Threat database

CVE-2024-32465 is a path traversal vulnerability in Git that affects certain versions prior to patched releases. It allows bypassing protections when working with untrusted repositories, especially when repositories are obtained as archives like .zip files. This can lead to execution of malicious hooks within the repository context. The issue has been fixed in multiple Git versions starting from 2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, and 2.44.1. Users are advised to avoid using Git on repositories obtained from untrusted archive sources or to upgrade to patched versions.

A vulnerability in Git prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 allows an attacker to create hardlinks to arbitrary user-readable files on the same filesystem when cloning a local repository containing symlinks. This occurs due to a race condition in the checks against symbolic links during the hard link operation in local cloning optimizations.

CVE-2024-32004 is a high-severity vulnerability in Git prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows an attacker to craft a local repository that, when cloned, executes arbitrary code during the cloning process. This issue has been patched in the specified fixed versions. Users are advised to avoid cloning repositories from untrusted sources as a temporary mitigation.

CVE-2024-32002 is a critical path traversal vulnerability in Git affecting versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows crafted repositories with submodules to write files into the .git/ directory instead of the submodule worktree, enabling execution of malicious hooks during cloning without user inspection. Disabling symbolic link support in Git mitigates the attack. The issue has been patched in the specified fixed versions.

CVE-2024-34340 is a critical improper authentication vulnerability in Cacti versions prior to 1.2.27. The issue arises from a type juggling flaw in the password verification function, where an MD5 hash comparison uses a loose equality check. This allows authentication bypass under certain conditions. The vulnerability is patched in version 1.2.27.

CVE-2024-31460 is a SQL injection vulnerability in Cacti prior to version 1.2.27. The flaw exists because data in automation_tree_rules.php is insufficiently validated before being concatenated into a SQL statement in the create_all_header_nodes() function. This allows attackers with limited privileges to modify the Cacti database contents, potentially leading to further impacts such as arbitrary file reading and remote code execution. The issue is fixed in version 1.2.27.

CVE-2024-31458 is a SQL injection vulnerability in Cacti versions prior to 1.2.27. The flaw exists because data handled by the form_save() function in graph_template_inputs.php is insufficiently validated before being concatenated into an SQL statement in draw_nontemplated_fields_graph_item() in lib/html_form_templates.php. This vulnerability was patched in version 1.2.27.

CVE-2024-31444 is a cross-site scripting (XSS) vulnerability in Cacti versions prior to 1.2.27. The issue arises from insufficient validation of data stored by the automation_tree_rules_form_save() function, which is later used in HTML concatenation in form_confirm(). This flaw allows injection of malicious scripts in the affected versions. The vulnerability is fixed in version 1.2.27.

CVE-2024-31443 is a cross-site scripting (XSS) vulnerability in Cacti prior to version 1.2.27. The issue arises from insufficient input validation in the form_save() function within data_queries.php, which leads to unsafe HTML concatenation in grow_right_pane_tree() in lib/html.php. This flaw allows an attacker with limited privileges to inject malicious scripts. The vulnerability is fixed in Cacti version 1.2.27.

CVE-2024-25641 is a critical arbitrary file write vulnerability in Cacti versions prior to 1.2.27. It affects the "Package Import" feature, allowing authenticated users with "Import Templates" permission to write or overwrite files on the web server via path traversal in the import_package() function. This can lead to arbitrary PHP code execution. The issue is fixed in version 1.2.27.

CVE-2024-27280 is a critical buffer-overread vulnerability in the StringIO library versions 3.0.1 as used in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The flaw allows the ungetbyte and ungetc methods to read beyond the end of the string buffer, potentially exposing memory contents when StringIO.gets is called subsequently. Fixed versions include 3.0.3, stringio 3.0.1.1 for Ruby 3.0, and stringio 3.0.1.2 for Ruby 3.1.

Jinja2 versions prior to 3.1.4 have a vulnerability in the xmlattr filter where user input passed as keys can include characters that lead to HTML attribute injection. This can allow an attacker to inject additional attributes and potentially perform cross-site scripting (XSS) if the application renders these keys in pages viewed by other users. The issue arises because xmlattr does not restrict keys from containing characters like spaces, '/', '>', or '=', which are invalid in XML/HTML attributes. The vulnerability is fixed in version 3.1.4.

CVE-2024-22391 is a heap-based buffer overflow vulnerability in the LookupTable::SetLUT function of Grassroot DICOM version 3.0.23. This flaw allows an attacker to cause memory corruption by providing a specially crafted malformed file. The vulnerability has a high severity score of 7.7 and can impact confidentiality, integrity, and availability.

CVE-2024-25569 is an out-of-bounds read vulnerability in the RAWCodec::DecodeBytes function of Grassroot DICOM version 3.0.23. This flaw can be triggered by processing a specially crafted DICOM file, potentially leading to information disclosure or application instability.

CVE-2024-22025 is a vulnerability in Node.js affecting multiple versions where the fetch() function always decodes Brotli compression. This behavior can be exploited by an attacker controlling the URL passed to fetch() to cause resource exhaustion, leading to a Denial of Service (DoS) condition. The attack results in memory exhaustion that may terminate the Node.js process depending on system configuration.

CVE-2024-22019 is a high-severity vulnerability in Node.js HTTP servers where specially crafted HTTP requests with chunked encoding can cause resource exhaustion. The flaw arises because the server reads an unlimited number of bytes from a single connection due to missing limits on chunk extension bytes. This can lead to denial of service by exhausting CPU and network bandwidth, bypassing typical protections like timeouts and body size limits.

Jinja2 versions prior to 3.1.3 have a vulnerability in the xmlattr filter that allows HTML attribute injection when user input is passed as keys. This occurs because keys containing spaces are accepted, which can be interpreted as multiple attributes, enabling potential cross-site scripting (XSS) if untrusted keys are rendered. This issue is mitigated by verifying keys or upgrading to version 3.1.3 or later.

CVE-2024-21647 is a vulnerability in Puma HTTP server versions prior to 6.4.2 and 5.6.8 where improper parsing of chunked transfer encoding bodies allows unbounded resource consumption. This occurs because chunk extensions are not size-limited, enabling attackers to exhaust CPU and network bandwidth resources. The issue has been fixed in versions 6.4.2 and 5.6.8. No known workarounds exist.

A StackOverflow vulnerability (CVE-2024-21634) exists in the ion-java library versions prior to 1.10.5. This flaw can cause a denial-of-service condition when deserializing crafted Ion text or binary data or when invoking certain IonValue methods on the deserialized data. The issue is fixed in ion-java version 1.10.5.