kernel: RDMA/uverbs: NULL pointer dereference in uapi_finalize()

An issue was discovered in the Linux kernel through 5.16-rc6. uapifinalize in drivers/infiniband/core/uverbsuapi.c lacks check of kmallocarray...

kernel: RDMA/uverbs: NULL pointer dereference in uapi_finalize()

An issue was discovered in the Linux kernel through 5.16-rc6. uapifinalize in drivers/infiniband/core/uverbsuapi.c lacks check of kmallocarray...

PT-2021-7531 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.16-rc6 Description: An issue was discovered in the Linux kernel where the uapi finalize function in drivers/infiniband/core/uverbs uapi.c lacks a check of kmalloc array. This issue is related to a pointer...

Geutebruck instantrec Remote Command Execution Exploit

This Metasploit module exploits a buffer overflow within the 'action' parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions equal to 1.12.0.27 as well as firmware versions 1.12.13.2 and...

kernel security and bug fix update

3.10.0-1160.11.1.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 slotsret under spinlockirq protection Rafael...

CVE-2020-10116

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

Design/Logic Flaw

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

Design/Logic Flaw

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

CVE-2020-10117

CVE-2020-10117 affects cPanel prior to 84.0.20, where enforcement of demo checks in the Market UAPI namespace is mishandled (SEC-542). The issue enables weaknesses in access/validation that could impact confidentiality and integrity (per CVSS3.1: High, with Network access and no user interaction)...

CVE-2020-10117

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

CVE-2020-10116

CVE-2020-10116 affects cPanel prior to 84.0.20. An attacker can bypass restrictions on features and demo accounts via WebDisk UAPI calls, enabling a restriction-bypass condition (SEC-541). The issue is tied to versions before 84.0.20; upgrade to 84.0.20 or later to remediate.

PT-2020-11938

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to...

CVE-2020-10117: Undefined Security Weakness

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...

PT-2020-11939

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue is related to the mishandling of enforcement of demo checks in the Market UAPI namespace. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the...

CVE-2020-10116: Missing Authorization

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...

CVE-2018-10465

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

Information disclosure

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

CVE-2018-10465

CVE-2018-10465 affects Jamf Pro 10.x before 10.3.0, where users with login access had full CRUD rights to the Universal API (UAPI) endpoints, regardless of privileges. Root cause: Incorrect Access Control allowing unauthorized information disclosure, compromised data integrity, and potential data...

CVE-2018-10465

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...

PT-2020-8514

Name of the Vulnerable Software and Affected Versions: Jamf Pro versions prior to 10.3.0 Description: The issue concerns incorrect access control, where Jamf Pro user accounts and groups with login access to Jamf Pro have full access to endpoints in the Universal API UAPI, regardless of their...