CVE-2024-31226 Sunshine's unquoted executable path could lead to hijacked execution flow

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

PT-2024-4727 · Microsoft · Net Core

Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names in the .NET Core component of the "Сервис оправдательных документов" software. Exploitation of...

PT-2024-4728 · Ооо 'Кейсистемс' · Сервис Оправдательных Документов

Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names. It may allow a remote attacker to gain read and write access to local files. Recommendations:...

CVE-2024-32742

A vulnerability has been identified in SIMATIC CN 4100 All versions V3.0. The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem...

PT-2024-5553 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 7.4.0 through 7.4.1 FortiADC versions prior to 7.2.4 Description: The issue is related to improper access control in the administrative interface of FortiADC, allowing a remote attacker to gain write access to arbitrary file...

RHEL 8 : gegl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gegl: write access violation geglbufferiteratereadsimple function in buffer/gegl-buffer-access.c...

CVE-2024-34346 Deno contains a permission escalation via open of privileged files with missing `--deny` flag

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access...

CVE-2024-3746

The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write or overwrite files...

CVE-2024-3746

Measuresoft ScadaPro version 6.9.0.0 is affected by an Improper Access Control vulnerability (CWE-284 ). The software is configured by default to allow all users, including unprivileged users , to write or overwrite files within the C:\ScadaPro parent directory and its sub-directories. Successful...

Measuresoft ScadaPro Access Control Vulnerability

Measuresoft ScadaPro Server is a powerful real-time data acquisition software package from Measuresoft Ireland. It provides monitoring, data logging, simulation development and report generation. An Access Control Error vulnerability exists in Measuresoft ScadaPro version 6.9.0.0, which stems fro...

RHEL 8 : container-tools:rhel8 (RHSA-2024:2098)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2098 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Bug Fixes: containerinitt does not...

buildah: Buildah: Container escape via improper bind mount validation

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

CVE-2024-28976

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

CVE-2024-28976

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

CVE-2024-28976

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

CVE-2024-28976

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

CVE-2024-26920

In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix registersnapshottrigger to return error code if it failed to allocate a snapshot instead of 0 success. Unless that, it will register snapshot trigger without an...

CVE-2024-26919

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: Fix debugfs directory leak The ULPI per-device debugfs root is named after the ulpi device's parent, but ulpiunregisterinterface tries to remove a debugfs directory named after the ulpi device itself. This results in t...

CVE-2024-21030

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2024-21022

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...