Last update performed on 03/18/2024 at 11:57:07 PM

(14) CRITICAL VULNERABILITIES [9.0, 10.0]

Source : patchstack.com

Vulnerability ID : CVE-2024-27957

First published on : 17-03-2024 17:15:06
Last modified on : 17-03-2024 22:38:29

Description :
Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1.

CVE ID : CVE-2024-27957
Source : audit@patchstack.com
CVSS Score : 10.0

References :
https://patchstack.com/database/vulnerability/pie-register/wordpress-pie-register-plugin-3-8-3-1-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-434

Source : cyber.gov.il

Vulnerability ID : CVE-2024-27767

First published on : 18-03-2024 14:15:08
Last modified on : 18-03-2024 19:40:00

Description :
CWE-287: Improper Authentication may allow Authentication Bypass

CVE ID : CVE-2024-27767
Source : cna@cyber.gov.il
CVSS Score : 10.0

References :
https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 | source : cna@cyber.gov.il

Vulnerability : CWE-287

Vulnerability ID : CVE-2024-27768

First published on : 18-03-2024 14:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE

CVE ID : CVE-2024-27768
Source : cna@cyber.gov.il
CVSS Score : 9.8

References :
https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered | source : cna@cyber.gov.il
https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 | source : cna@cyber.gov.il

Vulnerability : CWE-22

Source : github.com

Vulnerability ID : CVE-2024-24578

First published on : 18-03-2024 22:15:07
Last modified on : 18-03-2024 22:15:07

Description :
RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.

CVE ID : CVE-2024-24578
Source : security-advisories@github.com
CVSS Score : 10.0

References :
https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637h | source : security-advisories@github.com

Vulnerability : CWE-23
Vulnerability : CWE-306

Vulnerability ID : CVE-2024-28255

First published on : 15-03-2024 20:15:10
Last modified on : 17-03-2024 22:38:29

Description :
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.

CVE ID : CVE-2024-28255
Source : security-advisories@github.com
CVSS Score : 9.8

References :
https://github.com/open-metadata/OpenMetadata/blob/e2043a3f31312ebb42391d6c93a67584d798de52/openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java#L111 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/e2043a3f31312ebb42391d6c93a67584d798de52/openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java#L113 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-6wx7-qw5p-wh84 | source : security-advisories@github.com

Vulnerability : CWE-287

Vulnerability ID : CVE-2024-21652

First published on : 18-03-2024 18:15:09
Last modified on : 18-03-2024 19:40:00

Description :
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.

CVE ID : CVE-2024-21652
Source : security-advisories@github.com
CVSS Score : 9.8

References :
https://github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv | source : security-advisories@github.com

Vulnerability : CWE-307

Vulnerability ID : CVE-2024-28253

First published on : 15-03-2024 20:15:09
Last modified on : 17-03-2024 22:38:29

Description :
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-28253
Source : security-advisories@github.com
CVSS Score : 9.4

References :
https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java#L365 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java#L113 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6gr | source : security-advisories@github.com

Vulnerability : CWE-94

Source : incibe.es

Vulnerability ID : CVE-2024-2599

First published on : 18-03-2024 14:15:13
Last modified on : 18-03-2024 19:40:00

Description :
File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure.

CVE ID : CVE-2024-2599
Source : cve-coordination@incibe.es
CVSS Score : 9.9

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-434

Source : yd.MitsubishiElectric.co.jp

Vulnerability ID : CVE-2024-0802

First published on : 15-03-2024 01:15:57
Last modified on : 15-03-2024 12:53:06

Description :
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted packet.

CVE ID : CVE-2024-0802
Source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CVSS Score : 9.8

References :
https://jvn.jp/vu/JVNVU99690199/ | source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14 | source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf | source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Vulnerability : CWE-468

Vulnerability ID : CVE-2024-0803

First published on : 15-03-2024 01:15:57
Last modified on : 15-03-2024 12:53:06

Description :
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

CVE ID : CVE-2024-0803
Source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CVSS Score : 9.8

Vulnerability : CWE-190

Vulnerability ID : CVE-2024-1915

First published on : 15-03-2024 01:15:58
Last modified on : 15-03-2024 12:53:06

Description :
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.

CVE ID : CVE-2024-1915
Source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CVSS Score : 9.8

Vulnerability : CWE-468

Vulnerability ID : CVE-2024-1916

First published on : 15-03-2024 01:15:58
Last modified on : 15-03-2024 12:53:06

CVE ID : CVE-2024-1916
Source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CVSS Score : 9.8

Vulnerability : CWE-190

Vulnerability ID : CVE-2024-1917

First published on : 15-03-2024 01:15:58
Last modified on : 15-03-2024 12:53:06

CVE ID : CVE-2024-1917
Source : Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CVSS Score : 9.8

Vulnerability : CWE-190

Source : se.com

Vulnerability ID : CVE-2024-2051

First published on : 18-03-2024 16:15:09
Last modified on : 18-03-2024 19:40:00

Description :
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the login form.

CVE ID : CVE-2024-2051
Source : cybersecurity@se.com
CVSS Score : 9.8

References :
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf | source : cybersecurity@se.com

Vulnerability : CWE-307

(92) HIGH VULNERABILITIES [7.0, 8.9]

Source : wordfence.com

Vulnerability ID : CVE-2024-1795

First published on : 15-03-2024 07:15:08
Last modified on : 15-03-2024 12:53:06

Description :
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID : CVE-2024-1795
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051027%40woocommerce-products-filter&new=3051027%40woocommerce-products-filter&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/fff8dfbc-fd59-47db-85bb-de2a7c6a9a5f?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-1685

First published on : 16-03-2024 06:15:10
Last modified on : 17-03-2024 22:38:29

Description :
The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVE ID : CVE-2024-1685
Source : security@wordfence.com
CVSS Score : 8.8

References :
https://plugins.trac.wordpress.org/browser/social-media-builder/trunk/classes/SgmbButton.php#L32 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/9c17d18a-090f-4b35-a257-cfc0a16d5459?source=cve | source : security@wordfence.com

Source : vuldb.com

Vulnerability ID : CVE-2024-2485

First published on : 15-03-2024 07:15:13
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed_dir leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256892. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2485
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/SetSpeedWan.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256892 | source : cna@vuldb.com
https://vuldb.com/?id.256892 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2486

First published on : 15-03-2024 08:15:07
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability was found in Tenda AC18 15.03.05.05. It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256893 was assigned to this vulnerability.

CVE ID : CVE-2024-2486
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formQuickIndex.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256893 | source : cna@vuldb.com
https://vuldb.com/?id.256893 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2487

First published on : 15-03-2024 09:15:07
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName/mac leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256894 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2487
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetDeviceName_devName.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256894 | source : cna@vuldb.com
https://vuldb.com/?id.256894 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2488

First published on : 15-03-2024 09:15:08
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIP leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256895. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2488
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetPPTPServer.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256895 | source : cna@vuldb.com
https://vuldb.com/?id.256895 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2489

First published on : 15-03-2024 09:15:08
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetQosBand of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256896. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2489
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetQosBand.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256896 | source : cna@vuldb.com
https://vuldb.com/?id.256896 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2490

First published on : 15-03-2024 10:15:08
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256897 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2490
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/Emilytutu/IoT-vulnerable/blob/main/Tenda/AC18/setSchedWifi_end.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256897 | source : cna@vuldb.com
https://vuldb.com/?id.256897 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2546

First published on : 17-03-2024 02:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability has been found in Tenda AC18 15.13.07.09 and classified as critical. Affected by this vulnerability is the function fromSetWirelessRepeat. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256999. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2546
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/A18/fromSetWirelessRepeat_a.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256999 | source : cna@vuldb.com
https://vuldb.com/?id.256999 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2547

First published on : 17-03-2024 04:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical. Affected by this issue is the function R7WebsSecurityHandler. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257000. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2547
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/R7WebsSecurityHandler.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257000 | source : cna@vuldb.com
https://vuldb.com/?id.257000 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2558

First published on : 17-03-2024 09:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2558
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formexeCommand.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257057 | source : cna@vuldb.com
https://vuldb.com/?id.257057 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2581

First published on : 18-03-2024 03:15:06
Last modified on : 18-03-2024 12:38:25

Description :
A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function fromSetRouteStatic of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257081 was assigned to this vulnerability.

CVE ID : CVE-2024-2581
Source : cna@vuldb.com
CVSS Score : 8.8

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10/V16.03.10.13/fromSetRouteStatic.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257081 | source : cna@vuldb.com
https://vuldb.com/?id.257081 | source : cna@vuldb.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-2514

First published on : 15-03-2024 23:15:08
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as critical was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256951. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2514
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20Auth%20bypass%20-%20login.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256951 | source : cna@vuldb.com
https://vuldb.com/?id.256951 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2566

First published on : 17-03-2024 15:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240313. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file api/client/get_extension_yl.php. The manipulation of the argument imei leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257065 was assigned to this vulnerability.

CVE ID : CVE-2024-2566
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://h0e4a0r1t.github.io/2024/vulns/Fujian%20Kelixin%20Communication%20Co.,%20Ltd.%20Command%20and%20Dispatch%20Platform%20SQL%20Injection%20Vulnerability-get_extension_yl.pdf | source : cna@vuldb.com
https://vuldb.com/?ctiid.257065 | source : cna@vuldb.com
https://vuldb.com/?id.257065 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2569

First published on : 18-03-2024 00:15:07
Last modified on : 18-03-2024 01:13:31

Description :
A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin-manage-user.php. The manipulation leads to execution after redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257072.

CVE ID : CVE-2024-2569
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20admin-manage-user.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257072 | source : cna@vuldb.com
https://vuldb.com/?id.257072 | source : cna@vuldb.com

Vulnerability : CWE-698

Vulnerability ID : CVE-2024-2570

First published on : 18-03-2024 00:15:08
Last modified on : 18-03-2024 01:13:31

Description :
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /edit-task.php. The manipulation leads to execution after redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257073 was assigned to this vulnerability.

CVE ID : CVE-2024-2570
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20edit-task.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257073 | source : cna@vuldb.com
https://vuldb.com/?id.257073 | source : cna@vuldb.com

Vulnerability : CWE-698

Vulnerability ID : CVE-2024-2571

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage-admin.php. The manipulation leads to execution after redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257074 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2571
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20manage-admin.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257074 | source : cna@vuldb.com
https://vuldb.com/?id.257074 | source : cna@vuldb.com

Vulnerability : CWE-698

Vulnerability ID : CVE-2024-2572

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /task-details.php. The manipulation leads to execution after redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257075.

CVE ID : CVE-2024-2572
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20task-details.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257075 | source : cna@vuldb.com
https://vuldb.com/?id.257075 | source : cna@vuldb.com

Vulnerability : CWE-698

Vulnerability ID : CVE-2024-2573

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file /task-info.php. The manipulation leads to execution after redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257076.

CVE ID : CVE-2024-2573
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20task-info.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257076 | source : cna@vuldb.com
https://vuldb.com/?id.257076 | source : cna@vuldb.com

Vulnerability : CWE-698

Vulnerability ID : CVE-2024-2574

First published on : 18-03-2024 02:15:06
Last modified on : 18-03-2024 12:38:25

Description :
A vulnerability classified as critical was found in SourceCodester Employee Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit-task.php. The manipulation of the argument task_id leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257077 was assigned to this vulnerability.

CVE ID : CVE-2024-2574
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20edit-task.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257077 | source : cna@vuldb.com
https://vuldb.com/?id.257077 | source : cna@vuldb.com

Vulnerability : CWE-639

Vulnerability ID : CVE-2024-2575

First published on : 18-03-2024 02:15:06
Last modified on : 18-03-2024 12:38:25

Description :
A vulnerability, which was classified as critical, has been found in SourceCodester Employee Task Management System 1.0. Affected by this issue is some unknown functionality of the file /task-details.php. The manipulation of the argument task_id leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257078 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2575
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20task-details.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257078 | source : cna@vuldb.com
https://vuldb.com/?id.257078 | source : cna@vuldb.com

Vulnerability : CWE-639

Vulnerability ID : CVE-2024-2576

First published on : 18-03-2024 02:15:06
Last modified on : 18-03-2024 12:38:25

Description :
A vulnerability, which was classified as critical, was found in SourceCodester Employee Task Management System 1.0. This affects an unknown part of the file /update-admin.php. The manipulation of the argument admin_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257079.

CVE ID : CVE-2024-2576
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20update-admin.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257079 | source : cna@vuldb.com
https://vuldb.com/?id.257079 | source : cna@vuldb.com

Vulnerability : CWE-639

Vulnerability ID : CVE-2024-2577

First published on : 18-03-2024 03:15:06
Last modified on : 18-03-2024 12:38:25

Description :
A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /update-employee.php. The manipulation of the argument admin_id leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257080.

CVE ID : CVE-2024-2577
Source : cna@vuldb.com
CVSS Score : 7.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20update-employee.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257080 | source : cna@vuldb.com
https://vuldb.com/?id.257080 | source : cna@vuldb.com

Vulnerability : CWE-639

Source : mattermost.com

Vulnerability ID : CVE-2024-2450

First published on : 15-03-2024 10:15:08
Last modified on : 15-03-2024 12:53:06

Description :
Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.

CVE ID : CVE-2024-2450
Source : responsibledisclosure@mattermost.com
CVSS Score : 8.8

References :
https://mattermost.com/security-updates | source : responsibledisclosure@mattermost.com

Vulnerability : CWE-287

Source : github.com

Vulnerability ID : CVE-2024-28254

First published on : 15-03-2024 20:15:10
Last modified on : 17-03-2024 22:38:29

Description :
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `?AlertUtil::validateExpression` method evaluates an SpEL expression using `getValue` which by default uses the `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/<expression>` endpoint passes user-controlled data `AlertUtil::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and, therefore, any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-235`. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-28254
Source : security-advisories@github.com
CVSS Score : 8.8

References :
https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L101 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java#L108 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-j86m-rrpr-g8gw | source : security-advisories@github.com
https://github.com/spring-projects/spring-framework/blob/4e2d3573189b7c0afce62bce29cd915de4077f56/spring-expression/src/main/java/org/springframework/expression/spel/standard/SpelExpression.java#L106 | source : security-advisories@github.com

Vulnerability : CWE-78

Vulnerability ID : CVE-2024-28847

First published on : 15-03-2024 20:15:10
Last modified on : 17-03-2024 22:38:29

Description :
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called from `EventSubscriptionRepository.prepare()`, which can lead to Remote Code Execution. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that, even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and, therefore, after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/events/subscriptions` which gets handled by `EventSubscriptionResource.createOrUpdateEventSubscription()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-251`.

CVE ID : CVE-2024-28847
Source : security-advisories@github.com
CVSS Score : 8.8

References :
https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EventSubscriptionRepository.java#L69-L83 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/events/subscription/EventSubscriptionResource.java#L289 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-8p5r-6mvv-2435 | source : security-advisories@github.com

Vulnerability : CWE-94

Vulnerability ID : CVE-2024-28848

First published on : 15-03-2024 20:15:10
Last modified on : 17-03-2024 22:38:29

Description :
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `?CompiledRule::validateExpression` method evaluates an SpEL expression using an `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/<expression>` endpoint passes user-controlled data `CompiledRule::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and therefore any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-236`. This issue may lead to Remote Code Execution and has been resolved in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-28848
Source : security-advisories@github.com
CVSS Score : 8.8

References :
https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L51 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/CompiledRule.java#L57 | source : security-advisories@github.com
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5xv3-fm7g-865r | source : security-advisories@github.com

Vulnerability : CWE-94

Vulnerability ID : CVE-2023-41334

First published on : 18-03-2024 19:15:05
Last modified on : 18-03-2024 19:40:00

Description :
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.

CVE ID : CVE-2023-41334
Source : security-advisories@github.com
CVSS Score : 8.4

References :
https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539 | source : security-advisories@github.com
https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5 | source : security-advisories@github.com
https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf | source : security-advisories@github.com

Vulnerability : CWE-77

Vulnerability ID : CVE-2024-28855

First published on : 18-03-2024 22:15:08
Last modified on : 18-03-2024 22:15:08

Description :
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.

CVE ID : CVE-2024-28855
Source : security-advisories@github.com
CVSS Score : 8.1

Vulnerability : CWE-20

Vulnerability ID : CVE-2024-23333

First published on : 18-03-2024 21:15:06
Last modified on : 18-03-2024 21:15:06

Description :
LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When the file is then accessed via web the code would be executed. The issue is mitigated by the following: An attacker needs to know LAM's master configuration password to be able to change the main settings; and the webserver needs write access to a directory that is accessible via web. LAM itself does not provide any such directories. The issue has been fixed in 8.7. As a workaround, limit access to LAM configuration pages to authorized users.

CVE ID : CVE-2024-23333
Source : security-advisories@github.com
CVSS Score : 7.9

References :
https://github.com/LDAPAccountManager/lam/releases/tag/8.7 | source : security-advisories@github.com
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-fm9w-7m7v-wxqv | source : security-advisories@github.com

Vulnerability : CWE-74

Vulnerability ID : CVE-2024-27096

First published on : 18-03-2024 17:15:06
Last modified on : 18-03-2024 19:40:00

Description :
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.

CVE ID : CVE-2024-27096
Source : security-advisories@github.com
CVSS Score : 7.7

References :
https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.13 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-2x8m-vrcm-2jqv | source : security-advisories@github.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-28252

First published on : 15-03-2024 19:15:07
Last modified on : 17-03-2024 22:38:29

Description :
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.3 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.

CVE ID : CVE-2024-28252
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/CoreWCF/CoreWCF/issues/1345 | source : security-advisories@github.com
https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-32jq-mv89-5rx7 | source : security-advisories@github.com

Vulnerability : CWE-404

Vulnerability ID : CVE-2024-28854

First published on : 15-03-2024 19:15:07
Last modified on : 17-03-2024 22:38:29

Description :
tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.

CVE ID : CVE-2024-28854
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://en.wikipedia.org/wiki/Slowloris_(computer_security) | source : security-advisories@github.com
https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4 | source : security-advisories@github.com
https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7 | source : security-advisories@github.com

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-21661

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment. The vulnerability is rooted in the application's code, where an array is being modified while it is being iterated over. This is a classic programming error but becomes critically unsafe when executed in a multi-threaded environment. When two threads interact with the same array simultaneously, the application crashes. This is a Denial of Service (DoS) vulnerability. Any attacker can crash the application continuously, making it impossible for legitimate users to access the service. The issue is exacerbated because it does not require authentication, widening the pool of potential attackers. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.

CVE ID : CVE-2024-21661
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/argoproj/argo-cd/blob/54601c8fd30b86a4c4b7eb449956264372c8bde0/util/session/sessionmanager.go#L302-L311 | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345 | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208 | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/commit/ce04dc5c6f6e92033221ec6d96b74403b065ca8b | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/security/advisories/GHSA-6v85-wr92-q4p7 | source : security-advisories@github.com

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-21662

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.

CVE ID : CVE-2024-21662
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456 | source : security-advisories@github.com
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454 | source : security-advisories@github.com

Vulnerability : CWE-307

Vulnerability ID : CVE-2024-28865

First published on : 18-03-2024 22:15:09
Last modified on : 18-03-2024 22:15:09

Description :
django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article content that can cause severe use of server CPU through a regular expression loop. Version 0.10.1 fixes this issue. As a workaround, close off access to create and edit articles by anonymous users.

CVE ID : CVE-2024-28865
Source : security-advisories@github.com
CVSS Score : 7.5

References :
https://github.com/django-wiki/django-wiki/commit/8e280fd6c0bd27ce847c67b2d216c6cbf920f88c | source : security-advisories@github.com
https://github.com/django-wiki/django-wiki/security/advisories/GHSA-wj85-w4f4-xh8h | source : security-advisories@github.com

Vulnerability : CWE-1333

Vulnerability ID : CVE-2024-27920

First published on : 15-03-2024 20:15:09
Last modified on : 17-03-2024 22:38:29

Description :
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. The vulnerability is addressed in Nuclei v3.2.0. Users are strongly recommended to update to this version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed.

