kernel: buffer uses out of index in ext3/4 filesystem

A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability...

Cross-Site Scripting Vulnerability in Multiple Schneider Electric Products

Schneider Electric EcoStruxure Power Monitoring Expert is a product of the French company Schneider Electric.Schneider Electric EcoStruxure Power Monitoring Schneider Electric EcoStruxure Power Monitoring Expert is a device for power distribution monitoring in IoT environments.Schneider Electric...

pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab

It was found that the Key Recovery Authority KRA Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting XSS vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code...

UBUNTU-CVE-2020-13339

An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted...

PT-2020-13480 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.2.10 GitLab versions prior to 13.3.7 GitLab versions prior to 13.4.2 Description: An issue has been discovered in GitLab, where there is an XSS in SVG File Preview. The overall impact is limited, as only the curren...

fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket if the socket is being moved to a new parent directory and its old parent directory is being removed.

...

Automattic: Permanent DoS with one click.

Summary: Hello Team, messages of a user who deletes their account leave DoS effects on another user. Platforms Affected: website/mobile app/service Steps To Reproduce & PoC: Before you start testing, create two accounts. [email protected] [email protected] Confirm e-mails to sen...

GHSA-5JPF-PJ32-XX53 Authorization header is not sanitized in an error object in auth0

Overview Versions before and including 2.27.0 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be...

kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is...

UBUNTU-CVE-2018-12201

Buffer overflow vulnerability in Platform Sample / Silicon Reference firmware for 8th Generation IntelR Core Processor, 7th Generation IntelR Core Processor, IntelR PentiumR Silver J5005 Processor, IntelR PentiumR Silver N5000 Processor, IntelR CeleronR J4105 Processor, IntelR CeleronR J4005...

You are not alone; Facebook, Instagram and WhatsApp are down for many (Updated)

By Waqas You are not alone; the social media giant Facebook and its subsidiaries Instagram and WhatsApp Messenger are down in many countries around the world for almost an hour starting from 10 pm UK time. The reason for this outage is currently unknown and there has been no statement from...

CVE-2018-10879

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4xattrsetentry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image...

CVE-2018-5714

In Malwarefox Anti-Malware 2.72.169, the driver file zam64.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054...

CVE-2017-16766

An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager DSM before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option...

DEBIAN-CVE-2017-16536

The cx231xxusbprobe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

UBUNTU-CVE-2014-0047

Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage...

CVE-2014-0047

Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage...

CVE-2017-6007

A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 included in the HitmanPro.Alert solution and Sophos Clean allows local users to crash the OS via a malformed IOCTL call...

BSA-2017-353

Security Advisory ID : BSA-2017-353 Component : Linux Kernel Revision : 3.0: Interim The IPv6 DCCP implementation in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue t...

Qemu: usb: redirector: memory leakage when destroying redirector

Quick Emulator Qemu built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredirhandledestroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...