LibreNMS vulnerable to Stored Cross-site Scripting via File Upload

Summary Stored Cross-Site Scripting XSS can archive via Uploading a new Background for a Custom Map. Details Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripti...

CVE-2024-9400

A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

SUSE-SU-2024:3499-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-48791: Fix use-after-free for aborted TMF sastask bsc1228002 - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate bsc1229454. -...

kernel: leds: trigger: Unregister sysfs attributes before calling deactivate()

leds in linux kernel permits calling sysfs attributes show/store functions after deactivate has been called...

The vulnerability of the Go programming language’s network component, which allows a hacker to trigger a service failure

The vulnerability of the Go programming language component is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the qgroup component in the Linux operating system’s kernel, related to resource management errors, allows a hacker to trigger a service failure.

The vulnerability of the qgroup component in the Linux operating system’s kernel is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2024-46800 sch/netem: fix use after free in netem_dequeue

In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netemdequeue If netemdequeue enqueues packet to inner qdisc and that qdisc returns NETXMITSTOLEN. The packet is dropped but qdisctreereducebacklog is not called to update the parent's q.qlen,...

The vulnerability of Adobe Illustrator’s graphic editor, related to the manipulation of the zero pointer, allows a hacker to trigger a service failure.

The vulnerability of the Adobe Illustrator graphic editor is related to the handling of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the DRM/Nouveau kernel component in the Linux operating system arises from improper memory release before deleting the last reference, allowing a hacker to trigger a service failure.

The vulnerability of the DRM/Nouveau kernel component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability allows an attacker to cause a service failure...

CVE-2024-6678

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances...

UBUNTU-CVE-2024-6678

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances...

CVE-2024-6678

Removed by vendor...

CVE-2024-6678

GitLab CE/EE vulnerable in versions from 8.14 up to 17.1.7, from 17.2 up to 17.2.5, and from 17.3 up to 17.3.2. The issue allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances. The affected components are GitLab pipelines; root cause details are not provided in...

CVE-2024-6678 Authentication Bypass by Spoofing in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances...

The vulnerability of the TrigVector::release function (module jrd.cpp) in the database management system “Red Database” allows a attacker to cause a service failure on the server.

The vulnerability of the TrigVector::release function module jrd.cpp in the “Red Database” database management system is related to the fact that when a trigger is executed, which also modifies another object in another context, there is a possibility of a crash due to the use of a previously fre...

leds: trigger: netdev: Fix kernel panic on interface rename trig notify

...

Improper Encoding (Escaping Of Output)

Apache Airflow is vulnerable to Improper Encoding Escaping of Output. The vulnerability is due to the example DAG exampleinleteventextra.py allowing authenticated attackers with DAG trigger permissions to execute arbitrary commands...

BIT-AIRFLOW-2024-45498 Apache Airflow: Command Injection in an example DAG

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

PYSEC-2024-266

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

CVE-2024-45498 Apache Airflow: Command Injection in an example DAG

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...