PT-2021-6458

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 7.2 Description The issue concerns arbitrary code execution when an attacker can change environment variables for the user running the script. This affects those using gradlew on Unix-like systems or scripts generated ...

PT-2024-11312 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free UAF bug in the emac remove function. The adpt variable, which is netdev private data, cannot be used after the free netdev call. Using adpt aft...

CVE-2020-7389

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

Astra-OpenVPN-Server Integer Overflow DoS

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to improperly defined variable boundaries. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the parsec inodepostxattr function in the Linux-Astra-modules is related to a variable overflow, which subsequently leads to a null-ptr-deref error. Exploiting this vulnerability allows an attacker to cause service failures...

Advisory ROSA-SA-2021-2001

Software: xdg-utils 1.1.0 OS: Cobalt 7.9 CVE-ID: CVE-2014-9622 CVE-Crit: HIGH CVE-DESC: Eval injection vulnerability in xdg-utils 1.1.0 RC1 in the absence of a supported desktop environment allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open. CVE-STATUS:...

Advisory ROSA-SA-2021-1837

Software: fuse 2.9.2 OS: Cobalt 7.9 CVE-ID: CVE-2015-3202 CVE-Crit: HIGH CVE-DESC: fusermount in FUSE before 2.9.3-15 incorrectly clears the environment before calling 1 mount or 2 umount as root user, which allows local users to write arbitrary files via a created environment variable...

EulerOS Virtualization for ARM 64 3.0.2.0 : libwebp (EulerOS-SA-2021-2104)

According to the versions of the libwebp package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libwebp. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this...

CVE-2021-31838 Command injection through environment variable in MVISION EDR

A command injection vulnerability in MVISION EDR MVEDR prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'...

PT-2023-12201

Name of the Vulnerable Software and Affected Versions Saltstack versions 3003 and before Description The issue allows an attacker to execute arbitrary code via the func variable in the salt/salt/modules/status.py file. This is a Buffer Overflow vulnerability. Note that there is a dispute regardin...

OS Command Injection in sofianehamlaoui/lockdoor-framework

✍️ Description Command Injection due to unsanitized variable named algo 🕵️‍♂️ Proof of Concept 💥 Impact CI with the highest privilege...

PT-2021-29260

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.5 through v5.12.9 Description The issue is related to a NULL pointer dereference in the convert variable location function. This problem was introduced in version v5.5 and is fixed in version v5.12.10. The actual impac...

PT-2021-25235

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.5 through v5.10.42 Description The issue is related to a NULL pointer dereference in the convert variable location function. This problem was introduced in version v5.5 and is fixed in version v5.10.43. The actual impa...

PT-2021-25266

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.5 through v5.12.9 Description: The issue is related to a NULL pointer dereference in the convert variable location function. This problem was introduced in version v5.5 and is fixed in version v5.12.10. The actual...

PT-2021-29229

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.5 through v5.10.42 Description The issue is related to a NULL pointer dereference in the convert variable location function. This problem was introduced in version v5.5 and is fixed in version v5.10.43. The actual impa...

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library which has the surprising side-effect that if an application sets up multiple concurrent transfers the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario this weakens transport security significantly.

...

Updated puddletag packages fix security vulnerability

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injectio via the template function, particularly when a variable property is passed as an argument as it is not sanitized CVE-2021-23358...

libwebp Heap Buffer Overflow Code Execution

The vulnerability of the libwebp library for encoding and decoding WebP images is related to the use of an uninitialized variable. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Information Disclosure

bluez is vulnerable to information disclosure. The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the offset variable before using it as an index into an array for reading...

D-Link DIR-2640-US buffer error vulnerability

The D-Link DIR-2640-US is a smart AC2600 high power Wi-Fi Gigabit router. A buffer overflow vulnerability exists in the D-Link DIR-2640-US version 1.01B04. An attacker can exploit this vulnerability by overriding a global variable in a .bss segment to cause a process crash or change...