Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint<br /> <br /> When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty()<br /> may cause a NULL pointer dereference, or a general protection fault when<br /> KASAN is enabled.<br /> <br /> This happens because, since the tracepoint was added in<br /> mark_buffer_dirty(), it references the dev_t member bh-&gt;b_bdev-&gt;bd_dev<br /> regardless of whether the buffer head has a pointer to a block_device<br /> structure.<br /> <br /> In the current implementation, nilfs_grab_buffer(), which grabs a buffer<br /> to read (or create) a block of metadata, including b-tree node blocks,<br /> does not set the block device, but instead does so only if the buffer is<br /> not in the "uptodate" state for each of its caller block reading<br /> functions. However, if the uptodate flag is set on a folio/page, and the<br /> buffer heads are detached from it by try_to_free_buffers(), and new buffer<br /> heads are then attached by create_empty_buffers(), the uptodate flag may<br /> be restored to each buffer without the block device being set to<br /> bh-&gt;b_bdev, and mark_buffer_dirty() may be called later in that state,<br /> resulting in the bug mentioned above.<br /> <br /> Fix this issue by making nilfs_grab_buffer() always set the block device<br /> of the super block structure to the buffer head, regardless of the state<br /> of the buffer&amp;#39;s uptodate flag.

Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8.

Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.

The Client secret is not checked when using the OAuth Password grant type.<br /> <br /> By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment.<br /> Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.

Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks.<br /> <br /> <br /> This issue affects Online Ordering System: 8.2.1. <br /> <br /> NOTE: Vulnerability fixed in version 8.2.2 and does not exist before 8.2.1.

IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: sync_linked_regs() must preserve subreg_def<br /> <br /> Range propagation must not affect subreg_def marks, otherwise the<br /> following example is rewritten by verifier incorrectly when<br /> BPF_F_TEST_RND_HI32 flag is set:<br /> <br /> 0: call bpf_ktime_get_ns call bpf_ktime_get_ns<br /> 1: r0 &amp;= 0x7fffffff after verifier r0 &amp;= 0x7fffffff<br /> 2: w1 = w0 rewrites w1 = w0<br /> 3: if w0 r11 = 0x2f5674a6 (r)<br /> 4: r1 &gt;&gt;= 32 r11

A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack