Archive
27 February 2024
Vulnerabilities first published on this day (UTC), newest first.
51 results · Clear filters · Feed
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 8.1
Improper validation of document removal parameter
Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.
-
High 7.1
bpf: Fix masking negation logic upon negative dst register
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the…
-
High 7.8
net: qrtr: Avoid potential use after free in MHI send
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Avoid potential use after free in MHI send It is possible that the MHI ul_callback will be invoked immediately following the queueing of the skb for transmission, leading to the ca…
-
High 7.8
bus: mhi: core: Fix invalid error returning in mhi_queue
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: core: Fix invalid error returning in mhi_queue mhi_queue returns an error when the doorbell is not accessible in the current state. This can happen when the device is in non M0 stat…
-
High 7.8
vhost-vdpa: fix vm_flags for virtqueue doorbell mapping
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix vm_flags for virtqueue doorbell mapping The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cau…
-
High 7.8
scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() RIP: 0010:kmem_cache_free+0xfa/0x1b0 Call Trace: qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx] scsi_queue_rq+0x5e2/0xa40 __blk_mq_try_issue_d…
-
High 7.8
btrfs: fix race between transaction aborts and fsyncs leading to use-after-free
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between transaction aborts and fsyncs leading to use-after-free There is a race between a task aborting a transaction during a commit, a task doing an fsync and the transactio…
-
High 7.5
cifs: Return correct error code from smb2_get_enc_key
In the Linux kernel, the following vulnerability has been resolved: cifs: Return correct error code from smb2_get_enc_key Avoid a warning if the error percolates back up: [440700.376476] CIFS VFS: \\otters.example.com crypt_message: Could not get encryption k…
-
High 8.2
openvswitch: fix stack OOB read while fragmenting IPv4 packets
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 pa…
-
High 7.8
md/raid1: properly indicate failure when ending a failed write request
In the Linux kernel, the following vulnerability has been resolved: md/raid1: properly indicate failure when ending a failed write request This patch addresses a data corruption bug in raid1 arrays using bitmaps. Without this fix, the bitmap bits for the fail…
-
High 7.5
sfc: farch: fix TX queue lookup in TX event handling
In the Linux kernel, the following vulnerability has been resolved: sfc: farch: fix TX queue lookup in TX event handling We're starting from a TXQ label, not a TXQ type, so efx_channel_get_tx_queue() is inappropriate (and could return NULL, leading to panics).
-
High 7.5
Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails ap…
-
High 7.1
Download and export of file via default user role
Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export n…
-
High 7.3
Incomplete protection of personal password settings
Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal password setting and establishing a remote connection to a l…
-
High 7.1
SMTP smuggling in Apache James
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SM…
-
High 7.8CVE-2024-0197 Public exploit
Privilege Escalation in Thales SafeNet Sentinel HASP LDK
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
-
High 7.8CVE-2023-7016 Public exploit
Privilege Escalation in SafeNet Authentication Client
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
-
High 7.8
Privilege Escalation in SafeNet Authentication Client Installer
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
-
High 7.8
net: fix use-after-free in tw_timer_handler
In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe6…
-
High 7.8
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes…
-
High 7.8
sctp: use call_rcu to free endpoint
In the Linux kernel, the following vulnerability has been resolved: sctp: use call_rcu to free endpoint This patch is to delay the endpoint free by calling call_rcu() to fix another use-after-free issue in sctp_sock_dump(): BUG: KASAN: use-after-free in __loc…
-
High 7.8
net/smc: fix kernel panic caused by race of smc_sock
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix kernel panic caused by race of smc_sock A crash occurs when smc_cdc_tx_handler() tries to access smc_sock but smc_release() has already freed it. [ 4570.695099] BUG: unable to ha…
-
High 7.8
KEYS: trusted: Fix TPM reservation for seal/unseal
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM reservation for seal/unseal The original patch 8c657a0590de ("KEYS: trusted: Reserve TPM for seal and unseal operations") was correct on the mailing list: https://lore.…
-
High 7.8
locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
In the Linux kernel, the following vulnerability has been resolved: locking/qrwlock: Fix ordering in queued_write_lock_slowpath() While this code is executed with the wait_lock held, a reader can acquire the lock without holding wait_lock. The writer side loo…
-
High 7.5CVE-2023-7165 Scanner template
JetBackup < 2.0.9.9 - Directory Listing Exposing Backups
The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
-
High 7.5
JobSearch WP Job Board < 2.3.4 - Authentication Bypass
The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address.
-
High 7.5
JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
-
High 8.8
Apache Ambari: authenticated users could perform command injection to perform RCE
Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster…
-
High 7.3
net: Make tcp_allowed_congestion_control readonly in non-init netns
In the Linux kernel, the following vulnerability has been resolved: net: Make tcp_allowed_congestion_control readonly in non-init netns Currently, tcp_allowed_congestion_control is global and writable; writing to it in any net namespace will leak into all oth…
-
High 7.8
netfilter: nftables: clone set element expression template
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: clone set element expression template memcpy() breaks when using connlimit in set elements. Use nft_expr_clone() to initialize the connlimit expression list, otherwise co…
-
High 7.0
ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled
In the Linux kernel, the following vulnerability has been resolved: ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled The debugging code for kmap_local() doubles the number of per-CPU fixmap slots allocated for kmap_local(), in ord…
-
High 7.1
bpf: Use correct permission flag for mixed signed bounds arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Use correct permission flag for mixed signed bounds arithmetic We forbid adding unknown scalars with mixed signed bounds due to the spectre v1 masking mitigation. Hence this also needs b…
-
High 7.7
Collection of internally resolving IPs
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. Th…
-
High 8.3
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID.
-
High 7.2
SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via…