Apache Kylin authorization issue vulnerability

A security vulnerability exists in Apache Kylin versions 5 through 5.0.4. This vulnerability stems from the lack of authentication in the backend cache API, making it susceptible to SQL injection attacks that could lead to the execution of malicious SQL statements...

Mattermost log information leakage vulnerability

Mattermost versions 11.9.1 and earlier of 11.9.x series, 11.8.5 and earlier of 11.8.x series, 11.7.10 and earlier of 11.7.x series, and 11.10.1 and earlier of 11.10.x series have a vulnerability related to log information leakage. This vulnerability arises from the failure to clear the...

Lenovo Idea Tab Pro (TB373FU) licensing issues and vulnerabilities

The Lenovo Idea Tab Pro TB373FU has an authorization issue vulnerability. This vulnerability stems from an authentication bypass, which may allow users with physical access rights to access the device without proper authorization...

FastapiAdmin authorization issue vulnerability

In FastAPIAdmin versions 3.0 and earlier, there is an authorization issue vulnerability. This vulnerability stems from the lack of protection for the automatic login endpoint. Unauthorized attackers can list users through /api/v1/auth/auto-login/users, obtain the superuser automatic login token,...

JoeyZhou Xiaozhi ESP32 Server Java Authorization Vulnerability

JoeyZhou Xiaozhi ESP32 Server Java 6.1.0 and earlier versions have an authorization issue. This vulnerability stems from an authentication bypass. Unverified attackers can obtain a valid device WebSocket token by making a request to/api/device/ota with any MAC address. This allows them to open th...

FreeRDP resource management error vulnerability

FreeRDP versions from 3.0.0 to 3.32.0 have a resource management vulnerability. This vulnerability stems from an uncontrolled resource consumption issue in the parsenlamodepdu function. Unverified attackers can successfully perform TLS negotiations and send byte streams that do not start with the...

Astra Linux – Vulnerability in Chromium

The use of after free in Web Authentication in Google Chrome before version 149.0.7827.155 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – vulnerability in Tomcat9

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication ServerAuthContext component, which may throw an exception during the authentication process without explicitly setting an HTTP status indicating failure, the authentication may...

Astra Linux – Vulnerability in openipmi

OpenIPMI before version 2.0.36 has a buffer overflow vulnerability related to the authentication type in the ipmisim simulator. This vulnerability can lead to denial of service, or with a very low probability authentication bypass or code execution...

Astra Linux – vulnerability in open-vm-tools

A fully compromised ESXi host can cause VMware Tools to fail to authenticate host-to-guest operations, thereby compromising the confidentiality and integrity of the guest virtual machine...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggered a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting through a malicious RDP Gateway to crash with...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpicmpui During NVMeTCP Authentication, a controller can trigger a kernel oops by specifying the 8192-bit Diffie-Hellman group and passing a correctly sized but zeroed Diffie-Hellman...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: MAC comparisons need to be performed in constant time. To prevent timing attacks, MAC comparisons must be done in constant time. Replace the memcmp function with the correct function, cryptomemneq...

Astra Linux – vulnerability in python3.7, python2.7, pypy

An issue was found in Python versions prior to 3.8.18, 3.9.x prior to 3.9.18, 3.10.x prior to 3.10.13, and 3.11.x prior to 3.11.5. It primarily affects servers such as HTTP servers that employ TLS client authentication. When a TLS server-side socket is created, data is received into its buffer, a...

Astra Linux – Vulnerability in freerdp3

FreeRDP prior to version 3.29.0 affected versions ≤ 3.28.0 contains several vulnerabilities related to TLS certificate identity validation in functions like tlsverifycertificate, tlsmatchhostname, and x509Utilsietfgetdnsnames. Since FreeRDP performs custom matching of Common Name and DNS SAN...

Astra Linux – Vulnerability in pgpool2

Information disclosure vulnerabilities exist in Pgpool-II versions 4.4.0 to 4.4.1 4.4 series, 4.3.0 to 4.3.4 4.3 series, 4.2.0 to 4.2.11 4.2 series, 4.1.0 to 4.1.14 4.1 series, 4.0.0 to 4.0.21 4.0 series, all versions of the 3.7 series, all versions of the 3.6 series, all versions of the 3.5...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

Hardware logic with insecure de-synchronization in IntelR DSA and IntelR IAA for some IntelR 4th or 5th generation XeonR processors may allow an authorized user to potentially enable escalation of privilege local access...

Astra Linux – Vulnerability in curl

There is an authentication bypass vulnerability in libcurl version 8.0.0, particularly in the FTP connection reuse feature. This vulnerability can cause incorrect credentials to be used during subsequent transfers. Previously created connections are retained in a connection pool for reuse if they...

Astra Linux – vulnerability in curl

A authentication bypass vulnerability exists in libcurl versions 8.0.0 within the connection reuse feature. This allows connections previously established to be reused under incorrect user permissions, due to a failure to verify any changes in the CURLOPTGSSAPIDELEGATION option. The vulnerability...

Astra Linux – vulnerability in Erlang

In Erlang/OTP versions prior to 23.3.4.15, 24.x prior to 24.3.4.2, and 25.x prior to 25.0.2, there is a Client Authentication Bypass that occurs under certain client-certification scenarios for SSL, TLS, and DTLS...