CVE ID : CVE-2024-27920
Source : security-advisories@github.com
CVSS Score : 7.4

References :
https://docs.projectdiscovery.io/templates/protocols/code | source : security-advisories@github.com
https://docs.projectdiscovery.io/templates/reference/template-signing | source : security-advisories@github.com
https://docs.projectdiscovery.io/templates/workflows/overview | source : security-advisories@github.com
https://github.com/projectdiscovery/nuclei/pull/4822 | source : security-advisories@github.com
https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q | source : security-advisories@github.com

Vulnerability : CWE-78

Vulnerability ID : CVE-2024-28248

First published on : 18-03-2024 22:15:08
Last modified on : 18-03-2024 22:15:08

Description :
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, and 1.15.2, Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped. This issue has been patched in Cilium 1.15.2, 1.14.8, and 1.13.13. There are no known workarounds for this issue.

CVE ID : CVE-2024-28248
Source : security-advisories@github.com
CVSS Score : 7.2

References :
https://docs.cilium.io/en/stable/security/policy/language/#http | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.13.13 | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.14.8 | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.15.2 | source : security-advisories@github.com
https://github.com/cilium/cilium/security/advisories/GHSA-68mj-9pjq-mc85 | source : security-advisories@github.com

Vulnerability : CWE-693

Source : patchstack.com

Vulnerability ID : CVE-2023-51474

First published on : 16-03-2024 02:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3.

CVE ID : CVE-2023-51474
Source : audit@patchstack.com
CVSS Score : 8.8

References :
https://patchstack.com/database/vulnerability/terraclassifieds/wordpress-terraclassifieds-plugin-2-0-3-cross-site-request-forgery-csrf-to-account-takeover-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-27987

First published on : 15-03-2024 11:15:09
Last modified on : 15-03-2024 12:53:06

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP Give allows Reflected XSS.This issue affects Give: from n/a through 3.3.1.

CVE ID : CVE-2024-27987
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/give/wordpress-give-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25921

First published on : 15-03-2024 13:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Concerted Action Action Network allows Reflected XSS.This issue affects Action Network: from n/a through 1.4.2.

CVE ID : CVE-2024-25921
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/wp-action-network/wordpress-action-network-plugin-1-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27192

First published on : 15-03-2024 13:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Reilly Configure SMTP allows Reflected XSS.This issue affects Configure SMTP: from n/a through 3.1.

CVE ID : CVE-2024-27192
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/configure-smtp/wordpress-configure-smtp-plugin-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27193

First published on : 15-03-2024 13:15:09
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU PayU India allows Reflected XSS.This issue affects PayU India: from n/a through 3.8.2.

CVE ID : CVE-2024-27193
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/payu-india/wordpress-payu-india-plugin-3-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27196

First published on : 15-03-2024 13:15:09
Last modified on : 15-03-2024 16:26:49

Description :
Cross Site Scripting (XSS) vulnerability in Joel Starnes postMash – custom post order allows Reflected XSS.This issue affects postMash – custom post order: from n/a through 1.2.0.

CVE ID : CVE-2024-27196
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/postmash/wordpress-postmash-custom-post-order-plugin-1-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25597

First published on : 15-03-2024 14:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8.

CVE ID : CVE-2024-25597
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-2-8-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27194

First published on : 16-03-2024 02:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Andrei Ivasiuc Fontific | Google Fonts allows Stored XSS.This issue affects Fontific | Google Fonts: from n/a through 0.1.6.

CVE ID : CVE-2024-27194
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/fontific/wordpress-fontific-plugin-0-1-6-csrf-to-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-27195

First published on : 16-03-2024 02:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Sandi Verdev Watermark RELOADED allows Stored XSS.This issue affects Watermark RELOADED: from n/a through 1.3.5.

CVE ID : CVE-2024-27195
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/watermark-reloaded/wordpress-watermark-reloaded-plugin-1-3-5-csrf-to-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-27197

First published on : 16-03-2024 02:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Bee BeePress allows Stored XSS.This issue affects BeePress: from n/a through 6.9.8.

CVE ID : CVE-2024-27197
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/beepress/wordpress-beepress-plugin-6-9-8-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-27958

First published on : 17-03-2024 17:15:06
Last modified on : 17-03-2024 22:38:29

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Reflected XSS.This issue affects Visualizer: from n/a through 3.10.5.

CVE ID : CVE-2024-27958
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/visualizer/wordpress-visualizer-plugin-3-10-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27959

First published on : 17-03-2024 17:15:06
Last modified on : 17-03-2024 22:38:29

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: from n/a through 4.2.9.

CVE ID : CVE-2024-27959
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/woosquare/wordpress-apiexperts-square-for-woocommerce-plugin-4-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27960

First published on : 17-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20.

CVE ID : CVE-2024-27960
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/email-subscribe/wordpress-email-subscription-popup-plugin-1-2-20-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27961

First published on : 17-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codekraft AntiSpam for Contact Form 7 allows Reflected XSS.This issue affects AntiSpam for Contact Form 7: from n/a through 0.6.0.

CVE ID : CVE-2024-27961
Source : audit@patchstack.com
CVSS Score : 7.1

References :
https://patchstack.com/database/vulnerability/cf7-antispam/wordpress-antispam-for-contact-form-7-plugin-0-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Source : cyber.gov.il

Vulnerability ID : CVE-2024-27769

First published on : 18-03-2024 14:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices

CVE ID : CVE-2024-27769
Source : cna@cyber.gov.il
CVSS Score : 8.8

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-27770

First published on : 18-03-2024 14:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal

CVE ID : CVE-2024-27770
Source : cna@cyber.gov.il
CVSS Score : 8.8

Vulnerability : CWE-23

Vulnerability ID : CVE-2024-27771

First published on : 18-03-2024 14:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE

CVE ID : CVE-2024-27771
Source : cna@cyber.gov.il
CVSS Score : 8.8

Vulnerability : CWE-22

Vulnerability ID : CVE-2024-27772

First published on : 18-03-2024 14:15:09
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE

CVE ID : CVE-2024-27772
Source : cna@cyber.gov.il
CVSS Score : 8.8

Vulnerability : CWE-78

Vulnerability ID : CVE-2024-27773

First published on : 18-03-2024 14:15:09
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE

CVE ID : CVE-2024-27773
Source : cna@cyber.gov.il
CVSS Score : 8.8

Vulnerability : CWE-348

Vulnerability ID : CVE-2024-27774

First published on : 18-03-2024 14:15:09
Last modified on : 18-03-2024 19:40:00

Description :
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware

CVE ID : CVE-2024-27774
Source : cna@cyber.gov.il
CVSS Score : 7.5

Vulnerability : CWE-259

Source : zephyrproject.org

Vulnerability ID : CVE-2023-7060

First published on : 15-03-2024 19:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.

CVE ID : CVE-2023-7060
Source : vulnerabilities@zephyrproject.org
CVSS Score : 8.6

References :
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fjc8-223c-qgqr | source : vulnerabilities@zephyrproject.org

Source : redhat.com

Vulnerability ID : CVE-2024-1753

First published on : 18-03-2024 15:15:41
Last modified on : 18-03-2024 19:40:00

Description :
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

CVE ID : CVE-2024-1753
Source : secalert@redhat.com
CVSS Score : 8.6

References :
https://access.redhat.com/security/cve/CVE-2024-1753 | source : secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2265513 | source : secalert@redhat.com
https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf | source : secalert@redhat.com
https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3 | source : secalert@redhat.com

Vulnerability : CWE-269

Vulnerability ID : CVE-2024-2002

First published on : 18-03-2024 13:15:07
Last modified on : 18-03-2024 19:40:00

Description :
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

CVE ID : CVE-2024-2002
Source : secalert@redhat.com
CVSS Score : 7.5

References :
https://access.redhat.com/security/cve/CVE-2024-2002 | source : secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2267700 | source : secalert@redhat.com
https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt | source : secalert@redhat.com

Vulnerability : CWE-415

Vulnerability ID : CVE-2024-1013

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.

CVE ID : CVE-2024-1013
Source : secalert@redhat.com
CVSS Score : 7.1

References :
https://access.redhat.com/security/cve/CVE-2024-1013 | source : secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2260823 | source : secalert@redhat.com
https://github.com/lurcher/unixODBC/pull/157 | source : secalert@redhat.com

Vulnerability : CWE-823

Source : adobe.com

Vulnerability ID : CVE-2024-20767

First published on : 18-03-2024 12:15:06
Last modified on : 18-03-2024 12:38:25

Description :
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.

CVE ID : CVE-2024-20767
Source : psirt@adobe.com
CVSS Score : 8.2

References :
https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html | source : psirt@adobe.com

Vulnerability : CWE-284

Vulnerability ID : CVE-2024-20745

First published on : 18-03-2024 15:15:41
Last modified on : 18-03-2024 19:40:00

Description :
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20745
Source : psirt@adobe.com
CVSS Score : 7.8

References :
https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html | source : psirt@adobe.com

Vulnerability : CWE-122

Vulnerability ID : CVE-2024-20746

First published on : 18-03-2024 15:15:41
Last modified on : 18-03-2024 19:40:00

Description :
Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20746
Source : psirt@adobe.com
CVSS Score : 7.8

References :
https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html | source : psirt@adobe.com

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-20752

First published on : 18-03-2024 16:15:07
Last modified on : 18-03-2024 19:40:00

Description :
Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20752
Source : psirt@adobe.com
CVSS Score : 7.8

References :
https://helpx.adobe.com/security/products/bridge/apsb24-15.html | source : psirt@adobe.com

Vulnerability : CWE-416

Vulnerability ID : CVE-2024-20755

First published on : 18-03-2024 16:15:07
Last modified on : 18-03-2024 19:40:00

Description :
Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20755
Source : psirt@adobe.com
CVSS Score : 7.8

References :
https://helpx.adobe.com/security/products/bridge/apsb24-15.html | source : psirt@adobe.com

Vulnerability : CWE-122

Vulnerability ID : CVE-2024-20756

First published on : 18-03-2024 16:15:07
Last modified on : 18-03-2024 19:40:00

Description :
Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20756
Source : psirt@adobe.com
CVSS Score : 7.8

References :
https://helpx.adobe.com/security/products/bridge/apsb24-15.html | source : psirt@adobe.com

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-20761

First published on : 18-03-2024 18:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20761
Source : psirt@adobe.com
CVSS Score : 7.8

References :
https://helpx.adobe.com/security/products/animate/apsb24-19.html | source : psirt@adobe.com

Vulnerability : CWE-787

Vulnerability ID : CVE-2024-20754

First published on : 18-03-2024 18:15:07
Last modified on : 18-03-2024 19:40:00

Description :
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20754
Source : psirt@adobe.com
CVSS Score : 7.5

References :
https://helpx.adobe.com/security/products/lightroom/apsb24-17.html | source : psirt@adobe.com

Vulnerability : CWE-426

Source : incibe.es

Vulnerability ID : CVE-2024-2584

First published on : 18-03-2024 14:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2584
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2585

First published on : 18-03-2024 14:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send_2.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2585
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2586

First published on : 18-03-2024 14:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2586
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2587

First published on : 18-03-2024 14:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_khet_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2587
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2588

First published on : 18-03-2024 14:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/admin/index.php, in the 'id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2588
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2589

First published on : 18-03-2024 14:15:11
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_school_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2589
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2590

First published on : 18-03-2024 14:15:11
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/select_send.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2590
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2591

First published on : 18-03-2024 14:15:11
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2591
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2592

First published on : 18-03-2024 14:15:11
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/pic_show.php, in the 'person_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.

CVE ID : CVE-2024-2592
Source : cve-coordination@incibe.es
CVSS Score : 8.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2593

First published on : 18-03-2024 14:15:12
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

CVE ID : CVE-2024-2593
Source : cve-coordination@incibe.es
CVSS Score : 7.1

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2594

First published on : 18-03-2024 14:15:12
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/admin/index.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

CVE ID : CVE-2024-2594
Source : cve-coordination@incibe.es
CVSS Score : 7.1

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2595

First published on : 18-03-2024 14:15:12
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_khet_person.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

CVE ID : CVE-2024-2595
Source : cve-coordination@incibe.es
CVSS Score : 7.1

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2596

First published on : 18-03-2024 14:15:12
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/mail/main/select_send.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

CVE ID : CVE-2024-2596
Source : cve-coordination@incibe.es
CVSS Score : 7.1

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2597

First published on : 18-03-2024 14:15:13
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_school_person.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

CVE ID : CVE-2024-2597
Source : cve-coordination@incibe.es
CVSS Score : 7.1

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2598

First published on : 18-03-2024 14:15:13
Last modified on : 18-03-2024 19:40:00

Description :
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/select_send_2.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

CVE ID : CVE-2024-2598
Source : cve-coordination@incibe.es
CVSS Score : 7.1

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss | source : cve-coordination@incibe.es

Vulnerability : CWE-79

Source : vmware.com

Vulnerability ID : CVE-2024-22257

First published on : 18-03-2024 15:15:41
Last modified on : 18-03-2024 19:40:00

Description :
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

CVE ID : CVE-2024-22257
Source : security@vmware.com
CVSS Score : 8.2

References :
https://spring.io/security/cve-2024-22257 | source : security@vmware.com

Vulnerability ID : CVE-2024-22259

First published on : 16-03-2024 05:15:20
Last modified on : 17-03-2024 22:38:29

Description :
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

CVE ID : CVE-2024-22259
Source : security@vmware.com
CVSS Score : 8.1

References :
https://spring.io/security/cve-2024-22259 | source : security@vmware.com

Source : se.com

Vulnerability ID : CVE-2024-2050

First published on : 18-03-2024 16:15:08
Last modified on : 18-03-2024 19:40:00

Description :
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects then executes arbitrary malicious JavaScript code within the context of the product.

CVE ID : CVE-2024-2050
Source : cybersecurity@se.com
CVSS Score : 8.2

References :
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf | source : cybersecurity@se.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2229

First published on : 18-03-2024 16:15:09
Last modified on : 18-03-2024 19:40:00

Description :
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.

CVE ID : CVE-2024-2229
Source : cybersecurity@se.com
CVSS Score : 7.8

References :
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-02.pdf | source : cybersecurity@se.com

Vulnerability : CWE-502

Vulnerability ID : CVE-2024-2052

First published on : 18-03-2024 16:15:09
Last modified on : 18-03-2024 19:40:00

Description :
CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltration and download of files when an attacker modifies the URL to download to a different location.

CVE ID : CVE-2024-2052
Source : cybersecurity@se.com
CVSS Score : 7.5

References :
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf | source : cybersecurity@se.com

Vulnerability : CWE-552

Source : tenable.com

Vulnerability ID : CVE-2024-2390

First published on : 18-03-2024 16:15:09
Last modified on : 18-03-2024 19:40:00

Description :
As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin in order to escalate privileges.

CVE ID : CVE-2024-2390
Source : vulnreport@tenable.com
CVSS Score : 7.8

References :
https://www.tenable.com/security/tns-2024-05 | source : vulnreport@tenable.com

Vulnerability : CWE-269

Source : mitre.org

Vulnerability ID : CVE-2024-29154

First published on : 18-03-2024 06:15:06
Last modified on : 18-03-2024 12:38:25

Description :
danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling, such as in htmlToPlainText.

CVE ID : CVE-2024-29154
Source : cve@mitre.org
CVSS Score : 7.4

References :
https://sec1.io/security-advisories/cross-site-scripting-xss/ | source : cve@mitre.org

(150) MEDIUM VULNERABILITIES [4.0, 6.9]

Source : redhat.com

Vulnerability ID : CVE-2023-6725

First published on : 15-03-2024 13:15:06
Last modified on : 15-03-2024 16:26:49

Description :
An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.

CVE ID : CVE-2023-6725
Source : secalert@redhat.com
CVSS Score : 6.6

References :
https://access.redhat.com/security/cve/CVE-2023-6725 | source : secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2249273 | source : secalert@redhat.com

Vulnerability : CWE-1220

Vulnerability ID : CVE-2023-7250

First published on : 18-03-2024 13:15:06
Last modified on : 18-03-2024 19:40:00

Description :
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.

CVE ID : CVE-2023-7250
Source : secalert@redhat.com
CVSS Score : 5.3

References :
https://access.redhat.com/security/cve/CVE-2023-7250 | source : secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2244707 | source : secalert@redhat.com

Vulnerability : CWE-183

Vulnerability ID : CVE-2024-2496

First published on : 18-03-2024 13:15:08
Last modified on : 18-03-2024 19:40:00

Description :
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

CVE ID : CVE-2024-2496
Source : secalert@redhat.com
CVSS Score : 5.0

References :
https://access.redhat.com/security/cve/CVE-2024-2496 | source : secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | source : secalert@redhat.com

Vulnerability : CWE-476

Source : cert.pl

Vulnerability ID : CVE-2024-1605

First published on : 18-03-2024 10:15:20
Last modified on : 18-03-2024 12:38:25

Description :
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

CVE ID : CVE-2024-1605
Source : cvd@cert.pl
CVSS Score : 6.6

References :
https://cert.pl/en/posts/2024/03/CVE-2024-1604 | source : cvd@cert.pl
https://cert.pl/posts/2024/03/CVE-2024-1604 | source : cvd@cert.pl
https://www.bmc.com/it-solutions/control-m.html | source : cvd@cert.pl

Vulnerability : CWE-284

Vulnerability ID : CVE-2024-1604

First published on : 18-03-2024 10:15:19
Last modified on : 18-03-2024 12:38:25

Description :
Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

CVE ID : CVE-2024-1604
Source : cvd@cert.pl
CVSS Score : 6.4

Vulnerability : CWE-863

Vulnerability ID : CVE-2024-1606

First published on : 18-03-2024 10:15:20
Last modified on : 18-03-2024 12:38:25

Description :
Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled by an attacker. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.200.

CVE ID : CVE-2024-1606
Source : cvd@cert.pl
CVSS Score : 4.6

Vulnerability : CWE-80

Source : vuldb.com

Vulnerability ID : CVE-2024-2481

First published on : 15-03-2024 06:15:11
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2481
Source : cna@vuldb.com
CVSS Score : 6.5

References :
https://github.com/blackslim3/cve_sidequest/blob/main/poc/Broken_Access_Control%20on%20Hostel%20Management%20System%20using%20PHP%20and%20MySQL%201.0.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256890 | source : cna@vuldb.com
https://vuldb.com/?id.256890 | source : cna@vuldb.com

Vulnerability : CWE-284

Vulnerability ID : CVE-2024-2478

First published on : 15-03-2024 06:15:09
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2478
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/zuizui35/cve/blob/main/cve.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256886 | source : cna@vuldb.com
https://vuldb.com/?id.256886 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2480

First published on : 15-03-2024 06:15:10
Last modified on : 16-03-2024 22:15:07

Description :
A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The manipulation of the argument Companhia/Planta/Agente de/Agente até leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256888. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2480
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://johnermac.github.io/cve/sqli/ | source : cna@vuldb.com
https://vuldb.com/?ctiid.256888 | source : cna@vuldb.com
https://vuldb.com/?id.256888 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2516

First published on : 16-03-2024 12:15:14
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as critical, was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This affects an unknown part of the file home.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256953 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2516
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Blind%20SQL%20Injection%20-%20home.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256953 | source : cna@vuldb.com
https://vuldb.com/?id.256953 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2517

First published on : 16-03-2024 12:15:15
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_history.php. The manipulation of the argument del_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256954 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2517
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Blind%20SQL%20Injection%20-%20book_history.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256954 | source : cna@vuldb.com
https://vuldb.com/?id.256954 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2520

First published on : 16-03-2024 16:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/bookdate.php. The manipulation of the argument room_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2520
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20bookdate.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256957 | source : cna@vuldb.com
https://vuldb.com/?id.256957 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2522

First published on : 16-03-2024 17:15:05
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as critical has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This affects an unknown part of the file /admin/booktime.php. The manipulation of the argument room_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2522
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20booktime.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256959 | source : cna@vuldb.com
https://vuldb.com/?id.256959 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2524

First published on : 16-03-2024 18:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as critical, has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This issue affects some unknown processing of the file /admin/receipt.php. The manipulation of the argument room_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2524
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20receipt.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256961 | source : cna@vuldb.com
https://vuldb.com/?id.256961 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2527

First published on : 16-03-2024 19:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/rooms.php. The manipulation of the argument room_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256964. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2527
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20rooms.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256964 | source : cna@vuldb.com
https://vuldb.com/?id.256964 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2528

First published on : 16-03-2024 20:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-rooms.php. The manipulation of the argument room_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256965 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2528
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20update-rooms.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256965 | source : cna@vuldb.com
https://vuldb.com/?id.256965 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2529

First published on : 16-03-2024 20:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/rooms.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2529
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Arbitrary%20File%20Upload%20-%20rooms.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256966 | source : cna@vuldb.com
https://vuldb.com/?id.256966 | source : cna@vuldb.com

Vulnerability : CWE-434

Vulnerability ID : CVE-2024-2531

First published on : 16-03-2024 22:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as critical has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected is an unknown function of the file /admin/update-rooms.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256968. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2531
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Arbitrary%20File%20Upload%20-%20update-rooms.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256968 | source : cna@vuldb.com
https://vuldb.com/?id.256968 | source : cna@vuldb.com

Vulnerability : CWE-434

Vulnerability ID : CVE-2024-2532

First published on : 16-03-2024 22:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as critical was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/update-users.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256969 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2532
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20update-users.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256969 | source : cna@vuldb.com
https://vuldb.com/?id.256969 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2534

First published on : 17-03-2024 00:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as critical, was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This affects an unknown part of the file /admin/users.php. The manipulation of the argument user_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256971. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2534
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/SQL%20Injection%20-%20users.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256971 | source : cna@vuldb.com
https://vuldb.com/?id.256971 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2554

First published on : 17-03-2024 05:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file update-employee.php. The manipulation of the argument admin_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257053 was assigned to this vulnerability.

