Archive
7 August 2024
Vulnerabilities first published on this day (UTC), newest first.
118 results · Feed
-
High 7.5
Journyx Unauthenticated XML External Entities Injection
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
-
Medium 6.1CVE-2024-6892 Scanner template
Journyx Reflected Cross Site Scripting
Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.
-
High 8.8
Journyx Authenticated Remote Code Execution
Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.
-
Critical 9.8
Journyx Unauthenticated Password Reset Bruteforce
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
-
High 7.5
Open WebUI Arbitrary File Upload + Path Traversal
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.
-
Medium 6.3
Open WebUI Stored Cross-Site Scripting
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.
-
Critical 9.8
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware fla…
-
High 8.8
Tenda i22 apPortalAuth formApPortalWebAuth buffer overflow
A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the file /goform/apPortalAuth. The manipulation of the argument webUserName/webUserPassword leads to bu…
-
Medium 6.7
Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object cre…
-
High 7.5
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisc…
-
Critical 9.8
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisc…
-
Critical 9.8
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisc…
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…
-
Medium 5.4
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…
-
Medium 5.5
Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta…
-
High 8.8
Tenda i22 apPortalPhoneAuth formApPortalPhoneAuth buffer overflow
A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formApPortalPhoneAuth of the file /goform/apPortalPhoneAuth. The manipulation of the argument data leads to buffer overflow. It is possible to la…
-
High 8.8
Tenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflow
A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the function formApPortalOneKeyAuth of the file /goform/apPortalOneKeyAuth. The manipulation of the argument data leads to buffer overflow. The at…
-
High 8.8
Tenda i22 apPortalAccessCodeAuth formApPortalAccessCodeAuth buffer overflow
A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function formApPortalAccessCodeAuth of the file /goform/apPortalAccessCodeAuth. The manipulation of the argument accessCode/data/acceInfo leads to buff…
-
High 7.8
cachefiles: add missing lock protection when polling
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll routine when iterating xarray, otherwise: Even with RCU read lock held, only the slot of the radix tre…
-
High 7.8
spi: don't unoptimize message in spi_async()
In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spi_async() Calling spi_maybe_unoptimize_message() in spi_async() is wrong because the message is likely to be in the queue and not transferred yet. This can …
-
High 7.5
wireguard: allowedips: avoid unaligned 64-bit memory accesses
In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the kernel issues kernel warnings because swap_endian() tries to load a 128-bit IPv6 address from an unal…
-
Unscored —
tty: serial: ma35d1: Add a NULL check for of_node
In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for of_node The pdev->dev.of_node can be NULL if the "serial" node is absent. Add a NULL check to return an error in such cases.
-
Unscored —
Revert "sched/fair: Make sure to try to detach at least one movable task"
In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignor…
-
Unscored —
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to lo…
-
Unscored —
USB: serial: mos7840: fix crash on resume
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic re…
-
Unscored —
mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: if (max_size < PAGE_SIZE) max_size = PAGE_SIZE; whereas: blk_validate_limits() makes it an error: if (WA…
-
Unscored —
mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series "mm/filemap: Limit page cache size to that supported by xarray", v2. Currently, xarray can't support arbitrary page cach…
-
Unscored —
mm/shmem: disable PMD-sized page cache if needed
In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-sized page cache can't be supported by xarray. For example, 512MB page cache on ARM64 when the base pa…
-
Unscored —
x86/bhi: Avoid warning in #DB handler due to BHI mitigation
In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY …
-
Unscored —
bpf: Fail bpf_timer_cancel when callback is being cancelled
In the Linux kernel, the following vulnerability has been resolved: bpf: Fail bpf_timer_cancel when callback is being cancelled Given a schedule: timer1 cb timer2 cb bpf_timer_cancel(timer2); bpf_timer_cancel(timer1); Both bpf_timer_cancel calls would wait fo…
-
Unscored —
firmware: cs_dsp: Validate payload length before processing block
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load() to be done before the block is processed. The check th…
-
Unscored —
firmware: cs_dsp: Return error if block header overflows file
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp_power_up() if a block header is longer than the amount of data left in the file. The previous code in…
-
High 7.8
s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() used to work with NULL pointers before the conversion to ptdescs. Since crst_table_free() can be called…
-
High 7.8
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read i…
-
High 7.8
mm: fix crashes from deferred split racing folio migration
In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I've been seeing elusive "Bad page state"s (often on flags when freeing, yet the flags shown are not bad: PG_locke…
-
Critical 9.8
libceph: fix race between delayed_work() and ceph_monc_stop()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Bo…
-
High 7.8
filemap: replace pte_offset_map() with pte_offset_map_nolock()
In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_map_nolock() The vmf->ptl in filemap_fault_recheck_pte_none() is still set from handle_pte_fault(). But at the same time, we did a pte_unmap(…
-
High 8.8
Tenda A301 WifiBasicSet formWifiBasicSet stack-based overflow
A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. It is possible to ini…
-
Medium 6.3
Alien Technology ALR-F800 system.html os command injection
A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami …
-
Medium 6.3
Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection
A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of t…