Schwachstellen, die jetzt zählen.

PostgreSQL ODBC Treiber: Mehrere Schwachstellen ermöglichen Manipulation von Daten

postgresql-odbc: postgresql-odbc: arbitrary code execution via buffer overflow in large-object read

github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: Arbitrary command execution via crafted SSH repository proxy configuration

awswrangler: awswrangler: Privilege escalation via crafted column name in Apache Iceberg write component

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route…

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.

Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API…

Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Privilege escalation via use-after-free in event tracing subsystem

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: privilege escalation via use-after-free in coredump subsystem

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex)…

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

quickjs-ng: quickjs-ng: Arbitrary code execution via integer overflow during proxy property enumeration

netpbm: netpbm: Arbitrary code execution via integer overflow in jbigtopnm

netpbm: netpbm: Arbitrary code execution via crafted PICT file in picttoppm

netpbm: netpbm: Arbitrary code execution via crafted PICT file in picttoppm

netpbm: netpbm: Arbitrary code execution via integer overflow in winicontopam

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Barracuda Networks Multiple Products OS Command Injection Vulnerability

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

reply-from: reply-from: Unauthorized upstream access via path traversal

In GPU pdma, there is a possible escalation of privilege due to a missing permission check.

In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546.

In Modem, there is a possible out of bounds write due to a missing bounds check.

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.

knip: knip: Arbitrary file overwrite via path traversal

Linux Kernel: Mehrere Schwachstellen

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the…

Linux Kernel: Mehrere Schwachstellen

Linux Kernel: Mehrere Schwachstellen

Linux Kernel: Mehrere Schwachstellen