CVE ID : CVE-2024-2554
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/2024/Task%20Management%20System%20-%20multiple%20vulnerabilities.md#3sql-injection-vulnerability-in-update-employeephp | source : cna@vuldb.com
https://vuldb.com/?ctiid.257053 | source : cna@vuldb.com
https://vuldb.com/?id.257053 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2555

First published on : 17-03-2024 07:15:05
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file update-admin.php. The manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257054 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2555
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/2024/Task%20Management%20System%20-%20multiple%20vulnerabilities.md#4sql-injection-vulnerability-in-update-adminphp | source : cna@vuldb.com
https://vuldb.com/?ctiid.257054 | source : cna@vuldb.com
https://vuldb.com/?id.257054 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2556

First published on : 17-03-2024 08:15:05
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257055.

CVE ID : CVE-2024-2556
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/tht1997/WhiteBox/blob/main/sourcecodesters/employee-management-system-php-attendance-info.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257055 | source : cna@vuldb.com
https://vuldb.com/?id.257055 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2561

First published on : 17-03-2024 11:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controller/company/Index.php#sendCompanyLogo of the component Company Logo Handler. The manipulation of the argument imgBase64 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257060.

CVE ID : CVE-2024-2561
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://gist.github.com/Southseast/9f5284d8ee0f6d91e72eef73b285512a | source : cna@vuldb.com
https://vuldb.com/?ctiid.257060 | source : cna@vuldb.com
https://vuldb.com/?id.257060 | source : cna@vuldb.com

Vulnerability : CWE-434

Vulnerability ID : CVE-2024-2562

First published on : 17-03-2024 12:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as critical, was found in PandaXGO PandaX up to 20240310. This affects the function InsertRole of the file /apps/system/services/role_menu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257061 was assigned to this vulnerability.

CVE ID : CVE-2024-2562
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/PandaXGO/PandaX/issues/4 | source : cna@vuldb.com
https://vuldb.com/?ctiid.257061 | source : cna@vuldb.com
https://vuldb.com/?id.257061 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2564

First published on : 17-03-2024 14:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257063.

CVE ID : CVE-2024-2564
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/PandaXGO/PandaX/issues/6 | source : cna@vuldb.com
https://vuldb.com/?ctiid.257063 | source : cna@vuldb.com
https://vuldb.com/?id.257063 | source : cna@vuldb.com

Vulnerability : CWE-24

Vulnerability ID : CVE-2024-2565

First published on : 17-03-2024 15:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in PandaXGO PandaX up to 20240310. It has been classified as critical. Affected is an unknown function of the file /apps/system/router/upload.go of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257064.

CVE ID : CVE-2024-2565
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/PandaXGO/PandaX/issues/5 | source : cna@vuldb.com
https://vuldb.com/?ctiid.257064 | source : cna@vuldb.com
https://vuldb.com/?id.257064 | source : cna@vuldb.com

Vulnerability : CWE-434

Vulnerability ID : CVE-2024-2604

First published on : 18-03-2024 21:15:06
Last modified on : 18-03-2024 21:15:06

Description :
A vulnerability was found in SourceCodester File Manager App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update-file.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257182 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2604
Source : cna@vuldb.com
CVSS Score : 6.3

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20File%20Manager%20App/Arbitrary%20File%20Upload%20-%20update-file.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257182 | source : cna@vuldb.com
https://vuldb.com/?id.257182 | source : cna@vuldb.com

Vulnerability : CWE-434

Vulnerability ID : CVE-2024-2563

First published on : 17-03-2024 12:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.

CVE ID : CVE-2024-2563
Source : cna@vuldb.com
CVSS Score : 5.4

References :
https://github.com/PandaXGO/PandaX/pull/3 | source : cna@vuldb.com
https://vuldb.com/?ctiid.257062 | source : cna@vuldb.com
https://vuldb.com/?id.257062 | source : cna@vuldb.com

Vulnerability : CWE-24

Vulnerability ID : CVE-2024-2557

First published on : 17-03-2024 09:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin.php. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257056. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2557
Source : cna@vuldb.com
CVSS Score : 5.3

References :
https://github.com/vanitashtml/CVE-Dumps/blob/main/Execute%20After%20Redirect%20-%20Food%20Management%20System.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257056 | source : cna@vuldb.com
https://vuldb.com/?id.257056 | source : cna@vuldb.com

Vulnerability : CWE-285

Vulnerability ID : CVE-2024-2497

First published on : 15-03-2024 17:15:08
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2497
Source : cna@vuldb.com
CVSS Score : 4.7

References :
https://toradah.notion.site/Code-Injection-Leading-to-Remote-Code-Execution-RCE-in-RaspAP-Web-GUI-d321e1a416694520bec7099253c65060?pvs=4 | source : cna@vuldb.com
https://vuldb.com/?ctiid.256919 | source : cna@vuldb.com
https://vuldb.com/?id.256919 | source : cna@vuldb.com

Vulnerability : CWE-94

Vulnerability ID : CVE-2024-2568

First published on : 17-03-2024 23:15:05
Last modified on : 18-03-2024 01:13:31

Description :
A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071.

CVE ID : CVE-2024-2568
Source : cna@vuldb.com
CVSS Score : 4.7

References :
https://github.com/bigbigbigbaby/cms/blob/main/5.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257071 | source : cna@vuldb.com
https://vuldb.com/?id.257071 | source : cna@vuldb.com

Vulnerability : CWE-89

Vulnerability ID : CVE-2024-2483

First published on : 15-03-2024 07:15:11
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processing of the file /change-password.php of the component Password Change Handler. The manipulation of the argument oldpassword leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256889 was assigned to this vulnerability.

CVE ID : CVE-2024-2483
Source : cna@vuldb.com
CVSS Score : 4.3

References :
https://github.com/blackslim3/cve_sidequest/blob/main/poc/CSRF%20on%20Hostel%20Management%20System%20using%20PHP%20and%20MySQL%201.0.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256889 | source : cna@vuldb.com
https://vuldb.com/?id.256889 | source : cna@vuldb.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-2559

First published on : 17-03-2024 10:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as problematic has been found in Tenda AC18 15.03.05.05. Affected is the function fromSysToolReboot of the file /goform/SysToolReboot. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2559
Source : cna@vuldb.com
CVSS Score : 4.3

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromSysToolReboot.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257058 | source : cna@vuldb.com
https://vuldb.com/?id.257058 | source : cna@vuldb.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-2560

First published on : 17-03-2024 11:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2560
Source : cna@vuldb.com
CVSS Score : 4.3

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromSysToolRestoreSet.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257059 | source : cna@vuldb.com
https://vuldb.com/?id.257059 | source : cna@vuldb.com

Vulnerability : CWE-352

Source : patchstack.com

Vulnerability ID : CVE-2024-25598

First published on : 15-03-2024 13:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through 8.3.

CVE ID : CVE-2024-25598
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25916

First published on : 15-03-2024 13:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joseph C Dolson My Calendar allows Stored XSS.This issue affects My Calendar: from n/a through 3.4.23.

CVE ID : CVE-2024-25916
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/my-calendar/wordpress-my-calendar-plugin-3-4-23-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25919

First published on : 15-03-2024 13:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.

CVE ID : CVE-2024-25919
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25934

First published on : 15-03-2024 13:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormFacade allows Stored XSS.This issue affects FormFacade: from n/a through 1.0.0.

CVE ID : CVE-2024-25934
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/formfacade/wordpress-formfacade-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25936

First published on : 15-03-2024 13:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoundCloud Inc., Lawrie Malen SoundCloud Shortcode allows Stored XSS.This issue affects SoundCloud Shortcode: from n/a through 4.0.1.

CVE ID : CVE-2024-25936
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/soundcloud-shortcode/wordpress-soundcloud-shortcode-plugin-4-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-27189

First published on : 15-03-2024 13:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS.This issue affects WP Social Widget: from n/a through 2.2.5.

CVE ID : CVE-2024-27189
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/wp-social-widget/wordpress-wp-social-widget-plugin-2-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25593

First published on : 15-03-2024 14:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.5.

CVE ID : CVE-2024-25593
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/nex-forms-express-wp-form-builder/wordpress-nex-forms-plugin-8-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-23523

First published on : 16-03-2024 05:15:21
Last modified on : 17-03-2024 22:38:29

Description :
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2.

CVE ID : CVE-2024-23523
Source : audit@patchstack.com
CVSS Score : 6.5

References :
https://patchstack.com/database/vulnerability/elementor-pro/wordpress-elementor-pro-plugin-3-19-2-contributor-arbitrary-user-meta-data-retrieval-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-25592

First published on : 15-03-2024 14:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.

CVE ID : CVE-2024-25592
Source : audit@patchstack.com
CVSS Score : 5.9

References :
https://patchstack.com/database/vulnerability/broken-link-checker/wordpress-broken-link-checker-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-25596

First published on : 15-03-2024 14:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.This issue affects Doofinder for WooCommerce: from n/a through 2.1.8.

CVE ID : CVE-2024-25596
Source : audit@patchstack.com
CVSS Score : 5.9

References :
https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2023-50898

First published on : 15-03-2024 15:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2.

CVE ID : CVE-2023-50898
Source : audit@patchstack.com
CVSS Score : 5.4

References :
https://patchstack.com/database/vulnerability/sirv/wordpress-image-optimizer-resizer-and-cdn-sirv-plugin-7-1-2-broken-access-control-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-862

Vulnerability ID : CVE-2023-51489

First published on : 16-03-2024 01:15:49
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.

CVE ID : CVE-2023-51489
Source : audit@patchstack.com
CVSS Score : 5.4

References :
https://patchstack.com/database/vulnerability/polldaddy/wordpress-crowdsignal-polls-ratings-plugin-3-0-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51491

First published on : 16-03-2024 01:15:49
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Averta Depicter Slider.This issue affects Depicter Slider: from n/a through 2.0.6.

CVE ID : CVE-2023-51491
Source : audit@patchstack.com
CVSS Score : 5.4

References :
https://patchstack.com/database/vulnerability/depicter/wordpress-depicter-slider-plugin-2-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51521

First published on : 16-03-2024 01:15:50
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.18.

CVE ID : CVE-2023-51521
Source : audit@patchstack.com
CVSS Score : 5.4

References :
https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-1-18-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51486

First published on : 16-03-2024 02:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in RedNao WooCommerce PDF Invoice Builder.This issue affects WooCommerce PDF Invoice Builder: from n/a through 1.2.101.

CVE ID : CVE-2023-51486
Source : audit@patchstack.com
CVSS Score : 5.4

References :
https://patchstack.com/database/vulnerability/woo-pdf-invoice-builder/wordpress-woocommerce-pdf-invoice-builder-create-invoices-packing-slips-and-more-plugin-1-2-101-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51487

First published on : 16-03-2024 02:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft ARI Stream Quiz.This issue affects ARI Stream Quiz: from n/a through 1.2.32.

CVE ID : CVE-2023-51487
Source : audit@patchstack.com
CVSS Score : 5.4

References :
https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-wordpress-quizzes-builder-plugin-1-2-32-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2024-24845

First published on : 16-03-2024 05:15:21
Last modified on : 17-03-2024 22:38:29

Description :
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sewpafly Post Thumbnail Editor.This issue affects Post Thumbnail Editor: from n/a through 2.4.8.

CVE ID : CVE-2024-24845
Source : audit@patchstack.com
CVSS Score : 5.3

References :
https://patchstack.com/database/vulnerability/post-thumbnail-editor/wordpress-post-thumbnail-editor-plugin-2-4-8-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-24867

First published on : 17-03-2024 16:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 6.9.4.

CVE ID : CVE-2024-24867
Source : audit@patchstack.com
CVSS Score : 5.3

References :
https://patchstack.com/database/vulnerability/wp-stats-manager/wordpress-wp-stats-manager-plugin-6-9-4-sensitive-data-exposure-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-25933

First published on : 17-03-2024 16:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 1.9.7.

CVE ID : CVE-2024-25933
Source : audit@patchstack.com
CVSS Score : 5.3

References :
https://patchstack.com/database/vulnerability/pepro-ultimate-invoice/wordpress-peprodev-ultimate-invoice-plugin-1-9-7-sensitive-data-exposure-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-25591

First published on : 17-03-2024 17:15:06
Last modified on : 17-03-2024 22:38:29

Description :
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Benjamin Rojas WP Editor.This issue affects WP Editor: from n/a through 1.2.7.

CVE ID : CVE-2024-25591
Source : audit@patchstack.com
CVSS Score : 5.3

References :
https://patchstack.com/database/vulnerability/wp-editor/wordpress-wp-editor-plugin-1-2-7-sensitive-data-exposure-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-25903

First published on : 17-03-2024 17:15:06
Last modified on : 17-03-2024 22:38:29

Description :
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a through 22.7.

CVE ID : CVE-2024-25903
Source : audit@patchstack.com
CVSS Score : 5.3

References :
https://patchstack.com/database/vulnerability/nmedia-user-file-uploader/wordpress-frontend-file-manager-plugin-plugin-22-7-sensitive-data-exposure-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2023-50861

First published on : 15-03-2024 14:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.

CVE ID : CVE-2023-50861
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-50886

First published on : 15-03-2024 15:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.

CVE ID : CVE-2023-50886
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/legal-pages/wordpress-legal-pages-plugin-1-3-7-broken-access-control-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352
Vulnerability : CWE-863

Vulnerability ID : CVE-2023-51369

First published on : 15-03-2024 15:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from n/a through 1.8.3.

CVE ID : CVE-2023-51369
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/customize-my-account-for-woocommerce/wordpress-customize-my-account-for-woocommerce-plugin-1-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51522

First published on : 15-03-2024 15:15:08
Last modified on : 15-03-2024 16:26:49

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.

CVE ID : CVE-2023-51522
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/paid-member-subscriptions/wordpress-paid-membership-subscriptions-plugin-2-10-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51407

First published on : 16-03-2024 01:15:48
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9.

CVE ID : CVE-2023-51407
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/split-test-for-elementor/wordpress-split-test-for-elementor-plugin-1-6-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51510

First published on : 16-03-2024 01:15:49
Last modified on : 17-03-2024 22:38:29

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Atlas Gondal Export Media URLs.This issue affects Export Media URLs: from n/a through 1.0.

CVE ID : CVE-2023-51510
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/export-media-urls/wordpress-export-media-urls-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Vulnerability ID : CVE-2023-51512

First published on : 16-03-2024 01:15:49
Last modified on : 17-03-2024 22:38:29

Description :
Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6.

CVE ID : CVE-2023-51512
Source : audit@patchstack.com
CVSS Score : 4.3

References :
https://patchstack.com/database/vulnerability/woo-product-tables/wordpress-product-table-by-wbw-plugin-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Source : github.com

Vulnerability ID : CVE-2024-27085

First published on : 15-03-2024 20:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed groups` site setting.

CVE ID : CVE-2024-27085
Source : security-advisories@github.com
CVSS Score : 6.5

References :
https://github.com/discourse/discourse/commit/62ea382247c1f87361d186392c45ca74c83be295 | source : security-advisories@github.com
https://github.com/discourse/discourse/security/advisories/GHSA-cvp5-h7p8-mjj6 | source : security-advisories@github.com

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-27100

First published on : 15-03-2024 20:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same site or a malicious staff member on another site in the same multisite cluster. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-27100
Source : security-advisories@github.com
CVSS Score : 6.5

References :
https://github.com/discourse/discourse/commit/8cade1e825e90a66f440e820992d43c6905f4b47 | source : security-advisories@github.com
https://github.com/discourse/discourse/security/advisories/GHSA-xq4v-qg27-gxgc | source : security-advisories@github.com

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-27930

First published on : 18-03-2024 16:15:08
Last modified on : 18-03-2024 19:40:00

Description :
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.

CVE ID : CVE-2024-27930
Source : security-advisories@github.com
CVSS Score : 6.5

References :
https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e | source : security-advisories@github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.13 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq | source : security-advisories@github.com

Vulnerability : CWE-285

Vulnerability ID : CVE-2024-27937

First published on : 18-03-2024 16:15:08
Last modified on : 18-03-2024 19:40:00

Description :
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

CVE ID : CVE-2024-27937
Source : security-advisories@github.com
CVSS Score : 6.5

References :
https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da | source : security-advisories@github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.13 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj | source : security-advisories@github.com

Vulnerability : CWE-285

Vulnerability ID : CVE-2024-27098

First published on : 18-03-2024 17:15:06
Last modified on : 18-03-2024 19:40:00

Description :
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

CVE ID : CVE-2024-27098
Source : security-advisories@github.com
CVSS Score : 6.4

References :
https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.13 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w | source : security-advisories@github.com

Vulnerability : CWE-918

Vulnerability ID : CVE-2024-28249

First published on : 18-03-2024 22:15:08
Last modified on : 18-03-2024 22:15:08

Description :
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.

CVE ID : CVE-2024-28249
Source : security-advisories@github.com
CVSS Score : 6.1

References :
https://github.com/cilium/cilium/releases/tag/v1.13.13 | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.14.8 | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.15.2 | source : security-advisories@github.com
https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36 | source : security-advisories@github.com

Vulnerability : CWE-311

Vulnerability ID : CVE-2024-28250

First published on : 18-03-2024 22:15:08
Last modified on : 18-03-2024 22:15:08

Description :
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.

CVE ID : CVE-2024-28250
Source : security-advisories@github.com
CVSS Score : 6.1

References :
https://github.com/cilium/cilium/releases/tag/v1.13.13 | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.14.8 | source : security-advisories@github.com
https://github.com/cilium/cilium/releases/tag/v1.15.2 | source : security-advisories@github.com
https://github.com/cilium/cilium/security/advisories/GHSA-v6q2-4qr3-5cw6 | source : security-advisories@github.com

Vulnerability : CWE-311

Vulnerability ID : CVE-2024-24748

First published on : 15-03-2024 20:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-24748
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193 | source : security-advisories@github.com
https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x | source : security-advisories@github.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-24827

First published on : 15-03-2024 20:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` will determine the amount of resources used when creating an upload. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should reduce `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` as smaller uploads require less resources to process. Alternatively, `client_max_body_size` can be reduced in Nginx to prevent large uploads from reaching the server.

CVE ID : CVE-2024-24827
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/discourse/discourse/commit/003b80e62f97cd8c0114d6b9d3f93c10443e6fae | source : security-advisories@github.com
https://github.com/discourse/discourse/security/advisories/GHSA-58vw-246g-fjj4 | source : security-advisories@github.com

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-28242

First published on : 15-03-2024 20:15:09
Last modified on : 17-03-2024 22:38:29

Description :
Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.

CVE ID : CVE-2024-28242
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 | source : security-advisories@github.com
https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 | source : security-advisories@github.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-28862

First published on : 16-03-2024 00:15:07
Last modified on : 17-03-2024 22:38:29

Description :
The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.

CVE ID : CVE-2024-28862
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f | source : security-advisories@github.com

Vulnerability : CWE-276

Vulnerability ID : CVE-2024-27914

First published on : 18-03-2024 17:15:07
Last modified on : 18-03-2024 19:40:00

Description :
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.

CVE ID : CVE-2024-27914
Source : security-advisories@github.com
CVSS Score : 5.3

References :
https://github.com/glpi-project/glpi/commit/69e0dee8de0c0df139b42dbfa1a8997888c2af95 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.13 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-rcxj-fqr4-q34r | source : security-advisories@github.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-28859

First published on : 15-03-2024 23:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE ID : CVE-2024-28859
Source : security-advisories@github.com
CVSS Score : 5.0

References :
https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166 | source : security-advisories@github.com
https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r | source : security-advisories@github.com

Vulnerability : CWE-502

Vulnerability ID : CVE-2024-27104

First published on : 18-03-2024 17:15:06
Last modified on : 18-03-2024 19:40:00

Description :
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

CVE ID : CVE-2024-27104
Source : security-advisories@github.com
CVSS Score : 4.5

References :
https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.13 | source : security-advisories@github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj | source : security-advisories@github.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2023-51699

First published on : 15-03-2024 19:15:06
Last modified on : 17-03-2024 22:38:29

Description :
Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.

CVE ID : CVE-2023-51699
Source : security-advisories@github.com
CVSS Score : 4.0

References :
https://github.com/fluid-cloudnative/fluid/commit/e0184cff8790ad000c3e8943392c7f544fad7d66 | source : security-advisories@github.com
https://github.com/fluid-cloudnative/fluid/security/advisories/GHSA-wx8q-4gm9-rj2g | source : security-advisories@github.com

Vulnerability : CWE-78

Vulnerability ID : CVE-2024-28851

First published on : 15-03-2024 19:15:07
Last modified on : 17-03-2024 22:38:29

Description :
The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.

CVE ID : CVE-2024-28851
Source : security-advisories@github.com
CVSS Score : 4.0

References :
https://github.com/snowflakedb/snowflake-hive-metastore-connector/blob/master/scripts/add_snowflake_hive_metastore_connector_script_action.sh | source : security-advisories@github.com
https://github.com/snowflakedb/snowflake-hive-metastore-connector/commit/dfbf87dff456f6bb62c927711d97316f0c71d8ca | source : security-advisories@github.com
https://github.com/snowflakedb/snowflake-hive-metastore-connector/security/advisories/GHSA-r68p-g2x9-mq7x | source : security-advisories@github.com

Vulnerability : CWE-269

Vulnerability ID : CVE-2024-28237

First published on : 18-03-2024 22:15:07
Last modified on : 18-03-2024 22:15:07

Description :
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute JavaScript code in the victims browser when attempting to render the snapshot image. An attacker who successfully talked a victim with admin rights into performing a snapshot test with such a crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The vulnerability is patched in version 1.10.0rc3. OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation and what settings they modify based on instructions by strangers.

CVE ID : CVE-2024-28237
Source : security-advisories@github.com
CVSS Score : 4.0

References :
https://github.com/OctoPrint/OctoPrint/commit/779894c1bc6478332d14bc9ed1006df1354eb517 | source : security-advisories@github.com
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-x7mf-wrh9-r76c | source : security-advisories@github.com

Vulnerability : CWE-79

Source : wordfence.com

Vulnerability ID : CVE-2024-1796

First published on : 15-03-2024 07:15:09
Last modified on : 15-03-2024 12:53:06

Description :
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-1796
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3045600%40woocommerce-products-filter&new=3045600%40woocommerce-products-filter&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/748bc714-25ba-404e-ac3d-e588fd95b2f9?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-2399

First published on : 15-03-2024 07:15:09
Last modified on : 15-03-2024 12:53:06

Description :
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.10.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-2399
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.23/widgets/premium-media-wheel.php#L2753 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/3051259/premium-addons-for-elementor/trunk/widgets/premium-media-wheel.php | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/dc057069-15cd-477f-9106-e616e919c62f?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-2308

First published on : 16-03-2024 02:15:09
Last modified on : 17-03-2024 22:38:29

Description :
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link in the EliSlider in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-2308
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050556%40elementinvader-addons-for-elementor&new=3050556%40elementinvader-addons-for-elementor&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/40a272dc-cb2a-472f-be42-733efcb2fa61?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-1239

First published on : 16-03-2024 03:15:06
Last modified on : 17-03-2024 22:38:29

Description :
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-1239
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042291%40elementskit-lite&new=3042291%40elementskit-lite&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/1822fd58-0dba-4b15-9702-32e3aa4405b3?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-2042

First published on : 16-03-2024 03:15:07
Last modified on : 17-03-2024 22:38:29

Description :
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2024-2042
Source : security@wordfence.com
CVSS Score : 6.4

References :
https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.4/widgets/image-accordion/image-accordion.php#L962 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050248%40elementskit-lite&new=3050248%40elementskit-lite&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/be4ce3e6-8baa-419f-a48e-4256c306fbc1?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2023-6525

First published on : 16-03-2024 03:15:06
Last modified on : 17-03-2024 22:38:29

Description :
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multi-site installations and installations where unfiltered_html has been disabled.

CVE ID : CVE-2023-6525
Source : security@wordfence.com
CVSS Score : 5.5

References :
https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.3/widgets/progressbar/progressbar.php#L535 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset/3011323/elementskit-lite/trunk/widgets/progressbar/progressbar.php | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/e724394d-97aa-42e4-b36e-6e49bfefa2f6?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-1733

First published on : 16-03-2024 06:15:13
Last modified on : 17-03-2024 22:38:29

Description :
The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_replacer_ultra() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update arbitrary content on the affected WordPress site.

CVE ID : CVE-2024-1733
Source : security@wordfence.com
CVSS Score : 5.3

References :
https://plugins.trac.wordpress.org/browser/word-replacer-ultra/trunk/inc/word-replacer-ultra-ajax.php#L16 | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/1da53718-c2a2-45d0-ad43-daff3c68342d?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-1857

First published on : 16-03-2024 09:15:06
Last modified on : 17-03-2024 22:38:29

Description :
The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.

CVE ID : CVE-2024-1857
Source : security@wordfence.com
CVSS Score : 5.3

References :
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3046745%40woo-gift-cards-lite&new=3046745%40woo-gift-cards-lite&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0d0c44-0ee8-400b-a4ea-e5520c2a6710?source=cve | source : security@wordfence.com

Vulnerability ID : CVE-2024-2294

First published on : 16-03-2024 02:15:09
Last modified on : 17-03-2024 22:38:29

Description :
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.

CVE ID : CVE-2024-2294
Source : security@wordfence.com
CVSS Score : 4.9

References :
https://plugins.trac.wordpress.org/browser/backuply/trunk/functions.php#L1615 | source : security@wordfence.com
https://plugins.trac.wordpress.org/browser/backuply/trunk/main/ajax.php#L78 | source : security@wordfence.com
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050547%40backuply&new=3050547%40backuply&sfp_email=&sfph_mail= | source : security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/be3bd1f2-092c-47c4-a4e4-3365e107c57f?source=cve | source : security@wordfence.com

Source : us.ibm.com

Vulnerability ID : CVE-2021-38938

First published on : 15-03-2024 16:15:07
Last modified on : 15-03-2024 16:26:49

Description :
IBM Host Access Transformation Services (HATS) 9.6 through 9.6.1.4 and 9.7 through 9.7.0.3 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 210989.

CVE ID : CVE-2021-38938
Source : psirt@us.ibm.com
CVSS Score : 6.2

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/210989 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/6832964 | source : psirt@us.ibm.com

Vulnerability : CWE-522

Vulnerability ID : CVE-2023-47162

First published on : 15-03-2024 15:15:07
Last modified on : 15-03-2024 16:26:49

Description :
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 270973.

CVE ID : CVE-2023-47162
Source : psirt@us.ibm.com
CVSS Score : 6.1

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/270973 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7142038 | source : psirt@us.ibm.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2023-47699

First published on : 15-03-2024 16:15:08
Last modified on : 15-03-2024 16:26:49

CVE ID : CVE-2023-47699
Source : psirt@us.ibm.com
CVSS Score : 6.1

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/270974 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7142038 | source : psirt@us.ibm.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2023-47147

First published on : 15-03-2024 16:15:08
Last modified on : 15-03-2024 16:26:49

Description :
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598.

CVE ID : CVE-2023-47147
Source : psirt@us.ibm.com
CVSS Score : 5.9

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/270598 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7142038 | source : psirt@us.ibm.com

Vulnerability : CWE-73

Vulnerability ID : CVE-2023-46182

First published on : 15-03-2024 15:15:07
Last modified on : 15-03-2024 16:26:49

CVE ID : CVE-2023-46182
Source : psirt@us.ibm.com
CVSS Score : 5.4

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/269692 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7142038 | source : psirt@us.ibm.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2023-46179

First published on : 15-03-2024 15:15:07
Last modified on : 15-03-2024 16:26:49

Description :
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 269683.

CVE ID : CVE-2023-46179
Source : psirt@us.ibm.com
CVSS Score : 4.3

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/269683 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7142038 | source : psirt@us.ibm.com

Vulnerability : CWE-614

Vulnerability ID : CVE-2023-46181

First published on : 15-03-2024 16:15:07
Last modified on : 15-03-2024 16:26:49

Description :
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686.

CVE ID : CVE-2023-46181
Source : psirt@us.ibm.com
CVSS Score : 4.0

References :
https://exchange.xforce.ibmcloud.com/vulnerabilities/269686 | source : psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7142038 | source : psirt@us.ibm.com

Vulnerability : CWE-525

Source : mattermost.com

Vulnerability ID : CVE-2024-2445

First published on : 15-03-2024 10:15:07
Last modified on : 15-03-2024 12:53:06

Description :
Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

CVE ID : CVE-2024-2445
Source : responsibledisclosure@mattermost.com
CVSS Score : 6.1

References :
https://mattermost.com/security-updates | source : responsibledisclosure@mattermost.com

Vulnerability : CWE-74

Vulnerability ID : CVE-2024-2446

First published on : 15-03-2024 10:15:08
Last modified on : 15-03-2024 12:53:06

Description :
Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

CVE ID : CVE-2024-2446
Source : responsibledisclosure@mattermost.com
CVSS Score : 4.3

References :
https://mattermost.com/security-updates | source : responsibledisclosure@mattermost.com

Vulnerability : CWE-400

Source : fluidattacks.com

Vulnerability ID : CVE-2024-2180

First published on : 15-03-2024 05:15:06
Last modified on : 15-03-2024 12:53:06

Description :
Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard64.sys drivers

CVE ID : CVE-2024-2180
Source : help@fluidattacks.com
CVSS Score : 5.5

References :
https://fluidattacks.com/advisories/gomez/ | source : help@fluidattacks.com
https://zemana.com/us/antilogger.html | source : help@fluidattacks.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-2204

First published on : 15-03-2024 05:15:07
Last modified on : 15-03-2024 12:53:06

Description :
Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL codes of the zam64.sys and zamguard64.sys drivers.

CVE ID : CVE-2024-2204
Source : help@fluidattacks.com
CVSS Score : 5.5

References :
https://fluidattacks.com/advisories/hassan/ | source : help@fluidattacks.com
https://zemana.com/us/antilogger.html | source : help@fluidattacks.com

Vulnerability : CWE-476

Source : adobe.com

Vulnerability ID : CVE-2024-20757

First published on : 18-03-2024 16:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20757
Source : psirt@adobe.com
CVSS Score : 5.5

References :
https://helpx.adobe.com/security/products/bridge/apsb24-15.html | source : psirt@adobe.com

Vulnerability : CWE-125

Vulnerability ID : CVE-2024-20762

First published on : 18-03-2024 18:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE ID : CVE-2024-20762
Source : psirt@adobe.com
CVSS Score : 5.5

References :
https://helpx.adobe.com/security/products/animate/apsb24-19.html | source : psirt@adobe.com

Vulnerability : CWE-125

Vulnerability ID : CVE-2024-20763

First published on : 18-03-2024 18:15:09
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-20763
Source : psirt@adobe.com
CVSS Score : 5.5

References :
https://helpx.adobe.com/security/products/animate/apsb24-19.html | source : psirt@adobe.com

Vulnerability : CWE-125

Vulnerability ID : CVE-2024-20764

First published on : 18-03-2024 18:15:09
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-20764
Source : psirt@adobe.com
CVSS Score : 5.5

References :
https://helpx.adobe.com/security/products/animate/apsb24-19.html | source : psirt@adobe.com

Vulnerability : CWE-125

Vulnerability ID : CVE-2024-20760

First published on : 18-03-2024 18:15:08
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVE ID : CVE-2024-20760
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-20768

First published on : 18-03-2024 18:15:09
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-20768
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26028

First published on : 18-03-2024 18:15:09
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26028
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26030

First published on : 18-03-2024 18:15:10
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26030
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26031

First published on : 18-03-2024 18:15:10
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26031
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26032

First published on : 18-03-2024 18:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the victim's browser. Exploitation of this issue requires user interaction.

CVE ID : CVE-2024-26032
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26033

First published on : 18-03-2024 18:15:10
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26033
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26034

First published on : 18-03-2024 18:15:11
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26034
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26035

First published on : 18-03-2024 18:15:11
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26035
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26038

First published on : 18-03-2024 18:15:11
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26038
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26040

First published on : 18-03-2024 18:15:11
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26040
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26041

First published on : 18-03-2024 18:15:12
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26041
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26042

First published on : 18-03-2024 18:15:12
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26042
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26043

First published on : 18-03-2024 18:15:12
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26043
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26044

First published on : 18-03-2024 18:15:12
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the victim's browser.

CVE ID : CVE-2024-26044
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26045

First published on : 18-03-2024 18:15:13
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26045
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26052

First published on : 18-03-2024 18:15:13
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26052
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26056

First published on : 18-03-2024 18:15:14
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26056
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26059

First published on : 18-03-2024 18:15:14
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26059
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26061

First published on : 18-03-2024 18:15:14
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26061
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26062

First published on : 18-03-2024 18:15:14
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26062
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26064

First published on : 18-03-2024 18:15:15
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the victim's browser. Exploitation of this issue requires user interaction.

CVE ID : CVE-2024-26064
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26065

First published on : 18-03-2024 18:15:15
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26065
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26067

First published on : 18-03-2024 18:15:15
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26067
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26069

First published on : 18-03-2024 18:15:15
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26069
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26073

First published on : 18-03-2024 18:15:16
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26073
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26080

First published on : 18-03-2024 18:15:16
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26080
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26094

First published on : 18-03-2024 18:15:16
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26094
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26096

First published on : 18-03-2024 18:15:16
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26096
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26101

First published on : 18-03-2024 18:15:17
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

CVE ID : CVE-2024-26101
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26102

First published on : 18-03-2024 18:15:17
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26102
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26103

First published on : 18-03-2024 18:15:17
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26103
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26104

First published on : 18-03-2024 18:15:17
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26104
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26105

First published on : 18-03-2024 18:15:18
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26105
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26106

First published on : 18-03-2024 18:15:18
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26106
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26107

First published on : 18-03-2024 18:15:18
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26107
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26118

First published on : 18-03-2024 18:15:18
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26118
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26120

First published on : 18-03-2024 18:15:19
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26120
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26124

First published on : 18-03-2024 18:15:19
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26124
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26125

First published on : 18-03-2024 18:15:19
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26125
Source : psirt@adobe.com
CVSS Score : 5.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-26063

First published on : 18-03-2024 18:15:14
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information, potentially bypassing security measures. Exploitation of this issue does not require user interaction.

CVE ID : CVE-2024-26063
Source : psirt@adobe.com
CVSS Score : 5.3

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-26119

First published on : 18-03-2024 18:15:19
Last modified on : 18-03-2024 19:40:00

Description :
Adobe Experience Manager versions 6.5.19 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

CVE ID : CVE-2024-26119
Source : psirt@adobe.com
CVSS Score : 5.3

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-284

Vulnerability ID : CVE-2024-26050

First published on : 18-03-2024 18:15:13
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26050
Source : psirt@adobe.com
CVSS Score : 4.8

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Source : incibe.es

Vulnerability ID : CVE-2024-2495

First published on : 15-03-2024 13:15:09
Last modified on : 15-03-2024 16:26:49

Description :
Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to compromise the confidentiality and integrity of encrypted data.

CVE ID : CVE-2024-2495
Source : cve-coordination@incibe.es
CVSS Score : 5.2

References :
https://www.incibe.es/en/incibe-cert/notices/aviso/cryptographic-key-plain-text-vulnerability-friendlyelecs-friendlywrt | source : cve-coordination@incibe.es

Vulnerability : CWE-1321

Source : opentext.com

Vulnerability ID : CVE-2023-7248

First published on : 15-03-2024 20:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. This issue impacts the following Vertica Management Console versions: 10.x 11.1.1-24 or lower 12.0.4-18 or lower Please upgrade to one of the following Vertica Management Console versions: 10.x to upgrade to latest versions from below. 11.1.1-25 12.0.4-19 23.x 24.x

CVE ID : CVE-2023-7248
Source : security@opentext.com
CVSS Score : 5.0

References :
https://portal.microfocus.com/s/article/KM000027542?language=en_US | source : security@opentext.com

Vulnerability : CWE-20

Source : logitech.com

Vulnerability ID : CVE-2024-2537

First published on : 15-03-2024 18:15:08
Last modified on : 17-03-2024 22:38:29

Description :
Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion.

CVE ID : CVE-2024-2537
Source : cve-coordination@logitech.com
CVSS Score : 4.4

References :
https://hackerone.com/reports/2376663 | source : cve-coordination@logitech.com

Vulnerability : CWE-913

(19) LOW VULNERABILITIES [0.1, 3.9]

Source : vuldb.com

Vulnerability ID : CVE-2024-2482

First published on : 15-03-2024 07:15:10
Last modified on : 15-03-2024 12:53:06

Description :
A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /check_availability.php of the component HTTP POST Request Handler. The manipulation of the argument oldpassword leads to observable response discrepancy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256891.

CVE ID : CVE-2024-2482
Source : cna@vuldb.com
CVSS Score : 3.7

References :
https://github.com/blackslim3/cve_sidequest/blob/main/poc/Username_and_Password_Enumeration%20on%20Hostel%20Management%20System%20using%20PHP%20and%20MySQL%201.0.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256891 | source : cna@vuldb.com
https://vuldb.com/?id.256891 | source : cna@vuldb.com

Vulnerability : CWE-204

Vulnerability ID : CVE-2024-2479

First published on : 15-03-2024 06:15:10
Last modified on : 16-03-2024 22:15:07

Description :
A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The manipulation of the argument Query leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256887. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2479
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://johnermac.github.io/cve/xss/ | source : cna@vuldb.com
https://vuldb.com/?ctiid.256887 | source : cna@vuldb.com
https://vuldb.com/?id.256887 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2515

First published on : 16-03-2024 09:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as problematic, has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this issue is some unknown functionality of the file home.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256952. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2515
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20home.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256952 | source : cna@vuldb.com
https://vuldb.com/?id.256952 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2518

First published on : 16-03-2024 13:15:05
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as problematic. This issue affects some unknown processing of the file book_history.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256955. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2518
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20book_history.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256955 | source : cna@vuldb.com
https://vuldb.com/?id.256955 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2519

First published on : 16-03-2024 15:15:08
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been classified as problematic. Affected is an unknown function of the file navbar.php. The manipulation of the argument id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256956. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2519
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20navbar.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256956 | source : cna@vuldb.com
https://vuldb.com/?id.256956 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2521

First published on : 16-03-2024 16:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/bookdate.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2521
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20bookdate.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256958 | source : cna@vuldb.com
https://vuldb.com/?id.256958 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2523

First published on : 16-03-2024 17:15:05
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability classified as problematic was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This vulnerability affects unknown code of the file /admin/booktime.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2523
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20booktime.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256960 | source : cna@vuldb.com
https://vuldb.com/?id.256960 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2525

First published on : 16-03-2024 18:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as problematic, was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected is an unknown function of the file /admin/receipt.php. The manipulation of the argument id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2525
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20receipt.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256962 | source : cna@vuldb.com
https://vuldb.com/?id.256962 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2526

First published on : 16-03-2024 19:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/rooms.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2526
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20rooms.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256963 | source : cna@vuldb.com
https://vuldb.com/?id.256963 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2530

First published on : 16-03-2024 21:15:29
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/update-rooms.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2530
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20update-rooms.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256967 | source : cna@vuldb.com
https://vuldb.com/?id.256967 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2533

First published on : 16-03-2024 23:15:06
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as problematic, has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-users.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256970 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2533
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20update-users.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256970 | source : cna@vuldb.com
https://vuldb.com/?id.256970 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2535

First published on : 17-03-2024 01:15:50
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/users.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256972. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2024-2535
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20users.php.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.256972 | source : cna@vuldb.com
https://vuldb.com/?id.256972 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2553

First published on : 17-03-2024 04:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability, which was classified as problematic, was found in SourceCodester Product Review Rating System 1.0. Affected is an unknown function of the component Rate Product Handler. The manipulation of the argument Your Name/Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257052.

