Vulnerabilities

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: qla2xxx: Fix bsg_done() causing double free<br /> <br /> Kernel panic observed on system,<br /> <br /> [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000<br /> [5353358.825194] #PF: supervisor write access in kernel mode<br /> [5353358.825195] #PF: error_code(0x0002) - not-present page<br /> [5353358.825196] PGD 100006067 P4D 0<br /> [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI<br /> [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1<br /> [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025<br /> [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10<br /> [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246<br /> [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000<br /> [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000<br /> [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000<br /> [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090<br /> [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000<br /> [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000<br /> [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0<br /> [5353358.825221] PKRU: 55555554<br /> [5353358.825222] Call Trace:<br /> [5353358.825223] <br /> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df<br /> [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df<br /> [5353358.825232] ? sg_copy_buffer+0xc8/0x110<br /> [5353358.825236] ? __die_body.cold+0x8/0xd<br /> [5353358.825238] ? page_fault_oops+0x134/0x170<br /> [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110<br /> [5353358.825244] ? exc_page_fault+0xa8/0x150<br /> [5353358.825247] ? asm_exc_page_fault+0x22/0x30<br /> [5353358.825252] ? memcpy_erms+0x6/0x10<br /> [5353358.825253] sg_copy_buffer+0xc8/0x110<br /> [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]<br /> [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]<br /> <br /> Most routines in qla_bsg.c call bsg_done() only for success cases.<br /> However a few invoke it for failure case as well leading to a double<br /> free. Validate before calling bsg_done().

The server certificate was not verified when an Arc agent connected to a Guardian or CMC.<br /> <br /> <br /> <br /> A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC.

A logic error in the remove_password() function in Checkmk GmbH&amp;#39;s Checkmk versions

A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter.<br /> <br /> <br /> <br /> A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured to use the Alerted Nodes Dashboard, and alerts are reported for the affected node, then the injected HTML may render in the browser of a victim user interacting with it, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

A Stored HTML Injection vulnerability was discovered in the CMC&amp;#39;s Sensor Map functionality due to improper validation on connected Guardians&amp;#39; properties.<br /> <br /> <br /> <br /> A malicious authenticated user with administrator privileges on a Guardian connected to a CMC can edit the Guardian&amp;#39;s properties to inject HTML tags. If the Sensor Map functionality is enabled in the CMC, when a victim CMC user interacts with it, then the injected HTML may render in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: fix use-after-free in nf_tables_addchain()<br /> <br /> nf_tables_addchain() publishes the chain to table-&gt;chains via<br /> list_add_tail_rcu() (in nft_chain_add()) before registering hooks.<br /> If nf_tables_register_hook() then fails, the error path calls<br /> nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()<br /> with no RCU grace period in between.<br /> <br /> This creates two use-after-free conditions:<br /> <br /> 1) Control-plane: nf_tables_dump_chains() traverses table-&gt;chains<br /> under rcu_read_lock(). A concurrent dump can still be walking<br /> the chain when the error path frees it.<br /> <br /> 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly<br /> installs the IPv4 hook before IPv6 registration fails. Packets<br /> entering nft_do_chain() via the transient IPv4 hook can still be<br /> dereferencing chain-&gt;blob_gen_X when the error path frees the<br /> chain.<br /> <br /> Add synchronize_rcu() between nft_chain_del() and the chain destroy<br /> so that all RCU readers -- both dump threads and in-flight packet<br /> evaluation -- have finished before the chain is freed.

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0.<br /> <br /> HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0

Dell PowerScale OneFS, versions 9.10.0.0 through 9.10.1.5 and versions 9.11.0.0 through 9.12.0.1, contains an external control of system or configuration setting vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to code execution, denial of service, elevation of privileges, and information disclosure.

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.