Icinga Web 2 Cross-Site Request Forgery Vulnerability

Icinga Web 2 is a software application.Icinga Web 2 is the next generation open source monitoring web interface, framework and command line interface developed by the Icinga Project to support Icinga 2, Icinga Core and any other IDO database compatible monitoring backend. Icinga Web 2 suffers fro...

Icinga Web 2 Cross-Site Request Forgery Vulnerability

Icinga Web 2 is a software application.Icinga Web 2 is the next generation open source monitoring web interface, framework and command line interface developed by the Icinga Project to support Icinga 2, Icinga Core and any other IDO database compatible monitoring backend. A cross-site request...

AZL-34305 CVE-2024-1312 affecting package kernel for versions less than 5.15.148.2-2

A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the masprevslot function. This issue could allow a local user to crash the system...

CentOS 8 : rhc (CESA-2023:7058)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7058 advisory. - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of...

EulerOS 2.0 SP5 : harfbuzz (EulerOS-SA-2024-1142)

According to the versions of the harfbuzz packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the process of looking...

RHCOS 4 : OpenShift Container Platform 4.12.49 (RHSA-2024:0666)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0666 advisory. - runc: file descriptor leak CVE-2024-21626 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Ubuntu: Security Advisory (USN-6610-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2024-1140)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or...

EulerOS 2.0 SP5 : nginx (EulerOS-SA-2024-1154)

According to the versions of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Ubuntu 18.04 ESM / 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6625-2)

The remote Ubuntu 18.04 ESM / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6625-2 advisory. Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition...

CentOS 8 : linux-firmware (CESA-2023:5245)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:5245 advisory. - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 Not...

Fortinet Fortigate CVE-2023-44487 - Rapid Reset HTTP/2 vulnerability (FG-IR-23-397)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-397 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many...

CentOS 8 : nghttp2 (CESA-2023:5837)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:5837 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wi...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an int as an index for an array. The typechecker allows the usage of...

Security Bulletin: IBM PowerVM Novalink is vulnerable because Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. (CVE-2023-44487)

Summary IBM PowerVM Novalink is vulnerable because Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous HTTP/2 requests and RSTSTREAM frames over multiple streams, a remote attacker could exploit this...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-017)

The version of tomcat installed on the remote host is prior to 8.5.69-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2024-017 advisory. 2024-02-15: CVE-2021-30640 was added to this advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. A...

Amazon Linux 2 : python-jinja2 (ALAS-2024-2436)

The version of python-jinja2 installed on the remote host is prior to 2.7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2436 advisory. Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. I...

Amazon Linux 2 : thunderbird (ALAS-2024-2440)

The version of thunderbird installed on the remote host is prior to 115.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2440 advisory. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitabl...

Amazon Linux 2 : pcre2 (ALAS-2024-2449)

The version of pcre2 installed on the remote host is prior to 10.23-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2449 advisory. Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-010)

The version of kernel installed on the remote host is prior to 5.4.162-86.275. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-010 advisory. 2024-08-27: CVE-2021-47190 was added to this advisory. 2024-08-27: CVE-2021-47184 was added to this advisor...