CVE ID : CVE-2024-2553
Source : cna@vuldb.com
CVSS Score : 3.5

References :
https://github.com/BurakSevben/CVEs/blob/main/Product%20Rating%20System/Product%20Rating%20System%20-%20Cross-Site-Scripting-1.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257052 | source : cna@vuldb.com
https://vuldb.com/?id.257052 | source : cna@vuldb.com

Vulnerability : CWE-79

Vulnerability ID : CVE-2024-2567

First published on : 17-03-2024 21:15:05
Last modified on : 17-03-2024 22:38:29

Description :
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in jurecapuder AndroidWeatherApp 1.0.0 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. VDB-257070 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The code maintainer was contacted early about this disclosure but did not respond in any way. Instead the GitHub repository got deleted after a few days. We have to assume that the product is not supported anymore.

CVE ID : CVE-2024-2567
Source : cna@vuldb.com
CVSS Score : 1.8

References :
https://github.com/ctflearner/Android_Findings/blob/main/AndroidWeatherApp/Android_backup.md | source : cna@vuldb.com
https://vuldb.com/?ctiid.257070 | source : cna@vuldb.com
https://vuldb.com/?id.257070 | source : cna@vuldb.com

Vulnerability : CWE-530

Source : mattermost.com

Vulnerability ID : CVE-2024-24975

First published on : 15-03-2024 09:15:06
Last modified on : 15-03-2024 12:53:06

Description :
Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax highlighter, allowing an attacker to send a very large code block and crash the mobile app.

CVE ID : CVE-2024-24975
Source : responsibledisclosure@mattermost.com
CVSS Score : 3.5

References :
https://mattermost.com/security-updates | source : responsibledisclosure@mattermost.com

Vulnerability : CWE-400

Vulnerability ID : CVE-2024-28053

First published on : 15-03-2024 09:15:07
Last modified on : 15-03-2024 12:53:06

Description :
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.

CVE ID : CVE-2024-28053
Source : responsibledisclosure@mattermost.com
CVSS Score : 3.1

References :
https://mattermost.com/security-updates | source : responsibledisclosure@mattermost.com

Vulnerability : CWE-400

Source : adobe.com

Vulnerability ID : CVE-2024-26051

First published on : 18-03-2024 18:15:13
Last modified on : 18-03-2024 19:40:00

CVE ID : CVE-2024-26051
Source : psirt@adobe.com
CVSS Score : 3.4

References :
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html | source : psirt@adobe.com

Vulnerability : CWE-79

Source : github.com

Vulnerability ID : CVE-2024-28864

First published on : 18-03-2024 22:15:09
Last modified on : 18-03-2024 22:15:09

Description :
SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.

CVE ID : CVE-2024-28864
Source : security-advisories@github.com
CVSS Score : 2.6

References :
https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627 | source : security-advisories@github.com
https://github.com/IlicMiljan/Secure-Props/issues/20 | source : security-advisories@github.com
https://github.com/IlicMiljan/Secure-Props/pull/21 | source : security-advisories@github.com
https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8 | source : security-advisories@github.com

Vulnerability : CWE-1333

Vulnerability ID : CVE-2024-22412

First published on : 18-03-2024 21:15:06
Last modified on : 18-03-2024 21:15:06

Description :
ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.

CVE ID : CVE-2024-22412
Source : security-advisories@github.com
CVSS Score : 2.4

References :
https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015 | source : security-advisories@github.com
https://github.com/ClickHouse/ClickHouse/pull/58611 | source : security-advisories@github.com
https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r | source : security-advisories@github.com

Vulnerability : CWE-863

(130) NO SCORE VULNERABILITIES [0.0, 0.0]

Source : mitre.org

Vulnerability ID : CVE-2024-26454

First published on : 15-03-2024 01:15:58
Last modified on : 15-03-2024 12:53:06

Description :
A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php.

CVE ID : CVE-2024-26454
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/OmRajpurkar/Healthcare-Chatbot/issues/4 | source : cve@mitre.org
https://medium.com/%400x0d0x0a/healthcare-chatbot-xss-cve-2024-26454-acf2607bf210 | source : cve@mitre.org

Vulnerability ID : CVE-2024-26540

First published on : 15-03-2024 01:15:58
Last modified on : 15-03-2024 12:53:06

Description :
A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze.

CVE ID : CVE-2024-26540
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/GreycLab/CImg/issues/403 | source : cve@mitre.org

Vulnerability ID : CVE-2024-25227

First published on : 15-03-2024 06:15:08
Last modified on : 15-03-2024 12:53:06

Description :
SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via the tb_login parameter in admin login page.

CVE ID : CVE-2024-25227
Source : cve@mitre.org
CVSS Score : /

References :
https://thetrueartist.wixsite.com/cveblog/post/understanding-the-potential-impact-of-cve-2024-25227-what-you-need-to-know-and-how-it-was-discovered | source : cve@mitre.org

Vulnerability ID : CVE-2024-27756

First published on : 15-03-2024 07:15:09
Last modified on : 15-03-2024 12:53:06

Description :
An issue in GLPI v.10.0.12 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the title field.

CVE ID : CVE-2024-27756
Source : cve@mitre.org
CVSS Score : /

References :
https://medium.com/%40cristiansindile/formula-injection-in-glpi-cve-2024-27756-3649c7cca092 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28353

First published on : 15-03-2024 08:15:06
Last modified on : 15-03-2024 12:53:06

Description :
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi interface, thereby gaining root shell privileges.

CVE ID : CVE-2024-28353
Source : cve@mitre.org
CVSS Score : /

References :
https://warp-desk-89d.notion.site/TEW-827DRU-5c40fb20572148f0b00f329d69273791 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28354

First published on : 15-03-2024 08:15:07
Last modified on : 15-03-2024 12:53:06

Description :
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi interface, thereby gaining root shell privileges.

CVE ID : CVE-2024-28354
Source : cve@mitre.org
CVSS Score : /

References :
https://warp-desk-89d.notion.site/TEW-827DRU-c732df50b2454ecaa5451b02f3adda6a | source : cve@mitre.org

Vulnerability ID : CVE-2024-28318

First published on : 15-03-2024 15:15:08
Last modified on : 15-03-2024 16:26:49

Description :
gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325

CVE ID : CVE-2024-28318
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/gpac/gpac/issues/2764 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28319

First published on : 15-03-2024 15:15:09
Last modified on : 15-03-2024 16:26:49

Description :
gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374

CVE ID : CVE-2024-28319
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/gpac/gpac/issues/2763 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28403

First published on : 15-03-2024 16:15:08
Last modified on : 15-03-2024 17:15:08

Description :
TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.

CVE ID : CVE-2024-28403
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_5_VPN/XSS.md | source : cve@mitre.org
https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html | source : cve@mitre.org

Vulnerability ID : CVE-2024-28401

First published on : 15-03-2024 17:15:08
Last modified on : 17-03-2024 22:38:29

Description :
TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.

CVE ID : CVE-2024-28401
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_1_Root_Access_Control/XSS.md | source : cve@mitre.org
https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html | source : cve@mitre.org

Vulnerability ID : CVE-2024-28404

First published on : 15-03-2024 17:15:08
Last modified on : 17-03-2024 22:38:29

Description :
TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.

CVE ID : CVE-2024-28404
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_3_MAC_Filtering/XSS.md | source : cve@mitre.org
https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html | source : cve@mitre.org

Vulnerability ID : CVE-2024-27351

First published on : 15-03-2024 20:15:09
Last modified on : 17-03-2024 22:38:29

Description :
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

CVE ID : CVE-2024-27351
Source : cve@mitre.org
CVSS Score : /

References :
https://docs.djangoproject.com/en/5.0/releases/security/ | source : cve@mitre.org
https://groups.google.com/forum/#%21forum/django-announce | source : cve@mitre.org
https://www.djangoproject.com/weblog/2024/mar/04/security-releases/ | source : cve@mitre.org

Vulnerability ID : CVE-2024-24156

First published on : 16-03-2024 06:15:13
Last modified on : 17-03-2024 22:38:29

Description :
Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrary code via the wr_content parameter.

CVE ID : CVE-2024-24156
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/gnuboard/g6/issues/316 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28069

First published on : 16-03-2024 06:15:13
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to access sensitive information and potentially conduct unauthorized actions within the vulnerable component.

CVE ID : CVE-2024-28069
Source : cve@mitre.org
CVSS Score : /

References :
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0001 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28070

First published on : 16-03-2024 06:15:14
Last modified on : 17-03-2024 22:38:29

Description :
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information and gain unauthorized access.

CVE ID : CVE-2024-28070
Source : cve@mitre.org
CVSS Score : /

References :
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0002 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28639

First published on : 16-03-2024 06:15:14
Last modified on : 17-03-2024 22:38:29

Description :
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.

CVE ID : CVE-2024-28639
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/ZIKH26/CVE-information/blob/master/TOTOLINK/Vulnerability%20Information_1.md | source : cve@mitre.org

Vulnerability ID : CVE-2024-28640

First published on : 16-03-2024 06:15:14
Last modified on : 17-03-2024 22:38:29

Description :
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field.

CVE ID : CVE-2024-28640
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/ZIKH26/CVE-information/blob/master/TOTOLINK/Vulnerability%20Information_2.md | source : cve@mitre.org

Vulnerability ID : CVE-2024-22513

First published on : 16-03-2024 07:15:06
Last modified on : 17-03-2024 22:38:29

Description :
djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

CVE ID : CVE-2024-22513
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 | source : cve@mitre.org

Vulnerability ID : CVE-2023-52159

First published on : 18-03-2024 02:15:06
Last modified on : 18-03-2024 12:38:25

Description :
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.

CVE ID : CVE-2023-52159
Source : cve@mitre.org
CVSS Score : /

References :
https://codeberg.org/bizdelnick/gross/wiki/Known-vulnerabilities#cve-2023-52159 | source : cve@mitre.org

Vulnerability ID : CVE-2024-24230

First published on : 18-03-2024 02:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime().exec followed by an OS command.

CVE ID : CVE-2024-24230
Source : cve@mitre.org
CVSS Score : /

References :
https://blog.munz4u.de/posts/2023/11/cve-2023-xxxxx-rce-via-ssti-in-komm.one-cms-10.4.2.14/ | source : cve@mitre.org

Vulnerability ID : CVE-2022-47036

First published on : 18-03-2024 03:15:05
Last modified on : 18-03-2024 12:38:25

Description :
Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware, which would typically be used with firmware 2.1.1 or later.

CVE ID : CVE-2022-47036
Source : cve@mitre.org
CVSS Score : /

References :
https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html | source : cve@mitre.org

Vulnerability ID : CVE-2022-47037

First published on : 18-03-2024 03:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials.

CVE ID : CVE-2022-47037
Source : cve@mitre.org
CVSS Score : /

References :
https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html | source : cve@mitre.org

Vulnerability ID : CVE-2024-24539

First published on : 18-03-2024 03:15:06
Last modified on : 18-03-2024 12:38:25

Description :
FusionPBX before 5.2.0 does not validate a session.

CVE ID : CVE-2024-24539
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/fusionpbx/fusionpbx/commit/2f8bed375c124c1d7e36138acc6903fcfcf15a8f | source : cve@mitre.org
https://github.com/fusionpbx/fusionpbx/commit/ee202cd61dc9a79fb2d634b1ad21ff2416d531cb | source : cve@mitre.org

Vulnerability ID : CVE-2024-27757

First published on : 18-03-2024 04:15:09
Last modified on : 18-03-2024 12:38:25

Description :
flusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."

CVE ID : CVE-2024-27757
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/jubilianite/flusity-CMS/security/advisories/GHSA-5843-5m74-7fqh | source : cve@mitre.org

Vulnerability ID : CVE-2018-25099

First published on : 18-03-2024 05:15:06
Last modified on : 18-03-2024 12:38:25

Description :
In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.

CVE ID : CVE-2018-25099
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/DCIT/perl-CryptX/issues/47 | source : cve@mitre.org
https://github.com/libtom/libtomcrypt/pull/451 | source : cve@mitre.org
https://metacpan.org/dist/CryptX/changes | source : cve@mitre.org

Vulnerability ID : CVE-2021-47154

First published on : 18-03-2024 05:15:06
Last modified on : 18-03-2024 12:38:25

Description :
The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

CVE ID : CVE-2021-47154
Source : cve@mitre.org
CVSS Score : /

References :
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ | source : cve@mitre.org
https://github.com/stigtsp/Net-CIDR-Lite/commit/23b6ff0590dc279521863a502e890ef19a5a76fc | source : cve@mitre.org
https://metacpan.org/dist/Net-CIDR-Lite/changes | source : cve@mitre.org
https://metacpan.org/pod/Net::CIDR::Lite | source : cve@mitre.org

Vulnerability ID : CVE-2021-47155

First published on : 18-03-2024 05:15:06
Last modified on : 18-03-2024 12:38:25

Description :
The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

CVE ID : CVE-2021-47155
Source : cve@mitre.org
CVSS Score : /

References :
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-ipv4addrhttpsmetacpanorgreleasenet-ipv4addr | source : cve@mitre.org
https://metacpan.org/release/Net-IPv4Addr | source : cve@mitre.org

Vulnerability ID : CVE-2021-47156

First published on : 18-03-2024 05:15:06
Last modified on : 18-03-2024 12:38:25

Description :
The Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

CVE ID : CVE-2021-47156
Source : cve@mitre.org
CVSS Score : /

References :
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ | source : cve@mitre.org
https://metacpan.org/release/Net-IPAddress-Util | source : cve@mitre.org
https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-5.000/changes | source : cve@mitre.org

Vulnerability ID : CVE-2021-47157

First published on : 18-03-2024 05:15:06
Last modified on : 18-03-2024 12:38:25

Description :
The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.

CVE ID : CVE-2021-47157
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/kazeburo/Kossy/pull/16 | source : cve@mitre.org
https://metacpan.org/dist/Kossy/changes | source : cve@mitre.org

Vulnerability ID : CVE-2024-29151

First published on : 18-03-2024 06:15:05
Last modified on : 18-03-2024 12:38:25

Description :
Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.

CVE ID : CVE-2024-29151
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/RocketChat/Rocket.Chat.Audit/blob/5ad78e8017a9e190602e8257c22500ded0d931a9/requirements.txt#L3 | source : cve@mitre.org

Vulnerability ID : CVE-2024-29156

First published on : 18-03-2024 07:15:05
Last modified on : 18-03-2024 12:38:25

Description :
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

CVE ID : CVE-2024-29156
Source : cve@mitre.org
CVSS Score : /

References :
https://launchpad.net/bugs/2048114 | source : cve@mitre.org
https://opendev.org/openstack/murano/tags | source : cve@mitre.org
https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3 | source : cve@mitre.org
https://wiki.openstack.org/wiki/OSSN/OSSN-0093 | source : cve@mitre.org

Vulnerability ID : CVE-2024-28550

First published on : 18-03-2024 13:15:07
Last modified on : 18-03-2024 19:40:00

Description :
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the filePath parameter of formExpandDlnaFile function.

CVE ID : CVE-2024-28550
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formExpandDlnaFile.md | source : cve@mitre.org

Vulnerability ID : CVE-2024-28537

First published on : 18-03-2024 14:15:09
Last modified on : 18-03-2024 19:40:00

Description :
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.

CVE ID : CVE-2024-28537
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromNatStaticSetting.md | source : cve@mitre.org

Vulnerability ID : CVE-2024-28547

First published on : 18-03-2024 14:15:10
Last modified on : 18-03-2024 19:40:00

Description :
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the firewallEn parameter of formSetFirewallCfg function.

CVE ID : CVE-2024-28547
Source : cve@mitre.org
CVSS Score : /

References :
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetFirewallCfg.md | source : cve@mitre.org

Vulnerability ID : CVE-2024-28054

First published on : 18-03-2024 17:15:07
Last modified on : 18-03-2024 19:40:00

Description :
Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.

CVE ID : CVE-2024-28054
Source : cve@mitre.org
CVSS Score : /

References :
https://gitlab.com/amavis/amavis/-/issues/112 | source : cve@mitre.org
https://gitlab.com/amavis/amavis/-/raw/v2.13.1/README_FILES/README.CVE-2024-28054 | source : cve@mitre.org
https://lists.amavis.org/pipermail/amavis-users/2024-March/006811.html | source : cve@mitre.org
https://metacpan.org/pod/MIME::Tools | source : cve@mitre.org
https://www.amavis.org/release-notes.txt | source : cve@mitre.org

Vulnerability ID : CVE-2024-25654

First published on : 18-03-2024 20:15:08
Last modified on : 18-03-2024 20:15:08

Description :
Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database.

CVE ID : CVE-2024-25654
Source : cve@mitre.org
CVSS Score : /

References :
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25654 | source : cve@mitre.org

Vulnerability ID : CVE-2024-25655

First published on : 18-03-2024 20:15:08
Last modified on : 18-03-2024 20:15:08

Description :
Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with read access to the application database) to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP.

CVE ID : CVE-2024-25655
Source : cve@mitre.org
CVSS Score : /

References :
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25655 | source : cve@mitre.org

Vulnerability ID : CVE-2024-25656

First published on : 18-03-2024 20:15:08
Last modified on : 18-03-2024 20:15:08

Description :
Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premises Equipment) devices storing arbitrarily large amounts of data during registration. This can potentially lead to DDoS attacks on the application database and, ultimately, affect the entire product.

CVE ID : CVE-2024-25656
Source : cve@mitre.org
CVSS Score : /

References :
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25656 | source : cve@mitre.org

Vulnerability ID : CVE-2024-25657

First published on : 18-03-2024 20:15:09
Last modified on : 18-03-2024 20:15:09

Description :
An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to redirect authenticated users to malicious websites.

CVE ID : CVE-2024-25657
Source : cve@mitre.org
CVSS Score : /

References :
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25657 | source : cve@mitre.org

Source : apache.org

Vulnerability ID : CVE-2024-23944

First published on : 15-03-2024 11:15:08
Last modified on : 15-03-2024 12:53:06

Description :
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.

CVE ID : CVE-2024-23944
Source : security@apache.org
CVSS Score : /

References :
https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k | source : security@apache.org

Vulnerability : CWE-200

Vulnerability ID : CVE-2024-28752

First published on : 15-03-2024 11:15:09
Last modified on : 15-03-2024 12:53:06

Description :
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

CVE ID : CVE-2024-28752
Source : security@apache.org
CVSS Score : /

References :
https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt | source : security@apache.org

Vulnerability : CWE-918

Source : patchstack.com

Vulnerability ID : CVE-2023-51525

First published on : 15-03-2024 14:15:07
Last modified on : 15-03-2024 16:26:49

Description :
Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.

CVE ID : CVE-2023-51525
Source : audit@patchstack.com
CVSS Score : /

References :
https://patchstack.com/database/vulnerability/wp-simple-booking-calendar/wordpress-wp-simple-booking-calendar-plugin-2-0-8-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve | source : audit@patchstack.com

Vulnerability : CWE-352

Source : cert.org

Vulnerability ID : CVE-2023-6960

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion.

CVE ID : CVE-2023-6960
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2023-7003

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware.

CVE ID : CVE-2023-7003
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2023-7004

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.

CVE ID : CVE-2023-7004
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2023-7006

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.

CVE ID : CVE-2023-7006
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2023-7007

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field.

CVE ID : CVE-2023-7007
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2023-7009

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity.

CVE ID : CVE-2023-7009
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2023-7017

First published on : 15-03-2024 17:15:07
Last modified on : 17-03-2024 22:38:29

Description :
Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to compromise the device.

CVE ID : CVE-2023-7017
Source : cret@cert.org
CVSS Score : /

References :
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/ | source : cret@cert.org

Vulnerability ID : CVE-2024-2193

First published on : 15-03-2024 18:15:08
Last modified on : 17-03-2024 22:38:29

Description :
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.

CVE ID : CVE-2024-2193
Source : cret@cert.org
CVSS Score : /

References :
https://download.vusec.net/papers/ghostrace_sec24.pdf | source : cret@cert.org
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=944d5fe50f3f03daacfea16300e656a1691c4a23 | source : cret@cert.org
https://ibm.github.io/system-security-research-updates/2024/03/12/ghostrace | source : cret@cert.org
https://kb.cert.org/vuls/id/488902 | source : cret@cert.org
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7016.html | source : cret@cert.org
https://www.kb.cert.org/vuls/id/488902 | source : cret@cert.org
https://www.vusec.net/projects/ghostrace/ | source : cret@cert.org
https://xenbits.xen.org/xsa/advisory-453.html | source : cret@cert.org

Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47109

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: neighbour: allow NUD_NOARP entries to be forced GCed IFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to fill up the neighbour table with enough entries that it will overflow for valid connections after that. This behaviour is more prevalent after commit 58956317c8de ("neighbor: Improve garbage collection") is applied, as it prevents removal from entries that are not NUD_FAILED, unless they are more than 5s old.

CVE ID : CVE-2021-47109
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/7a6b1ab7475fd6478eeaf5c9d1163e7a18125c8f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d17d47da59f726dc4c87caebda3a50333d7e2fd3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d99029e6aab62aef0a0251588b2867e77e83b137 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ddf088d7aaaaacfc836104f2e632b29b1d383cfc | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47110

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate. Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource.

CVE ID : CVE-2021-47110
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1df2dc09926f61319116c80ee85701df33577d70 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3b0becf8b1ecf642a9edaf4c9628ffc641e490d6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9084fe1b3572664ad276f427dce575f580c9799a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c02027b5742b5aa804ef08a4a9db433295533046 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47111

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: xen-netback: take a reference to the RX task thread Do this in order to prevent the task from being freed if the thread returns (which can be triggered by the frontend) before the call to kthread_stop done as part of the backend tear down. Not taking the reference will lead to a use-after-free in that scenario. Such reference was taken before but dropped as part of the rework done in 2ac061ce97f4. Reintroduce the reference taking and add a comment this time explaining why it's needed. This is XSA-374 / CVE-2021-28691.

CVE ID : CVE-2021-47111
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/107866a8eb0b664675a260f1ba0655010fac1e08 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6b53db8c4c14b4e7256f058d202908b54a7b85b4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/caec9bcaeb1a5f03f2d406305355c853af10c13e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47112

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Teardown PV features on boot CPU as well Various PV features (Async PF, PV EOI, steal time) work through memory shared with hypervisor and when we restore from hibernation we must properly teardown all these features to make sure hypervisor doesn't write to stale locations after we jump to the previously hibernated kernel (which can try to place anything there). For secondary CPUs the job is already done by kvm_cpu_down_prepare(), register syscore ops to do the same for boot CPU.

CVE ID : CVE-2021-47112
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/38b858da1c58ad46519a257764e059e663b59ff2 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7620a669111b52f224d006dea9e1e688e2d62c54 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8b79feffeca28c5459458fe78676b081e87c93a4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d1629b5b925de9b27979e929dae7fcb766daf6b6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47113

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort in rename_exchange if we fail to insert the second ref Error injection stress uncovered a problem where we'd leave a dangling inode ref if we failed during a rename_exchange. This happens because we insert the inode ref for one side of the rename, and then for the other side. If this second inode ref insert fails we'll leave the first one dangling and leave a corrupt file system behind. Fix this by aborting if we did the insert for the first inode ref.

CVE ID : CVE-2021-47113
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/0df50d47d17401f9f140dfbe752a65e5d72f9932 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc09ef3562726cd520c8338c1640872a60187af5 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ff8de2cec65a8c8521faade12a31b39c80e49f5b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47114

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption by fallocate When fallocate punches holes out of inode size, if original isize is in the middle of last cluster, then the part from isize to the end of the cluster will be zeroed with buffer write, at that time isize is not yet updated to match the new size, if writeback is kicked in, it will invoke ocfs2_writepage()->block_write_full_page() where the pages out of inode size will be dropped. That will cause file corruption. Fix this by zero out eof blocks when extending the inode size. Running the following command with qemu-image 4.2.1 can get a corrupted coverted image file easily. qemu-img convert -p -t none -T none -f qcow2 $qcow_image \ -O qcow2 -o compat=1.1 $qcow_image.conv The usage of fallocate in qemu is like this, it first punches holes out of inode size, then extend the inode size. fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0 fallocate(11, 0, 2276196352, 65536) = 0 v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html v2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/

CVE ID : CVE-2021-47114
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2021-47115

First published on : 15-03-2024 21:15:06
Last modified on : 18-03-2024 11:15:07

Description :
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE ID : CVE-2021-47115
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :

Vulnerability ID : CVE-2021-47116

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_mb_init_backend on error path. Fix a memory leak discovered by syzbot when a file system is corrupted with an illegally large s_log_groups_per_flex.

CVE ID : CVE-2021-47116
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/04fb2baa0b147f51db065a1b13a11954abe592d0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2050c6e5b161e5e25ce3c420fef58b24fa388a49 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a8867f4e3809050571c98de7a2d465aff5e4daf5 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47117

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed We got follow bug_on when run fsstress with injecting IO fault: [130747.323114] kernel BUG at fs/ext4/extents_status.c:762! [130747.323117] Internal error: Oops - BUG: 0 [#1] SMP ...... [130747.334329] Call trace: [130747.334553] ext4_es_cache_extent+0x150/0x168 [ext4] [130747.334975] ext4_cache_extents+0x64/0xe8 [ext4] [130747.335368] ext4_find_extent+0x300/0x330 [ext4] [130747.335759] ext4_ext_map_blocks+0x74/0x1178 [ext4] [130747.336179] ext4_map_blocks+0x2f4/0x5f0 [ext4] [130747.336567] ext4_mpage_readpages+0x4a8/0x7a8 [ext4] [130747.336995] ext4_readpage+0x54/0x100 [ext4] [130747.337359] generic_file_buffered_read+0x410/0xae8 [130747.337767] generic_file_read_iter+0x114/0x190 [130747.338152] ext4_file_read_iter+0x5c/0x140 [ext4] [130747.338556] __vfs_read+0x11c/0x188 [130747.338851] vfs_read+0x94/0x150 [130747.339110] ksys_read+0x74/0xf0 This patch's modification is according to Jan Kara's suggestion in: https://patchwork.ozlabs.org/project/linux-ext4/patch/20210428085158.3728201-1-yebin10@huawei.com/ "I see. Now I understand your patch. Honestly, seeing how fragile is trying to fix extent tree after split has failed in the middle, I would probably go even further and make sure we fix the tree properly in case of ENOSPC and EDQUOT (those are easily user triggerable). Anything else indicates a HW problem or fs corruption so I'd rather leave the extent tree as is and don't try to fix it (which also means we will not create overlapping extents)."

CVE ID : CVE-2021-47117
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2021-47118

First published on : 15-03-2024 21:15:06
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to struct pid in commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the pre-KASAN stone age of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`. Full KASAN splat below. ================================================================== BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline] task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950 exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8 kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882 [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180 copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500 kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687 arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270: slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401 proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510 fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585 ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff ---truncated---

CVE ID : CVE-2021-47118
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2021-47119

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_fill_super Buffer head references must be released before calling kill_bdev(); otherwise the buffer head (and its page referenced by b_data) will not be freed by kill_bdev, and subsequently that bh will be leaked. If blocksizes differ, sb_set_blocksize() will kill current buffers and page cache by using kill_bdev(). And then super block will be reread again but using correct blocksize this time. sb_set_blocksize() didn't fully free superblock page and buffer head, and being busy, they were not freed and instead leaked. This can easily be reproduced by calling an infinite loop of: systemctl start <ext4_on_lvm>.mount, and systemctl stop <ext4_on_lvm>.mount ... since systemd creates a cgroup for each slice which it mounts, and the bh leak get amplified by a dying memory cgroup that also never gets freed, and memory consumption is much more easily noticed.

CVE ID : CVE-2021-47119
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/01d349a481f0591230300a9171330136f9159bcd | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1385b23396d511d5233b8b921ac3058b3f86a5e1 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/afd09b617db3786b6ef3dc43e28fe728cfea84df | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47120

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 ("HID: magicmouse: add support for Apple Magic Trackpad 2") added a sanity check for an Apple trackpad but returned success instead of -ENODEV when the check failed. This means that the remove callback will dereference the never-initialised driver data pointer when the driver is later unbound (e.g. on USB disconnect).

CVE ID : CVE-2021-47120
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/368c5d45a87e1bcc7f1e98e0c255c37b7b12c5d6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4b4f6cecca446abcb686c6e6c451d4f1ec1a7497 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9cf27473f21913a3eaf4702dd2a25415afd5f33f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b5d013c4c76b276890135b5d32803c4c63924b77 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47121

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in cfusbl_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error.

CVE ID : CVE-2021-47121
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2021-47122

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in caif_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error

CVE ID : CVE-2021-47122
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2021-47123

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix ltout double free on completion race Always remove linked timeout on io_link_timeout_fn() from the master request link list, otherwise we may get use-after-free when first io_link_timeout_fn() puts linked timeout in the fail path, and then will be found and put on master's free.

CVE ID : CVE-2021-47123
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1f64f5e903b9d1d157875721e02adadc9d6f0a5d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/447c19f3b5074409c794b350b10306e1da1ef4ba | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47124

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix link timeout refs WARNING: CPU: 0 PID: 10242 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] io_put_req fs/io_uring.c:2140 [inline] io_queue_linked_timeout fs/io_uring.c:6300 [inline] __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354 io_submit_sqe fs/io_uring.c:6534 [inline] io_submit_sqes+0x2bbd/0x7c50 fs/io_uring.c:6660 __do_sys_io_uring_enter fs/io_uring.c:9240 [inline] __se_sys_io_uring_enter+0x256/0x1d60 fs/io_uring.c:9182 io_link_timeout_fn() should put only one reference of the linked timeout request, however in case of racing with the master request's completion first io_req_complete() puts one and then io_put_req_deferred() is called.

CVE ID : CVE-2021-47124
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/0b2a990e5d2f76d020cb840c456e6ec5f0c27530 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6f5d7a45f58d3abe3a936de1441b8d6318f978ff | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/876808dba2ff7509bdd7f230c4f374a0caf4f410 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ff4a96ba5c8f9b266706280ff8021d2ef3f17e86 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47125

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: sch_htb: fix refcount leak in htb_parent_to_leaf_offload The commit ae81feb7338c ("sch_htb: fix null pointer dereference on a null new_q") fixes a NULL pointer dereference bug, but it is not correct. Because htb_graft_helper properly handles the case when new_q is NULL, and after the previous patch by skipping this call which creates an inconsistency : dev_queue->qdisc will still point to the old qdisc, but cl->parent->leaf.q will point to the new one (which will be noop_qdisc, because new_q was NULL). The code is based on an assumption that these two pointers are the same, so it can lead to refcount leaks. The correct fix is to add a NULL pointer check to protect qdisc_refcount_inc inside htb_parent_to_leaf_offload.

CVE ID : CVE-2021-47125
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47126

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions Reported by syzbot: HEAD commit: 90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master dashboard link: https://syzkaller.appspot.com/bug?extid=123aa35098fd3c000eb7 compiler: Debian clang version 11.0.1-2 ================================================================== BUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline] BUG: KASAN: slab-out-of-bounds in fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732 Read of size 8 at addr ffff8880145c78f8 by task syz-executor.4/17760 CPU: 0 PID: 17760 Comm: syz-executor.4 Not tainted 5.12.0-rc8-syzkaller #0 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x202/0x31e lib/dump_stack.c:120 print_address_description+0x5f/0x3b0 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x15c/0x200 mm/kasan/report.c:416 fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline] fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732 fib6_nh_release+0x9a/0x430 net/ipv6/route.c:3536 fib6_info_destroy_rcu+0xcb/0x1c0 net/ipv6/ip6_fib.c:174 rcu_do_batch kernel/rcu/tree.c:2559 [inline] rcu_core+0x8f6/0x1450 kernel/rcu/tree.c:2794 __do_softirq+0x372/0x7a6 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x22c/0x260 kernel/softirq.c:422 irq_exit_rcu+0x5/0x20 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100 </IRQ> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 RIP: 0010:lock_acquire+0x1f6/0x720 kernel/locking/lockdep.c:5515 Code: f6 84 24 a1 00 00 00 02 0f 85 8d 02 00 00 f7 c3 00 02 00 00 49 bd 00 00 00 00 00 fc ff df 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 4b c7 44 3d 09 00 00 00 00 43 c7 44 3d RSP: 0018:ffffc90009e06560 EFLAGS: 00000206 RAX: 1ffff920013c0cc0 RBX: 0000000000000246 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90009e066e0 R08: dffffc0000000000 R09: fffffbfff1f992b1 R10: fffffbfff1f992b1 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920013c0cb4 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:267 rcu_read_lock include/linux/rcupdate.h:656 [inline] ext4_get_group_info+0xea/0x340 fs/ext4/ext4.h:3231 ext4_mb_prefetch+0x123/0x5d0 fs/ext4/mballoc.c:2212 ext4_mb_regular_allocator+0x8a5/0x28f0 fs/ext4/mballoc.c:2379 ext4_mb_new_blocks+0xc6e/0x24f0 fs/ext4/mballoc.c:4982 ext4_ext_map_blocks+0x2be3/0x7210 fs/ext4/extents.c:4238 ext4_map_blocks+0xab3/0x1cb0 fs/ext4/inode.c:638 ext4_getblk+0x187/0x6c0 fs/ext4/inode.c:848 ext4_bread+0x2a/0x1c0 fs/ext4/inode.c:900 ext4_append+0x1a4/0x360 fs/ext4/namei.c:67 ext4_init_new_dir+0x337/0xa10 fs/ext4/namei.c:2768 ext4_mkdir+0x4b8/0xc00 fs/ext4/namei.c:2814 vfs_mkdir+0x45b/0x640 fs/namei.c:3819 ovl_do_mkdir fs/overlayfs/overlayfs.h:161 [inline] ovl_mkdir_real+0x53/0x1a0 fs/overlayfs/dir.c:146 ovl_create_real+0x280/0x490 fs/overlayfs/dir.c:193 ovl_workdir_create+0x425/0x600 fs/overlayfs/super.c:788 ovl_make_workdir+0xed/0x1140 fs/overlayfs/super.c:1355 ovl_get_workdir fs/overlayfs/super.c:1492 [inline] ovl_fill_super+0x39ee/0x5370 fs/overlayfs/super.c:2035 mount_nodev+0x52/0xe0 fs/super.c:1413 legacy_get_tree+0xea/0x180 fs/fs_context.c:592 vfs_get_tree+0x86/0x270 fs/super.c:1497 do_new_mount fs/namespace.c:2903 [inline] path_mount+0x196f/0x2be0 fs/namespace.c:3233 do_mount fs/namespace.c:3246 [inline] __do_sys_mount fs/namespace.c:3454 [inline] __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3431 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 ---truncated---

CVE ID : CVE-2021-47126
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/09870235827451409ff546b073d754a19fd17e2e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0a462e25ef0f7ab305081a08d435bbd1f13c0a94 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7ba7fa78a92dc410b6f93ed73075ab669c3a0b59 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/821bbf79fe46a8b1d18aa456e8ed0a3c208c3754 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47127

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: ice: track AF_XDP ZC enabled queues in bitmap Commit c7a219048e45 ("ice: Remove xsk_buff_pool from VSI structure") silently introduced a regression and broke the Tx side of AF_XDP in copy mode. xsk_pool on ice_ring is set only based on the existence of the XDP prog on the VSI which in turn picks ice_clean_tx_irq_zc to be executed. That is not something that should happen for copy mode as it should use the regular data path ice_clean_tx_irq. This results in a following splat when xdpsock is run in txonly or l2fwd scenarios in copy mode: <snip> [ 106.050195] BUG: kernel NULL pointer dereference, address: 0000000000000030 [ 106.057269] #PF: supervisor read access in kernel mode [ 106.062493] #PF: error_code(0x0000) - not-present page [ 106.067709] PGD 0 P4D 0 [ 106.070293] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 106.074721] CPU: 61 PID: 0 Comm: swapper/61 Not tainted 5.12.0-rc2+ #45 [ 106.081436] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 106.092027] RIP: 0010:xp_raw_get_dma+0x36/0x50 [ 106.096551] Code: 74 14 48 b8 ff ff ff ff ff ff 00 00 48 21 f0 48 c1 ee 30 48 01 c6 48 8b 87 90 00 00 00 48 89 f2 81 e6 ff 0f 00 00 48 c1 ea 0c <48> 8b 04 d0 48 83 e0 fe 48 01 f0 c3 66 66 2e 0f 1f 84 00 00 00 00 [ 106.115588] RSP: 0018:ffffc9000d694e50 EFLAGS: 00010206 [ 106.120893] RAX: 0000000000000000 RBX: ffff88984b8c8a00 RCX: ffff889852581800 [ 106.128137] RDX: 0000000000000006 RSI: 0000000000000000 RDI: ffff88984cd8b800 [ 106.135383] RBP: ffff888123b50001 R08: ffff889896800000 R09: 0000000000000800 [ 106.142628] R10: 0000000000000000 R11: ffffffff826060c0 R12: 00000000000000ff [ 106.149872] R13: 0000000000000000 R14: 0000000000000040 R15: ffff888123b50018 [ 106.157117] FS: 0000000000000000(0000) GS:ffff8897e0f40000(0000) knlGS:0000000000000000 [ 106.165332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.171163] CR2: 0000000000000030 CR3: 000000000560a004 CR4: 00000000007706e0 [ 106.178408] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 106.185653] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 106.192898] PKRU: 55555554 [ 106.195653] Call Trace: [ 106.198143] <IRQ> [ 106.200196] ice_clean_tx_irq_zc+0x183/0x2a0 [ice] [ 106.205087] ice_napi_poll+0x3e/0x590 [ice] [ 106.209356] __napi_poll+0x2a/0x160 [ 106.212911] net_rx_action+0xd6/0x200 [ 106.216634] __do_softirq+0xbf/0x29b [ 106.220274] irq_exit_rcu+0x88/0xc0 [ 106.223819] common_interrupt+0x7b/0xa0 [ 106.227719] </IRQ> [ 106.229857] asm_common_interrupt+0x1e/0x40 </snip> Fix this by introducing the bitmap of queues that are zero-copy enabled, where each bit, corresponding to a queue id that xsk pool is being configured on, will be set/cleared within ice_xsk_pool_{en,dis}able and checked within ice_xsk_pool(). The latter is a function used for deciding which napi poll routine is executed. Idea is being taken from our other drivers such as i40e and ixgbe.

