CVE-2024-0005
published 2024-09-23CVE-2024-0005: A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP…
PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.64%
45.9th percentile
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| purestorage | flasharray | — | — |
| purestorage | flasharray | — | — |
| purestorage | flasharray | 5.0.0 – 5.0.11 | — |
| purestorage | flasharray | 5.1.0 – 5.1.17 | — |
| purestorage | flasharray | 5.2.0 – 5.2.7 | — |
| purestorage | flasharray | 5.3.0 – 5.3.21 | — |
| purestorage | flasharray | 6.0.0 – 6.0.9 | — |
| purestorage | flasharray | 6.1.0 – 6.1.25 | — |
| purestorage | flasharray | 6.2.0 – 6.2.17 | — |
| purestorage | flasharray | 6.3.0 – 6.3.14 | — |
| purestorage | flasharray | 6.4.0 – 6.4.10 | — |
| purestorage | flashblade | 3.0.0 – 3.0.9 | — |
| purestorage | flashblade | 3.1.0 – 3.1.15 | — |
| purestorage | flashblade | 3.2.0 – 3.2.10 | — |
| purestorage | flashblade | 3.3.0 – 3.3.11 | — |
| purestorage | flashblade | 4.0.0 – 4.0.6 | — |
| purestorage | flashblade | 4.1.0 – 4.1.10 | — |
| purestorage | flashblade | 4.2.0 – 4.2.3 | — |
| purestorage | flashblade | 4.3.0 – 4.3.1 | — |
| purestorage | purity_fa | — | — |
| purestorage | purity_fa | — | — |
| purestorage | purity_fa | 5.0.0 – 5.0.11 | — |
| purestorage | purity_fa | 5.1.0 – 5.1.17 | — |
| purestorage | purity_fa | 5.2.0 – 5.2.7 | — |
| purestorage | purity_fa | 5.3.0 – 5.3.21 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q6vw-x86f-x8m4: A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically craft
ghsa_unreviewed·2024-09-23
CVE-2024-0005 [CRITICAL] CWE-77 GHSA-q6vw-x86f-x8m4: A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically craft
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
Red Hat
kernel: platform/x86: x86-android-tablets: Unregister devices in reverse order
vendor_redhat·2024-07-12·CVSS 5.5
CVE-2024-40975 [MEDIUM] CWE-911 kernel: platform/x86: x86-android-tablets: Unregister devices in reverse order
kernel: platform/x86: x86-android-tablets: Unregister devices in reverse order
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: Unregister devices in reverse order
Not all subsystems support a device getting removed while there are
still consumers of the device with a reference to the device.
One example of this is the regulator subsystem. If a regulator gets
unregistered while there are still drivers holding a reference
a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:
WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister
Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015
RIP: 0010:regulator_unregister
Call Trace:
VMware
VMware Workstation and Fusion updates address an out-of-bounds read vulnerability (CVE-2024-22251)
vendor_vmware·2024-02-27·CVSS 5.9
CVE-2024-22251 [MEDIUM] VMware Workstation and Fusion updates address an out-of-bounds read vulnerability (CVE-2024-22251)
VMSA-2024-0005: VMware Workstation and Fusion updates address an out-of-bounds read vulnerability (CVE-2024-22251)
VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.9.
CVEs: CVE-2024-22251
Affected products: VMware Fusion, VMware Workstation, Workstation Pro
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-28863 node-tar: denial of service while parsing a tar file due to lack of folders depth validation
bugzilla·2024-06-20·CVSS 6.5
CVE-2024-28863 [MEDIUM] CVE-2024-28863 node-tar: denial of service while parsing a tar file due to lack of folders depth validation
CVE-2024-28863 node-tar: denial of service while parsing a tar file due to lack of folders depth validation
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
https://security.netapp.com/advisory/ntap-20240524-0005/
Discussion:
Created
Microsoft
Detecting and mitigating elevation-of-privilege exploit for CVE-2017-0005 | Microsoft Security Blog
blogs_microsoft·2017-03-27·CVSS 7.8
[HIGH] Detecting and mitigating elevation-of-privilege exploit for CVE-2017-0005 | Microsoft Security Blog
Research
March 27, 2017
## Related posts
April 22, 2024
October 25, 2023
September 14, 2023
## Get started with Microsoft Security
Protect your people, data, and infrastructure with AI-powered, end-to-end security from Microsoft.
Connect with us on social
Careers
About Microsoft
Company news
Privacy at Microsoft
Investors
Diversity and inclusion
Accessibility
Sustainability
2024-09-23
Published