Database/Control plane, storage & DevOps
Samba: Path traversal in client pipe names
CVSS 9.1CVE-2023-3961Control plane, storage & DevOpscurated
Impact
Path traversal in client pipe names -> connect to Unix sockets outside the private directory
Who can reach it
Network (remote)
What to do
Data-plane: smbd upgrade on file-serving nodes
References
Related entries
- Samba: SMB client can truncate files despite read-only permissions when acl_xattr ignores system ACLsCVE-2023-4091 · SambaMedium
- Lustre (incorrect access control, 2.13.x-2.15.x before 2.15.4): Incorrect access control in Lustre lets an attackerCVE-2023-51786 · Lustre (incorrect access control, 2.13.x-2.15.x before 2.15.4)Critical
- Pure Storage FlashArray Purity (remote administrative account creation): An attacker uses a remote administrativeCVE-2024-0003 · Pure Storage FlashArray Purity (remote administrative account creation)Critical
- Pure Storage FlashArray Purity (array admin command execution): A user holding the array admin role executes arbitraryCVE-2024-0004 · Pure Storage FlashArray Purity (array admin command execution)Critical
- Pure Storage FlashArray / FlashBlade Purity (SNMP configuration command injection): A crafted SNMP configuration yieldsCVE-2024-0005 · Pure Storage FlashArray / FlashBlade Purity (SNMP configuration command injection)Critical
- Ivanti Connect Secure: Command injection in web componentsCVE-2024-21887 · Ivanti Connect SecureCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.