CVE ID : CVE-2021-47127
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1d34fa4fcf06649036ba0c97854fcf7a741ee18c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e102db780e1c14f10c70dafa7684af22a745b51d | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47128

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks Commit 59438b46471a ("security,lockdown,selinux: implement SELinux lockdown") added an implementation of the locked_down LSM hook to SELinux, with the aim to restrict which domains are allowed to perform operations that would breach lockdown. This is indirectly also getting audit subsystem involved to report events. The latter is problematic, as reported by Ondrej and Serhei, since it can bring down the whole system via audit: 1) The audit events that are triggered due to calls to security_locked_down() can OOM kill a machine, see below details [0]. 2) It also seems to be causing a deadlock via avc_has_perm()/slow_avc_audit() when trying to wake up kauditd, for example, when using trace_sched_switch() tracepoint, see details in [1]. Triggering this was not via some hypothetical corner case, but with existing tools like runqlat & runqslower from bcc, for example, which make use of this tracepoint. Rough call sequence goes like: rq_lock(rq) -> -------------------------+ trace_sched_switch() -> | bpf_prog_xyz() -> +-> deadlock selinux_lockdown() -> | audit_log_end() -> | wake_up_interruptible() -> | try_to_wake_up() -> | rq_lock(rq) --------------+ What's worse is that the intention of 59438b46471a to further restrict lockdown settings for specific applications in respect to the global lockdown policy is completely broken for BPF. The SELinux policy rule for the current lockdown check looks something like this: allow <who> <who> : lockdown { <reason> }; However, this doesn't match with the 'current' task where the security_locked_down() is executed, example: httpd does a syscall. There is a tracing program attached to the syscall which triggers a BPF program to run, which ends up doing a bpf_probe_read_kernel{,_str}() helper call. The selinux_lockdown() hook does the permission check against 'current', that is, httpd in this example. httpd has literally zero relation to this tracing program, and it would be nonsensical having to write an SELinux policy rule against httpd to let the tracing helper pass. The policy in this case needs to be against the entity that is installing the BPF program. For example, if bpftrace would generate a histogram of syscall counts by user space application: bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }' bpftrace would then go and generate a BPF program from this internally. One way of doing it [for the sake of the example] could be to call bpf_get_current_task() helper and then access current->comm via one of bpf_probe_read_kernel{,_str}() helpers. So the program itself has nothing to do with httpd or any other random app doing a syscall here. The BPF program _explicitly initiated_ the lockdown check. The allow/deny policy belongs in the context of bpftrace: meaning, you want to grant bpftrace access to use these helpers, but other tracers on the system like my_random_tracer _not_. Therefore fix all three issues at the same time by taking a completely different approach for the security_locked_down() hook, that is, move the check into the program verification phase where we actually retrieve the BPF func proto. This also reliably gets the task (current) that is trying to install the BPF tracing program, e.g. bpftrace/bcc/perf/systemtap/etc, and it also fixes the OOM since we're moving this out of the BPF helper's fast-path which can be called several millions of times per second. The check is then also in line with other security_locked_down() hooks in the system where the enforcement is performed at open/load time, for example, open_kcore() for /proc/kcore access or module_sig_check() for module signatures just to pick f ---truncated---

CVE ID : CVE-2021-47128
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/acc43fc6cf0d50612193813c5906a1ab9d433e1e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ff40e51043af63715ab413995ff46996ecf9583f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ff5039ec75c83d2ed5b781dc7733420ee8c985fc | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47129

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: skip expectations for confirmed conntrack nft_ct_expect_obj_eval() calls nf_ct_ext_add() for a confirmed conntrack entry. However, nf_ct_ext_add() can only be called for !nf_ct_is_confirmed(). [ 1825.349056] WARNING: CPU: 0 PID: 1279 at net/netfilter/nf_conntrack_extend.c:48 nf_ct_xt_add+0x18e/0x1a0 [nf_conntrack] [ 1825.351391] RIP: 0010:nf_ct_ext_add+0x18e/0x1a0 [nf_conntrack] [ 1825.351493] Code: 41 5c 41 5d 41 5e 41 5f c3 41 bc 0a 00 00 00 e9 15 ff ff ff ba 09 00 00 00 31 f6 4c 89 ff e8 69 6c 3d e9 eb 96 45 31 ed eb cd <0f> 0b e9 b1 fe ff ff e8 86 79 14 e9 eb bf 0f 1f 40 00 0f 1f 44 00 [ 1825.351721] RSP: 0018:ffffc90002e1f1e8 EFLAGS: 00010202 [ 1825.351790] RAX: 000000000000000e RBX: ffff88814f5783c0 RCX: ffffffffc0e4f887 [ 1825.351881] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88814f578440 [ 1825.351971] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88814f578447 [ 1825.352060] R10: ffffed1029eaf088 R11: 0000000000000001 R12: ffff88814f578440 [ 1825.352150] R13: ffff8882053f3a00 R14: 0000000000000000 R15: 0000000000000a20 [ 1825.352240] FS: 00007f992261c900(0000) GS:ffff889faec00000(0000) knlGS:0000000000000000 [ 1825.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1825.352417] CR2: 000056070a4d1158 CR3: 000000015efe0000 CR4: 0000000000350ee0 [ 1825.352508] Call Trace: [ 1825.352544] nf_ct_helper_ext_add+0x10/0x60 [nf_conntrack] [ 1825.352641] nft_ct_expect_obj_eval+0x1b8/0x1e0 [nft_ct] [ 1825.352716] nft_do_chain+0x232/0x850 [nf_tables] Add the ct helper extension only for unconfirmed conntrack. Skip rule evaluation if the ct helper extension does not exist. Thus, you can only create expectations from the first packet. It should be possible to remove this limitation by adding a new action to attach a generic ct helper to the first packet. Then, use this ct helper extension from follow up packets to create the ct expectation. While at it, add a missing check to skip the template conntrack too and remove check for IPCT_UNTRACK which is implicit to !ct.

CVE ID : CVE-2021-47129
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1710eb913bdcda3917f44d383c32de6bdabfc836 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2c0e6b35b88a961127066a1028bce9c727cbc3e5 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5f3429c05e4028a0e241afdad856dd15dec2ffb9 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/da8d31e80ff425f5a65dab7060d5c4aba749e562 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47130

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix freeing unallocated p2pmem In case p2p device was found but the p2p pool is empty, the nvme target is still trying to free the sgl from the p2p pool instead of the regular sgl pool and causing a crash (BUG() is called). Instead, assign the p2p_dev for the request only if it was allocated from p2p pool. This is the crash that was caused: [Sun May 30 19:13:53 2021] ------------[ cut here ]------------ [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! [Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI ... [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! ... [Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [Sun May 30 19:13:53 2021] Call Trace: [Sun May 30 19:13:53 2021] ------------[ cut here ]------------ [Sun May 30 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [Sun May 30 19:13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [Sun May 30 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518! [Sun May 30 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [Sun May 30 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]

CVE ID : CVE-2021-47130
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bcd9a0797d73eeff659582f23277e7ab6e5f18f3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47131

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tls_device_down is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it still points to the TLS context, which is now deallocated. If a netdev goes up, while the connection is still active, and the data flow resumes after a number of TCP retransmissions, it will lead to a use-after-free of the TLS context. This commit addresses this bug by keeping the context alive until its normal destruction, and implements the necessary fallbacks, so that the connection can resume in software (non-offloaded) kTLS mode. On the TX side tls_sw_fallback is used to encrypt all packets. The RX side already has all the necessary fallbacks, because receiving non-decrypted packets is supported. The thing needed on the RX side is to block resync requests, which are normally produced after receiving non-decrypted packets. The necessary synchronization is implemented for a graceful teardown: first the fallbacks are deployed, then the driver resources are released (it used to be possible to have a tls_dev_resync after tls_dev_del). A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback mode. It's used to skip the RX resync logic completely, as it becomes useless, and some objects may be released (for example, resync_async, which is allocated and freed by the driver).

CVE ID : CVE-2021-47131
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/0f1e6fe66977a864fe850522316f713d7b926fd9 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f1d4184f128dede82a59a841658ed40d4e6d3aa2 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47132

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sk_forward_memory corruption on retransmission MPTCP sk_forward_memory handling is a bit special, as such field is protected by the msk socket spin_lock, instead of the plain socket lock. Currently we have a code path updating such field without handling the relevant lock: __mptcp_retrans() -> __mptcp_clean_una_wakeup() Several helpers in __mptcp_clean_una_wakeup() will update sk_forward_alloc, possibly causing such field corruption, as reported by Matthieu. Address the issue providing and using a new variant of blamed function which explicitly acquires the msk spin lock.

CVE ID : CVE-2021-47132
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/b5941f066b4ca331db225a976dae1d6ca8cf0ae3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b9c78b1a95966a7bd2ddae05b73eafc0cda4fba3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47133

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Fix memory leak in amd_sfh_work Kmemleak tool detected a memory leak in the amd_sfh driver. ==================== unreferenced object 0xffff88810228ada0 (size 32): comm "insmod", pid 3968, jiffies 4295056001 (age 775.792s) hex dump (first 32 bytes): 00 20 73 1f 81 88 ff ff 00 01 00 00 00 00 ad de . s............. 22 01 00 00 00 00 ad de 01 00 02 00 00 00 00 00 "............... backtrace: [<000000007b4c8799>] kmem_cache_alloc_trace+0x163/0x4f0 [<0000000005326893>] amd_sfh_get_report+0xa4/0x1d0 [amd_sfh] [<000000002a9e5ec4>] amdtp_hid_request+0x62/0x80 [amd_sfh] [<00000000b8a95807>] sensor_hub_get_feature+0x145/0x270 [hid_sensor_hub] [<00000000fda054ee>] hid_sensor_parse_common_attributes+0x215/0x460 [hid_sensor_iio_common] [<0000000021279ecf>] hid_accel_3d_probe+0xff/0x4a0 [hid_sensor_accel_3d] [<00000000915760ce>] platform_probe+0x6a/0xd0 [<0000000060258a1f>] really_probe+0x192/0x620 [<00000000fa812f2d>] driver_probe_device+0x14a/0x1d0 [<000000005e79f7fd>] __device_attach_driver+0xbd/0x110 [<0000000070d15018>] bus_for_each_drv+0xfd/0x160 [<0000000013a3c312>] __device_attach+0x18b/0x220 [<000000008c7b4afc>] device_initial_probe+0x13/0x20 [<00000000e6e99665>] bus_probe_device+0xfe/0x120 [<00000000833fa90b>] device_add+0x6a6/0xe00 [<00000000fa901078>] platform_device_add+0x180/0x380 ==================== The fix is to freeing request_list entry once the processed entry is removed from the request_list.

CVE ID : CVE-2021-47133
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/29beadea66a226d744d5ffdcde6b984623053d24 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5ad755fd2b326aa2bc8910b0eb351ee6aece21b1 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47134

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: efi/fdt: fix panic when no valid fdt found setup_arch() would invoke efi_init()->efi_get_fdt_params(). If no valid fdt found then initial_boot_params will be null. So we should stop further fdt processing here. I encountered this issue on risc-v.

CVE ID : CVE-2021-47134
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/5148066edbdc89c6fe5bc419c31a5c22e5f83bdb | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/668a84c1bfb2b3fd5a10847825a854d63fac7baa | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8a7e8b4e5631a03ea2fee27957857a56612108ca | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2021-47135

First published on : 15-03-2024 21:15:07
Last modified on : 17-03-2024 22:38:29

Description :
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report Fix possible array out of bound access in mt7921_mcu_tx_rate_report. Remove unnecessary varibable in mt7921_mcu_tx_rate_report

CVE ID : CVE-2021-47135
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/6919e8a24e70b6ba148fe07f44f835bcdd1a8d02 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d874e6c06952382897d35bf4094193cd44ae91bd | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52609

First published on : 18-03-2024 11:15:07
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: binder: fix race between mmput() and do_exit() Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A.

CVE ID : CVE-2023-52609
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2023-52610

First published on : 18-03-2024 11:15:07
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare skb_morph which is not straightforward. However when frags arrive out of order, nobody unref the last frag, and all frags are leaked. The situation is even worse, as initiating packet capture can lead to a crash[0] when skb has been cloned and shared at the same time. Fix the issue by removing skb_get() before defragmentation. act_ct returns TC_ACT_CONSUMED when defrag failed or in progress. [0]: [ 843.804823] ------------[ cut here ]------------ [ 843.809659] kernel BUG at net/core/skbuff.c:2091! [ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP [ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 [ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 [ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 [ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 [ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 [ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 [ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 [ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 [ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 [ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 [ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 [ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 [ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 843.894229] PKRU: 55555554 [ 843.898539] Call Trace: [ 843.902772] <IRQ> [ 843.906922] ? __die_body+0x1e/0x60 [ 843.911032] ? die+0x3c/0x60 [ 843.915037] ? do_trap+0xe2/0x110 [ 843.918911] ? pskb_expand_head+0x2ac/0x300 [ 843.922687] ? do_error_trap+0x65/0x80 [ 843.926342] ? pskb_expand_head+0x2ac/0x300 [ 843.929905] ? exc_invalid_op+0x50/0x60 [ 843.933398] ? pskb_expand_head+0x2ac/0x300 [ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 [ 843.940226] ? pskb_expand_head+0x2ac/0x300 [ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 [ 843.946904] ip_defrag+0x5d4/0x870 [ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] [ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] [ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] [ 843.959657] tcf_action_exec+0xa1/0x160 [ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] [ 843.966010] ? skb_clone+0x53/0xc0 [ 843.969173] tcf_classify+0x24d/0x420 [ 843.972333] tc_run+0x8f/0xf0 [ 843.975465] __netif_receive_skb_core+0x67a/0x1080 [ 843.978634] ? dev_gro_receive+0x249/0x730 [ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 [ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 [ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] [ 843.991170] napi_complete_done+0x72/0x1a0 [ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] [ 843.997501] __napi_poll+0x25/0x1b0 [ 844.000627] net_rx_action+0x256/0x330 [ 844.003705] __do_softirq+0xb3/0x29b [ 844.006718] irq_exit_rcu+0x9e/0xc0 [ 844.009672] common_interrupt+0x86/0xa0 [ 844.012537] </IRQ> [ 844.015285] <TASK> [ 844.017937] asm_common_interrupt+0x26/0x40 [ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 [ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb ---truncated---

CVE ID : CVE-2023-52610
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/0b5b831122fc3789fff75be433ba3e4dd7b779d4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/172ba7d46c202e679f3ccb10264c67416aaeb1c4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3f14b377d01d8357eba032b4cabc8c1149b458b6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/73f7da5fd124f2cda9161e2e46114915e6e82e97 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f5346df0591d10bc948761ca854b1fae6d2ef441 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52611

First published on : 18-03-2024 11:15:08
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: sdio: Honor the host max_req_size in the RX path Lukas reports skb_over_panic errors on his Banana Pi BPI-CM4 which comes with an Amlogic A311D (G12B) SoC and a RTL8822CS SDIO wifi/Bluetooth combo card. The error he observed is identical to what has been fixed in commit e967229ead0e ("wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr()") but that commit didn't fix Lukas' problem. Lukas found that disabling or limiting RX aggregation works around the problem for some time (but does not fully fix it). In the following discussion a few key topics have been discussed which have an impact on this problem: - The Amlogic A311D (G12B) SoC has a hardware bug in the SDIO controller which prevents DMA transfers. Instead all transfers need to go through the controller SRAM which limits transfers to 1536 bytes - rtw88 chips don't split incoming (RX) packets, so if a big packet is received this is forwarded to the host in it's original form - rtw88 chips can do RX aggregation, meaning more multiple incoming packets can be pulled by the host from the card with one MMC/SDIO transfer. This Depends on settings in the REG_RXDMA_AGG_PG_TH register (BIT_RXDMA_AGG_PG_TH limits the number of packets that will be aggregated, BIT_DMA_AGG_TO_V1 configures a timeout for aggregation and BIT_EN_PRE_CALC makes the chip honor the limits more effectively) Use multiple consecutive reads in rtw_sdio_read_port() and limit the number of bytes which are copied by the host from the card in one MMC/SDIO transfer. This allows receiving a buffer that's larger than the hosts max_req_size (number of bytes which can be transferred in one MMC/SDIO transfer). As a result of this the skb_over_panic error is gone as the rtw88 driver is now able to receive more than 1536 bytes from the card (either because the incoming packet is larger than that or because multiple packets have been aggregated). In case of an receive errors (-EILSEQ has been observed by Lukas) we need to drain the remaining data from the card's buffer, otherwise the card will return corrupt data for the next rtw_sdio_read_port() call.

CVE ID : CVE-2023-52611
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/00384f565a91c08c4bedae167f749b093d10e3fe | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0e9ffff72a0674cd6656314dbd99cdd2123a3030 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5b5ddf21b978ec315cab9d9e7e6ac7374791a8c7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52612

First published on : 18-03-2024 11:15:08
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.

CVE ID : CVE-2023-52612
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2023-52613

First published on : 18-03-2024 11:15:08
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need -ENODEV as the right value for comparison. Otherwise, tz->type is NULL when thermal-zones is undefined, resulting in the following error: [ 12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8 [ 12.302877] Oops[#1]: [ 12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385 [ 12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10 [ 12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001 [ 12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c [ 12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901 [ 12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790 [ 12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40 [ 12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000 [ 12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8 [ 12.362938] ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300 [ 12.386411] ERA: 900000000355f410 strscpy+0xf0/0x160 [ 12.391626] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 12.397898] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 12.403678] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 12.409859] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 12.415907] BADV: fffffffffffffff1 [ 12.415911] PRID: 0014a000 (Loongson-64bit, Loongson-2K1000) [ 12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc [ 12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3) [ 12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358 [ 12.415982] ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410 [ 12.415999] ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0 [ 12.416016] 9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed [ 12.416032] 0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000 [ 12.416048] 90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410 [ 12.416065] 0000000000000000 9000000002df6808 90000001002a3410 0000000000000000 [ 12.416081] ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8 [ 12.416097] 00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002 [ 12.416114] ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30 [ 12.416131] ... [ 12.416138] Call Trace: [ 12.416142] [<900000000355f410>] strscpy+0xf0/0x160 [ 12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300 [ 12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0 [ 12.416200] [<ffffff80020cc1e8>] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal] [ 12.416232] [<9000000002df6808>] platform_probe+0x68/0x140 [ 12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0 [ 12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180 [ 12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160 [ 12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200 [ 12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120 [ 12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0 [ 12.416346] [<9000000002df46b4>] driver_register+0x74/0x160 [ 12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220 [ 12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0 [ ---truncated---

CVE ID : CVE-2023-52613
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/15ef92e9c41124ee9d88b01208364f3fe1f45f84 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6010a9fc14eb1feab5cafd84422001134fe8ec58 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/70481755ed77400e783200e2d022e5fea16060ce | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52614

First published on : 18-03-2024 11:15:08
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show Fix buffer overflow in trans_stat_show(). Convert simple snprintf to the more secure scnprintf with size of PAGE_SIZE. Add condition checking if we are exceeding PAGE_SIZE and exit early from loop. Also add at the end a warning that we exceeded PAGE_SIZE and that stats is disabled. Return -EFBIG in the case where we don't have enough space to write the full transition table. Also document in the ABI that this function can return -EFBIG error.

CVE ID : CVE-2023-52614
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/08e23d05fa6dc4fc13da0ccf09defdd4bbc92ff4 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/796d3fad8c35ee9df9027899fb90ceaeb41b958f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8a7729cda2dd276d7a3994638038fb89035b6f2c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a979f56aa4b93579cf0e4265ae04d7e9300fd3e8 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/eaef4650fa2050147ca25fd7ee43bc0082e03c87 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52615

First published on : 18-03-2024 11:15:08
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user.

CVE ID : CVE-2023-52615
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2023-52616

First published on : 18-03-2024 11:15:08
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately.

CVE ID : CVE-2023-52616
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52617

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or exit, at a point way past switchtec_pci_remove(). Otherwise the last ref would vanish with the trailing put_device(), just before return. At that later point in time, the devm cleanup has already removed the stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause a fatal page fault, and the subsequent dma_free_coherent(), if reached, would pass a stale &stdev->pdev->dev pointer. Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents. Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com

CVE ID : CVE-2023-52617
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/0233b836312e39a3c763fb53512b3fa455b473b3 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1d83c85922647758c1f1e4806a4c5c3cf591a20a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4a5d0528cf19dbf060313dffbe047bc11c90c24c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d8c293549946ee5078ed0ab77793cec365559355 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/df25461119d987b8c81d232cfe4411e91dcabe66 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e129c7fa7070fbce57feb0bfc5eaa65eef44b693 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ff1c7e2fb9e9c3f53715fbe04d3ac47b80be7eb8 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52618

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present).

CVE ID : CVE-2023-52618
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/5b9ea86e662035a886ccb5c76d56793cba618827 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/95bc866c11974d3e4a9d922275ea8127ff809cf7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a2c6206f18104fba7f887bf4dbbfe4c41adc4339 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/af7bbdac89739e2e7380387fda598848d3b7010f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f6abd5e17da33eba15df2bddc93413e76c2b55f7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2023-52619

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of the zone will become: addr of zone0 = BASE addr of zone1 = BASE + zone_size addr of zone2 = BASE + zone_size*2 ... The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va. So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.

