CVE-2024-4177
published 2024-06-06CVE-2024-4177: A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
34.5th percentile
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bitdefender | gravityzone | < 6.38.1-2 | 6.38.1-2 |
| bitdefender | gravityzone_console_on-premise | < 6.38.1-2 | 6.38.1-2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g5m9-q65c-x6m4: A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forg
ghsa_unreviewed·2024-06-06
CVE-2024-4177 [HIGH] CWE-116 GHSA-g5m9-q65c-x6m4: A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forg
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.
Red Hat
kernel: drm/fbdev-dma: Only cleanup deferred I/O if necessary
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2024-50037 [MEDIUM] CWE-690 kernel: drm/fbdev-dma: Only cleanup deferred I/O if necessary
kernel: drm/fbdev-dma: Only cleanup deferred I/O if necessary
In the Linux kernel, the following vulnerability has been resolved:
drm/fbdev-dma: Only cleanup deferred I/O if necessary
Commit 5a498d4d06d6 ("drm/fbdev-dma: Only install deferred I/O if
necessary") initializes deferred I/O only if it is used.
drm_fbdev_dma_fb_destroy() however calls fb_deferred_io_cleanup()
unconditionally with struct fb_info.fbdefio == NULL. KASAN with the
out-of-tree Apple silicon display driver posts following warning from
__flush_work() of a random struct work_struct instead of the expected
NULL pointer derefs.
[ 22.053799] ------------[ cut here ]------------
[ 22.054832] WARNING: CPU: 2 PID: 1 at kernel/workqueue.c:4177 __flush_work+0x4d8/0x580
[ 22.056597] Modules linked in: uhid bnep uinput nls_ascii
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bitdefender.com/consumer/support/support/security-advisories/host-whitelist-parser-issue-in-gravityzone-console-on-premise-va-11554/https://www.cve.org/CVERecord?id=CVE-2024-4177https://bitdefender.com/consumer/support/support/security-advisories/host-whitelist-parser-issue-in-gravityzone-console-on-premise-va-11554/
2024-06-06
Published