PT-2024-6937

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.6 through 17.2.9 GitLab CE/EE versions 17.3 through 17.3.5 GitLab CE/EE versions 17.4 through 17.4.2 Description The issue is related to authentication errors in GitLab, allowing a remote attacker to trigger pipelines ...

Parse Server's custom object ID allows to acquire role privileges

Impact If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. Patches Improved validation for custom user object IDs...

PT-2024-32465

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 6.5.9 Parse Server versions prior to 7.3.0 Description The issue arises when the Parse Server option allowCustomObjectId: true is set, allowing an attacker to create a new user with a custom object ID that exploi...

The vulnerability of Juniper Networks’ Junos OS Evolved operating system, related to insufficient checking of unusual or exceptional states, allows a perpetrator to trigger a service failure.

The vulnerability of Juniper Networks’ Junos OS Evolved operating system is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by sending specially crafted TCP packets...

LibreNMS vulnerable to Stored Cross-site Scripting via File Upload

Summary Stored Cross-Site Scripting XSS can archive via Uploading a new Background for a Custom Map. Details Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripti...

CVE-2024-9400

A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

SUSE-SU-2024:3499-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-48791: Fix use-after-free for aborted TMF sastask bsc1228002 - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate bsc1229454. -...

kernel: leds: trigger: Unregister sysfs attributes before calling deactivate()

leds in linux kernel permits calling sysfs attributes show/store functions after deactivate has been called...

The vulnerability of the qgroup component in the Linux operating system’s kernel, related to resource management errors, allows a hacker to trigger a service failure.

The vulnerability of the qgroup component in the Linux operating system’s kernel is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Go programming language’s network component, which allows a hacker to trigger a service failure

The vulnerability of the Go programming language component is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2024-46800 sch/netem: fix use after free in netem_dequeue

In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netemdequeue If netemdequeue enqueues packet to inner qdisc and that qdisc returns NETXMITSTOLEN. The packet is dropped but qdisctreereducebacklog is not called to update the parent's q.qlen,...

The vulnerability of Adobe Illustrator’s graphic editor, related to the manipulation of the zero pointer, allows a hacker to trigger a service failure.

The vulnerability of the Adobe Illustrator graphic editor is related to the handling of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the DRM/Nouveau kernel component in the Linux operating system arises from improper memory release before deleting the last reference, allowing a hacker to trigger a service failure.

The vulnerability of the DRM/Nouveau kernel component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability allows an attacker to cause a service failure...

CVE-2024-6678

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances...