Pi-hole 安全漏洞

Pi-hole is a web-grade ad-blocking application from Pi-hole, Inc. A security vulnerability exists in versions prior to Pi-hole 6. An attacker exploiting the vulnerability could change the temperature units of the web dashboard...

PT-2024-30935 · Pi-Hole · Pi-Hole

Name of the Vulnerable Software and Affected Versions: Pi-hole versions prior to 6 Description: The issue allows unauthenticated calls to "admin/api.php?setTempUnit=" to change the temperature units of the web dashboard. The supplier reportedly does not consider this a security issue, but the...

UBUNTU-CVE-2024-7545

oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this...

CVE-2024-42102

A vulnerability was found in the wbdirtylimits function in the Linux kernel, where a removed u64 cast in the dtc-wbthresh dtc-bgthresh operation can result in multiplication overflow on 32-bit architectures. This issue could lead to memory corruption or performance issues. Mitigation Mitigation f...

CVE-2024-42102 Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"

In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wbdirtylimits, again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch...

PT-2024-37521 · Conduit · Conduit

Name of the Vulnerable Software and Affected Versions: Conduit affected versions not specified Description: The issue is related to the lack of consideration of key expiry when validating signatures in Conduit. This allows an attacker who has compromised an expired key to forge requests as the...

CVE-2024-33687

CVE-2024-33687 concerns Omron NJ/NX series CPU units (all versions) with an insufficient verification of data authenticity (CWE-345). The issue allows altered user programs to potentially go undetected. Root cause is improper verification of data authenticity in affected devices. Impact notes fro...

CVE-2020-27352

The CVE-2020-27352 issue affects snapd (e.g., the docker snap and similar snaps) where the systemd service units for these snaps are generated without setting Delegate=yes. This omission allows systemd to move processes from containers managed by the snap into the cgroup of the snap’s main daemon...

CVE-2020-27352

When generating the systemd service units for the docker snap and other similar snaps, snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading syst...

Schneider Electric SAGE RTUs Security Vulnerability

Schneider Electric SAGE RTUs is a high-performance device for industrial automation and remote monitoring from Schneider Electric France. A security vulnerability exists in the Schneider Electric SAGE RTUs that stems from the presence of incorrect default permissions that allow authenticated user...

Schneider Electric SAGE RTUs Security Vulnerability

Schneider Electric SAGE RTUs is a high-performance device for industrial automation and remote monitoring from Schneider Electric France. A security vulnerability exists in the Schneider Electric SAGE RTUs that stems from buffer copying without checking the input size, which could allow a user wi...

Schneider Electric SAGE RTUs 缓冲区错误漏洞

Schneider Electric SAGE RTUs are a high-performance device for industrial automation and remote monitoring from Schneider Electric, France. An out-of-bounds read vulnerability exists in the Schneider Electric SAGE RTUs, which can be exploited by an attacker to cause a denial of service in the...

RHEL 8 : booth (RHSA-2024:3659)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3659 advisory. The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inpu...

PT-2024-25295 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions 7.20 through 7.29 ILIAS versions 8.4 through 8.10 ILIAS version 9.0 Description: A Stored Cross-site Scripting XSS vulnerability in the "Import of organizational units and title of organizational unit" feature allows remote...

Cyber Power Systems PowerPanel Business Edition 安全漏洞

Cyber Power Systems PowerPanel Business Edition is a suite of power management software from Cyber Power Systems, USA. The software automates the shutdown of physical and virtual infrastructures, and monitors and manages CyberPower UPS systems and network-connected PDUs Power Distribution Units. ...

CVE-2024-2617

A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature was not enabled on all CMUs of a RTU500. If a malicious actor successfully exploits this vulnerability, they could use it to update the RTU500 with unsigned...

Mageia: Security Advisory (MGASA-2024-0136)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated puppet packages fix security vulnerabilities

The updated packages fix missing requires for puppet and fix commands in systemd units...

MGASA-2024-0136 Updated puppet packages fix security vulnerabilities

The updated packages fix missing requires for puppet and fix commands in systemd units...

CVE-2024-3528

A vulnerability was found in Campcodes Complete Online Student Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file unitsview.php. The manipulation of the argument FirstRecord leads to cross site scripting. The attack may be launche...