🚨 CVE-2024-38531
Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.
🎖@cveNotify
Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.
🎖@cveNotify
GitHub
libstore/local-derivation-goal: prohibit creating setuid/setgid binaries by Ma27 · Pull Request #10501 · NixOS/nix
Motivation
With Linux kernel >=6.6 & glibc 2.39 a fchmodat2(2) is available that
isn't filtered away by the libseccomp sandbox.
Being able to use this to bypass that restric...
With Linux kernel >=6.6 & glibc 2.39 a fchmodat2(2) is available that
isn't filtered away by the libseccomp sandbox.
Being able to use this to bypass that restric...
🚨 CVE-2024-29039
tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.
🎖@cveNotify
tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.
🎖@cveNotify
GitHub
Release 5.7 · tpm2-software/tpm2-tools
Security
Fixed CVE-2024-29038
Fixed CVE-2024-29039
Fixed
Fix eventlog test
Fix issues with reading NV indexes
Fix context save error on tpm2_create
tpm2_sessionconfig: fix handling of --disable-...
Fixed CVE-2024-29038
Fixed CVE-2024-29039
Fixed
Fix eventlog test
Fix issues with reading NV indexes
Fix context save error on tpm2_create
tpm2_sessionconfig: fix handling of --disable-...
🚨 CVE-2024-35137
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.
🎖@cveNotify
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.
🎖@cveNotify
Ibmcloud
IBM X-Force Exchange
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
🚨 CVE-2024-35139
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415.
🎖@cveNotify
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415.
🎖@cveNotify
Ibmcloud
IBM X-Force Exchange
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
🚨 CVE-2024-38521
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0.
🎖@cveNotify
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0.
🎖@cveNotify
GitHub
[Dev Beta] Persistent XSS in Inbox
### Summary
There is a persistent XSS in the Inbox.
### Details
There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon displa...
There is a persistent XSS in the Inbox.
### Details
There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon displa...
🚨 CVE-2024-38987
aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38987] Prototype Pollution vulnerability affecting aofl/cli-lib module, versions <= 3.14.0
[CVE-2024-38987] Prototype Pollution vulnerability affecting aofl/cli-lib module, versions <= 3.14.0 - aofl-cli-lib-pp.md
🚨 CVE-2024-38990
Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38990] Vulnerability Advisory: @abip/sp-common, version 0.5.4
[CVE-2024-38990] Vulnerability Advisory: @abip/sp-common, version 0.5.4 - Advisory_Tada5hi.md
🚨 CVE-2024-38991
akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38991] Vulnerability Advisory: Prototype Pollution in @akbr/patch-into, version 1.0.1
[CVE-2024-38991] Vulnerability Advisory: Prototype Pollution in @akbr/patch-into, version 1.0.1 - Advisory_akbr.md
🚨 CVE-2024-38992
airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38992] Vulnerability Advisory: Prototype Pollution in @airvertco/frappejs, 0.0.11
[CVE-2024-38992] Vulnerability Advisory: Prototype Pollution in @airvertco/frappejs, 0.0.11 - Advisory_frappe.md
🚨 CVE-2024-38993
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38993] Vulnerability Advisory Prototype Pollution in @jsonic/jsonic-next, version 2.12.1
[CVE-2024-38993] Vulnerability Advisory Prototype Pollution in @jsonic/jsonic-next, version 2.12.1 - Advisory_rjrodger.md
🚨 CVE-2024-38994
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38994] Vulnerability Advisory: Prototype Pollution in @amoy/common, version 1.0.10
[CVE-2024-38994] Vulnerability Advisory: Prototype Pollution in @amoy/common, version 1.0.10 - Advisory_amoyjs.md
🚨 CVE-2024-38996
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38996] Vulnerability Advisory: Prototype Pollution, version 31.3.2
[CVE-2024-38996] Vulnerability Advisory: Prototype Pollution, version 31.3.2 - Advisory_ag-grid.md
🚨 CVE-2024-38997
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38997] Vulnerability Advisory: Prototype Pollution in @adolph_dudu/ratio-swiper, version <= 0.0.2
[CVE-2024-38997] Vulnerability Advisory: Prototype Pollution in @adolph_dudu/ratio-swiper, version <= 0.0.2 - Advisory_Adophlidu.md
🚨 CVE-2024-38998
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38998] Vulnerability Advisory: Prototype Pollution in requirejs, versions <= 2.3.6
[CVE-2024-38998] Vulnerability Advisory: Prototype Pollution in requirejs, versions <= 2.3.6 - Advisory_jrburke.md
🚨 CVE-2024-38999
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38998] Vulnerability Advisory: Prototype Pollution in requirejs, versions <= 2.3.6
[CVE-2024-38998] Vulnerability Advisory: Prototype Pollution in requirejs, versions <= 2.3.6 - Advisory_jrburke.md
🚨 CVE-2024-39000
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38997] Vulnerability Advisory: Prototype Pollution in @adolph_dudu/ratio-swiper, version <= 0.0.2
[CVE-2024-38997] Vulnerability Advisory: Prototype Pollution in @adolph_dudu/ratio-swiper, version <= 0.0.2 - Advisory_Adophlidu.md
🚨 CVE-2024-39001
ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38996] Vulnerability Advisory: Prototype Pollution, version 31.3.2
[CVE-2024-38996] Vulnerability Advisory: Prototype Pollution, version 31.3.2 - Advisory_ag-grid.md
🚨 CVE-2024-39002
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38993] Vulnerability Advisory Prototype Pollution in @jsonic/jsonic-next, version 2.12.1
[CVE-2024-38993] Vulnerability Advisory Prototype Pollution in @jsonic/jsonic-next, version 2.12.1 - Advisory_rjrodger.md
🚨 CVE-2024-39003
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-38994] Vulnerability Advisory: Prototype Pollution in @amoy/common, version 1.0.10
[CVE-2024-38994] Vulnerability Advisory: Prototype Pollution in @amoy/common, version 1.0.10 - Advisory_amoyjs.md
🚨 CVE-2024-39008
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-39008] Vulnerability Advisory: Prototype Pollution in fast-loops@1.1.3
[CVE-2024-39008] Vulnerability Advisory: Prototype Pollution in fast-loops@1.1.3 - Advisory_robinweser.md
🚨 CVE-2024-39013
2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
🎖@cveNotify
Gist
[CVE-2024-39013] Vulnerability Advisory Prototype Pollution in 2o3t-utility, version 0.1.2
[CVE-2024-39013] Vulnerability Advisory Prototype Pollution in 2o3t-utility, version 0.1.2 - Advisory_2o3t.md