CVE ID : CVE-2023-52619
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2024-26631

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work idev->mc_ifc_count can be written over without proper locking. Originally found by syzbot [1], fix this issue by encapsulating calls to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with mutex_lock() and mutex_unlock() accordingly as these functions should only be called with mc_lock per their declarations. [1] BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0: mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline] ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725 addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949 addrconf_notify+0x310/0x980 notifier_call_chain kernel/notifier.c:93 [inline] raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461 __dev_notify_flags+0x205/0x3d0 dev_change_flags+0xab/0xd0 net/core/dev.c:8685 do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916 rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] __rtnl_newlink net/core/rtnetlink.c:3717 [inline] rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754 rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910 ... write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1: mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700 worker_thread+0x525/0x730 kernel/workqueue.c:2781 ...

CVE ID : CVE-2024-26631
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/2e7ef287f07c74985f1bf2858bedc62bd9ebf155 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/380540bb06bb1d1b12bdc947d1b8f56cda6b5663 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3bb5849675ae1d592929798a2b37ea450879c855 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3cc283fd16fba72e2cefe3a6f48d7a36b0438900 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/62b3387beef11738eb6ce667601a28fa089fa02c | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26632

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: block: Fix iterating over an empty bio with bio_for_each_folio_all If the bio contains no data, bio_first_folio() calls page_folio() on a NULL pointer and oopses. Move the test that we've reached the end of the bio from bio_next_folio() to bio_first_folio(). [axboe: add unlikely() to error case]

CVE ID : CVE-2024-26632
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/7bed6f3d08b7af27b7015da8dc3acf2b9c1f21d7 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a6bd8182137a12d22d3f2cee463271bdcb491659 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c6350b5cb78e9024c49eaee6fdb914ad2903a5fe | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ca3ede3f5893e2d26d4dbdef1eec28a8487fafde | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26633

First published on : 18-03-2024 11:15:09
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendms ---truncated---

CVE ID : CVE-2024-26633
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2024-26634

First published on : 18-03-2024 11:15:10
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames Mark reports a BUG() when a net namespace is removed. kernel BUG at net/core/dev.c:11520! Physical interfaces moved outside of init_net get "refunded" to init_net when that namespace disappears. The main interface name may get overwritten in the process if it would have conflicted. We need to also discard all conflicting altnames. Recent fixes addressed ensuring that altnames get moved with the main interface, which surfaced this problem.

CVE ID : CVE-2024-26634
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/8072699aa9e67d1727692cfb3c347263bb627fb9 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a2232f29bf52c24f827865b3c90829c44b6c695b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d09486a04f5da0a812c26217213b89a3b1acf836 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e855dded4b70d1975ee7b9fed0c700391e3c8ea6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26635

First published on : 18-03-2024 11:15:10
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023

CVE ID : CVE-2024-26635
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2024-26636

First published on : 18-03-2024 11:15:10
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more robust against bonding changes syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_alloc_send_skb(). Then it acquires it again, but does not redo all the sanity checks that were performed. This fix: - Uses LL_RESERVED_SPACE() to reserve space. - Check all conditions again after socket lock is held again. - Do not account Ethernet header for mtu limitation. [1] skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 sp : ffff800096f97000 x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic net/core/skbuff.c:189 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 skb_push+0xf0/0x108 net/core/skbuff.c:2451 eth_header+0x44/0x1f8 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3188 [inline] llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x194/0x274 net/socket.c:767 splice_to_socket+0x7cc/0xd58 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 do_splice_direct+0x20c/0x348 fs/splice.c:1194 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)

CVE ID : CVE-2024-26636
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

Vulnerability ID : CVE-2024-26637

First published on : 18-03-2024 11:15:10
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: rely on mac80211 debugfs handling for vif mac80211 started to delete debugfs entries in certain cases, causing a ath11k to crash when it tried to delete the entries later. Fix this by relying on mac80211 to delete the entries when appropriate and adding them from the vif_add_debugfs handler.

CVE ID : CVE-2024-26637
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/556857aa1d0855aba02b1c63bc52b91ec63fc2cc | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aa74ce30a8a40d19a4256de4ae5322e71344a274 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26638

First published on : 18-03-2024 11:15:10
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work

CVE ID : CVE-2024-26638
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1960f2b534da1e6c65fb96f9e98bda773495f406 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/78fbb92af27d0982634116c7a31065f24d092826 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b0028f333420a65a53a63978522db680b37379dd | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d9c54763e5cdbbd3f81868597fe8aca3c96e6387 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26639

First published on : 18-03-2024 11:15:10
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: mm, kmsan: fix infinite recursion due to RCU critical section Alexander Potapenko writes in [1]: "For every memory access in the code instrumented by KMSAN we call kmsan_get_metadata() to obtain the metadata for the memory being accessed. For virtual memory the metadata pointers are stored in the corresponding `struct page`, therefore we need to call virt_to_page() to get them. According to the comment in arch/x86/include/asm/page.h, virt_to_page(kaddr) returns a valid pointer iff virt_addr_valid(kaddr) is true, so KMSAN needs to call virt_addr_valid() as well. To avoid recursion, kmsan_get_metadata() must not call instrumented code, therefore ./arch/x86/include/asm/kmsan.h forks parts of arch/x86/mm/physaddr.c to check whether a virtual address is valid or not. But the introduction of rcu_read_lock() to pfn_valid() added instrumented RCU API calls to virt_to_page_or_null(), which is called by kmsan_get_metadata(), so there is an infinite recursion now. I do not think it is correct to stop that recursion by doing kmsan_enter_runtime()/kmsan_exit_runtime() in kmsan_get_metadata(): that would prevent instrumented functions called from within the runtime from tracking the shadow values, which might introduce false positives." Fix the issue by switching pfn_valid() to the _sched() variant of rcu_read_lock/unlock(), which does not require calling into RCU. Given the critical section in pfn_valid() is very small, this is a reasonable trade-off (with preemptible RCU). KMSAN further needs to be careful to suppress calls into the scheduler, which would be another source of recursion. This can be done by wrapping the call to pfn_valid() into preempt_disable/enable_no_resched(). The downside is that this sacrifices breaking scheduling guarantees; however, a kernel compiled with KMSAN has already given up any performance guarantees due to being heavily instrumented. Note, KMSAN code already disables tracing via Makefile, and since mmzone.h is included, it is not necessary to use the notrace variant, which is generally preferred in all other cases.

CVE ID : CVE-2024-26639
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/5a33420599fa0288792537e6872fd19cc8607ea6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6335c0cdb2ea0ea02c999e04d34fd84f69fb27ff | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc904345e3771aa01d0b8358b550802fdc6fe00b | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26640

First published on : 18-03-2024 11:15:11
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional checks: - Page must not be a compound one. - page->mapping must be NULL. This fixes the panic reported by ZhangPeng. syzbot was able to loopback packets built with sendfile(), mapping pages owned by an ext4 file to TCP rx zerocopy. r3 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10) connect$inet(r4, &(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10) r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181e42, 0x0) fallocate(r5, 0x0, 0x0, 0x85b8) sendfile(r4, r5, 0x0, 0x8ba0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x40) r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181e42, 0x0)

CVE ID : CVE-2024-26640
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/1b8adcc0e2c584fec778add7777fe28e20781e60 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/577e4432f3ac810049cb7e6b71f4d96ec7c6e894 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/718f446e60316bf606946f7f42367d691d21541e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b383d4ea272fe5795877506dcce5aad1f6330e5e | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d15cc0f66884ef2bed28c7ccbb11c102aa3a0760 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f48bf9a83b1666d934247cb58a9887d7b3127b6f | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Vulnerability ID : CVE-2024-26641

First published on : 18-03-2024 11:15:11
Last modified on : 18-03-2024 12:38:25

Description :
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head. [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5532 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646 netif_receive_skb_internal net/core/dev.c:5732 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5791 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2084 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x786/0x1200 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2084 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x786/0x1200 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023

CVE ID : CVE-2024-26641
Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Score : /

References :
https://git.kernel.org/stable/c/350a6640fac4b53564ec20aa3f4a0922cb0ba5e6 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8d975c15c0cd744000ca386247432d57b21f9df0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a9bc32879a08f23cdb80a48c738017e39aea1080 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/af6b5c50d47ab43e5272ad61935d0ed2e264d3f0 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c835df3bcc14858ae9b27315dd7de76370b94f3a | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d54e4da98bbfa8c257bdca94c49652d81d18a4d8 | source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Source : apple.com

Vulnerability ID : CVE-2024-23298

First published on : 15-03-2024 23:15:07
Last modified on : 17-03-2024 22:38:29

Description :
A logic issue was addressed with improved state management.

CVE ID : CVE-2024-23298
Source : product-security@apple.com
CVSS Score : /

References :
https://support.apple.com/en-us/HT214092 | source : product-security@apple.com

Source : carrier.com

Vulnerability ID : CVE-2023-36483

First published on : 16-03-2024 05:15:18
Last modified on : 17-03-2024 22:38:29

Description :
An authorization bypass was discovered in the Carrier MASmobile Classic application through 1.16.18 for Android, MASmobile Classic app through 1.7.24 for iOS, and MAS ASP.Net Services through 1.9. It can be achieved via session ID prediction, allowing remote attackers to retrieve sensitive data including customer data, security system status, and event history. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The affected products cannot simply be updated; they must be removed, but can be replaced by other Carrier software as explained in the Carrier advisory.

CVE ID : CVE-2023-36483
Source : productsecurity@carrier.com
CVSS Score : /

References :
https://www.corporate.carrier.com/Images/CARR-PSA-MASMobile%20Classic%20Authorization%20Bypass-012-0623_tcm558-203964.pdf | source : productsecurity@carrier.com

Source : autodesk.com

Vulnerability ID : CVE-2024-23138

First published on : 18-03-2024 00:15:07
Last modified on : 18-03-2024 01:13:31

Description :
A maliciously crafted DWG file when parsed through Autodesk DWG TrueView can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE ID : CVE-2024-23138
Source : psirt@autodesk.com
CVSS Score : /

References :
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0006 | source : psirt@autodesk.com

Vulnerability : CWE-121

Vulnerability ID : CVE-2024-23139

First published on : 18-03-2024 00:15:07
Last modified on : 18-03-2024 01:13:31

Description :
An Out-Of-Bounds Write Vulnerability in Autodesk FBX Review version 1.5.3.0 and prior may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code “ABC” files. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

CVE ID : CVE-2024-23139
Source : psirt@autodesk.com
CVSS Score : /

References :
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005 | source : psirt@autodesk.com

Vulnerability : CWE-787

Source : jpcert.or.jp

Vulnerability ID : CVE-2023-39223

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

CVE ID : CVE-2023-39223
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://akisoftware.com/Vulnerability202301.html | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN92720882/ | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2023-39933

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a user who can upload files through the product may execute an arbitrary executable file with the web server's execution privilege.

CVE ID : CVE-2023-39933
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://akisoftware.com/Vulnerability202301.html | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN92720882/ | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2023-40160

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server.

CVE ID : CVE-2023-40160
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://akisoftware.com/Vulnerability202301.html | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN92720882/ | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2023-40747

First published on : 18-03-2024 01:15:48
Last modified on : 18-03-2024 01:53:02

Description :
Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot.

CVE ID : CVE-2023-40747
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://akisoftware.com/Vulnerability202301.html | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN92720882/ | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2024-28745

First published on : 18-03-2024 04:15:09
Last modified on : 18-03-2024 12:38:25

Description :
Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.

CVE ID : CVE-2024-28745
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://jvn.jp/en/jp/JVN70640802/ | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2024-21824

First published on : 18-03-2024 08:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. If this vulnerability is exploited, a network-adjacent user who can access the product may impersonate an administrative user. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

CVE ID : CVE-2024-21824
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://jvn.jp/en/jp/JVN82749078/ | source : vultures@jpcert.or.jp
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faqp00100601_000 | source : vultures@jpcert.or.jp
https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faq00100823_000 | source : vultures@jpcert.or.jp
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_2_announce.html | source : vultures@jpcert.or.jp
https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000002 | source : vultures@jpcert.or.jp
https://www.toshibatec.com/information/20240306_01.html | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2024-22475

First published on : 18-03-2024 08:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected product. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

CVE ID : CVE-2024-22475
Source : vultures@jpcert.or.jp
CVSS Score : /

Vulnerability ID : CVE-2024-23604

First published on : 18-03-2024 08:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with specially crafted multiple parameters.

CVE ID : CVE-2024-23604
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
http://fitnesse.org/FitNesseDownload | source : vultures@jpcert.or.jp
https://github.com/unclebob/fitnesse | source : vultures@jpcert.or.jp
https://github.com/unclebob/fitnesse/blob/master/SECURITY.md | source : vultures@jpcert.or.jp
https://jvn.jp/en/jp/JVN94521208/ | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2024-27974

First published on : 18-03-2024 08:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].

CVE ID : CVE-2024-27974
Source : vultures@jpcert.or.jp
CVSS Score : /

References :
https://jvn.jp/en/jp/JVN34328023/ | source : vultures@jpcert.or.jp
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html | source : vultures@jpcert.or.jp

Vulnerability ID : CVE-2024-28125

First published on : 18-03-2024 08:15:06
Last modified on : 18-03-2024 12:38:25

Description :
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.

CVE ID : CVE-2024-28125
Source : vultures@jpcert.or.jp
CVSS Score : /

Vulnerability ID : CVE-2024-28128

First published on : 18-03-2024 08:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.

CVE ID : CVE-2024-28128
Source : vultures@jpcert.or.jp
CVSS Score : /

Vulnerability ID : CVE-2024-28039

First published on : 18-03-2024 09:15:06
Last modified on : 18-03-2024 12:38:25

Description :
Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.

CVE ID : CVE-2024-28039
Source : vultures@jpcert.or.jp
CVSS Score : /

Source : wpscan.com

Vulnerability ID : CVE-2024-1331

First published on : 18-03-2024 16:15:07
Last modified on : 18-03-2024 19:40:00

Description :
The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

CVE ID : CVE-2024-1331
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/b2bac900-3d8f-406c-b03d-c8db156acc59/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-1333

First published on : 18-03-2024 16:15:07
Last modified on : 18-03-2024 19:40:00

Description :
The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks

CVE ID : CVE-2024-1333
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/30546402-03b8-4e18-ad7e-04a6b556ffd7/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-1658

First published on : 18-03-2024 16:15:07
Last modified on : 18-03-2024 19:40:00

Description :
The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVE ID : CVE-2024-1658
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/9489925e-5a47-4608-90a2-0139c5e1c43c/ | source : contact@wpscan.com

Vulnerability ID : CVE-2023-6821

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 contains a vulnerability that allows you to read and download PHP logs without authorization

CVE ID : CVE-2023-6821
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/6b1a998d-c97c-4305-b12a-69e29408ebd9/ | source : contact@wpscan.com

Vulnerability ID : CVE-2023-7085

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

CVE ID : CVE-2023-7085
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/a2ec1308-75a0-49d0-9288-33c6d9ee4328/ | source : contact@wpscan.com

Vulnerability ID : CVE-2023-7236

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information.

CVE ID : CVE-2023-7236
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/2a4557e2-b764-4678-a6d6-af39dd1ba76b/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0365

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.

CVE ID : CVE-2024-0365
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/4b8b9638-d52a-40bc-b298-ae1c74788c18/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0711

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVE ID : CVE-2024-0711
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/8e286c04-ef32-4af0-be78-d978999b2a90/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0719

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVE ID : CVE-2024-0719
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/6e67bf7f-07e6-432b-a8f4-aa69299aecaf/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0779

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example

CVE ID : CVE-2024-0779
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0780

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, allowing any authenticated users, such as subscriber to perform such action

CVE ID : CVE-2024-0780
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/be3045b1-72e6-450a-8dd2-4702a9328447/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0820

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Jobs for WordPress plugin before 2.7.4 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

CVE ID : CVE-2024-0820
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/fc091bbd-7338-4bd4-add5-e46502a9a949/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0858

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.

CVE ID : CVE-2024-0858
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/f6627a35-d158-495e-9d56-69405cfca221/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0951

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE ID : CVE-2024-0951
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/88b2e479-eb15-4213-9df8-3d353074974e/ | source : contact@wpscan.com

Vulnerability ID : CVE-2024-0973

First published on : 18-03-2024 19:15:06
Last modified on : 18-03-2024 19:40:00

Description :
The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE ID : CVE-2024-0973
Source : contact@wpscan.com
CVSS Score : /

References :
https://wpscan.com/vulnerability/798de421-4814-46a9-a055-ebb95a7218ed/ | source : contact@wpscan.com

This website uses the NVD API, but is not approved or certified by it.

Latest vulnerabilities [Monday, March 18, 2024 + weekend]

(14) CRITICAL VULNERABILITIES [9.0, 10.0]

Source : patchstack.com

Vulnerability ID : CVE-2024-27957

Source : cyber.gov.il

Vulnerability ID : CVE-2024-27767

Vulnerability ID : CVE-2024-27768

Source : github.com

Vulnerability ID : CVE-2024-24578

Vulnerability ID : CVE-2024-28255

Vulnerability ID : CVE-2024-21652

Vulnerability ID : CVE-2024-28253

Source : incibe.es

Vulnerability ID : CVE-2024-2599

Source : yd.MitsubishiElectric.co.jp

Vulnerability ID : CVE-2024-0802

Vulnerability ID : CVE-2024-0803

Vulnerability ID : CVE-2024-1915

Vulnerability ID : CVE-2024-1916

Vulnerability ID : CVE-2024-1917

Source : se.com

Vulnerability ID : CVE-2024-2051

(92) HIGH VULNERABILITIES [7.0, 8.9]

Source : wordfence.com

Vulnerability ID : CVE-2024-1795

Vulnerability ID : CVE-2024-1685

Source : vuldb.com

Vulnerability ID : CVE-2024-2485

Vulnerability ID : CVE-2024-2486

Vulnerability ID : CVE-2024-2487

Vulnerability ID : CVE-2024-2488

Vulnerability ID : CVE-2024-2489

Vulnerability ID : CVE-2024-2490

Vulnerability ID : CVE-2024-2546

Vulnerability ID : CVE-2024-2547

Vulnerability ID : CVE-2024-2558

Vulnerability ID : CVE-2024-2581

Vulnerability ID : CVE-2024-2514

Vulnerability ID : CVE-2024-2566

Vulnerability ID : CVE-2024-2569

Vulnerability ID : CVE-2024-2570

Vulnerability ID : CVE-2024-2571

Vulnerability ID : CVE-2024-2572

Vulnerability ID : CVE-2024-2573

Vulnerability ID : CVE-2024-2574

Vulnerability ID : CVE-2024-2575

Vulnerability ID : CVE-2024-2576

Vulnerability ID : CVE-2024-2577

Source : mattermost.com

Vulnerability ID : CVE-2024-2450

Source : github.com

Vulnerability ID : CVE-2024-28254

Vulnerability ID : CVE-2024-28847

Vulnerability ID : CVE-2024-28848

Vulnerability ID : CVE-2023-41334

Vulnerability ID : CVE-2024-28855

Vulnerability ID : CVE-2024-23333

Vulnerability ID : CVE-2024-27096

Vulnerability ID : CVE-2024-28252

Vulnerability ID : CVE-2024-28854

Vulnerability ID : CVE-2024-21661

Vulnerability ID : CVE-2024-21662

Vulnerability ID : CVE-2024-28865

Vulnerability ID : CVE-2024-27920

Vulnerability ID : CVE-2024-28248

Source : patchstack.com

Vulnerability ID : CVE-2023-51474

Vulnerability ID : CVE-2024-27987

Vulnerability ID : CVE-2024-25921

Vulnerability ID : CVE-2024-27192

Vulnerability ID : CVE-2024-27193

Vulnerability ID : CVE-2024-27196

Vulnerability ID : CVE-2024-25597

Vulnerability ID : CVE-2024-27194

Vulnerability ID : CVE-2024-27195

Vulnerability ID : CVE-2024-27197

Vulnerability ID : CVE-2024-27958

Vulnerability ID : CVE-2024-27959

Vulnerability ID : CVE-2024-27960

Vulnerability ID : CVE-2024-27961