BIT-VALKEY-2023-45145 Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

BIT-KEYDB-2021-32675 DoS vulnerability in Redis

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

BIT-KEYDB-2023-45145 Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

PT-2024-5978 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based versions prior to 128.0.2739.42 Description: The issue is related to insufficient input validation in Microsoft Edge, allowing an attacker to execute arbitrary code. There is no information provided about the...

PT-2024-30675 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.10.x through 9.10.0 Description: The issue is related to improper access controls, allowing any authenticated user, including guests, to mark any channel inside any team as read fo...

PT-2024-30138 · Unknown · Kashipara Hotel Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Hotel Management System version 1.0 Description: A Cross-Site Request Forgery CSRF issue was found in the system via the "/admin/delete room.php" API endpoint. This allows an attacker to perform unauthorized actions on the system...

PT-2024-38789 · Totolink · Totolink Ac1200 T8

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 T8 version 4.1.5cu.862 B20230228 Description: A critical vulnerability has been found, affecting the setDiagnosisCfg function, which leads to os command injection. The attack can be launched remotely. The vendor was contacted...

PT-2024-30145 · Unknown · Kashipara Hotel Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Hotel Management System version 1.0 Description: An Incorrect Access Control issue was found in the /admin/delete room.php endpoint, allowing an unauthenticated attacker to delete valid hotel room entries in the administrator sectio...

PT-2024-31476 · Matrix +1 · Libolm +1

Name of the Vulnerable Software and Affected Versions: Matrix libolm versions 3.2.16 and earlier Description: There is Ed25519 signature malleability due to lack of validation criteria in the libolm implementation of Olm, which does not ensure that S n. This issue only affects products that are n...

PT-2024-32163

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.52 Description A null pointer dereference issue has been resolved in the Linux kernel. The issue occurs when req op level equals SMB2 OPLOCK LEVEL LEASE and parse lease state returns NULL, causing a null...

CKAN has Cross-site Scripting vector in the Datatables view plugin

The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Impact Sites running CKAN = 2.7.0 with the datatablesview plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to...

PT-2024-5908 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 128.0.6613.84 Description: The issue is related to an inappropriate implementation in V8, which can allow a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. This can b...

matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

Impact A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain' method, so...

SUSE CVE-2024-42486

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could lead to Gateway...

PT-2024-30562 · Megabot +1 · Megabot +1

Name of the Vulnerable Software and Affected Versions: MEGABOT versions prior to 1.5.0 Description: The /math command in MEGABOT contains a remote code execution issue due to a Python eval function. This allows an attacker to inject Python code into the expression parameter when using /math in an...

PT-2024-28348 · Friendica · Friendica

Name of the Vulnerable Software and Affected Versions: Friendica version 2024.03 Description: The issue is related to Cross Site Scripting XSS in the settings/profile section via the homepage, xmpp, and matrix parameters. This allows for potential malicious script execution. Recommendations: For...

PT-2024-30561 · Kanister +1 · Kanister +1

Name of the Vulnerable Software and Affected Versions: Kanister affected versions not specified Description: Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding...

PT-2024-38754 · Genexis · Genexis Tilgin Home Gateway

Name of the Vulnerable Software and Affected Versions: Genexis Tilgin Home Gateway version 322 AS0500-03 05 13 05 Description: This issue affects some unknown processing of the file "/vood/cgi-bin/vood view.cgi?lang=EN&act=user/spec...

PT-2024-30557 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions prior to 2.3.0 Description: A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks, enabling them to modify a namespace without the necessar...

PT-2024-30566 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost versions 4.46.0 through 5.89.4 Description: The issue is related to improper authentication on some endpoints used for member actions, allowing an attacker to perform member-only actions and read member information. Recommendations: For...