Node.js: "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash

A vulnerability was discovered in the Node.js HTTP/2 stack http2 package. An attacker could send a small amount of TCP packets with HTTP/2 frames, causing the Node.js server to crash due to an assertion failure in the Http2Session destructor. The issue occurred when headers with HTTP/2 CONTINUATI...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling...

Xitami 2.5 Denial Of Service

!/usr/bin/perl use IO::Socket::INET; Exploit Title: Xitami 2.5 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 14 january 2024 Vendor Homepage: https://imatix-legacy.github.io/xitami.com/ Download to demo:...

CVE-2023-46218 affecting package curl for versions less than 8.5.0-1

CVE-2023-46218 affecting package curl for versions less than 8.5.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-49284 affecting package fish for versions less than 3.6.2-1

CVE-2023-49284 affecting package fish for versions less than 3.6.2-1. An upgraded version of the package is available that resolves this issue...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This co...

Security Bulletin: Vulnerability CVE-2023-44487 in Go related packages may affect IBM CICS TX Standard

Summary Vulnerability CVE-2023-44487 in Go related packages may affect IBM CICS TX Standard. IBM CICS TX Standard has addressed the applicable issue. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling...

PT-2024-1137

Name of the Vulnerable Software and Affected Versions Relax-and-Recover aka ReaR versions 2.7 and earlier Description The issue is related to information disclosure. It allows local attackers to gain access to system secrets that are otherwise only readable by root. This occurs when using GRUB...

Ubuntu: Security Advisory (USN-6562-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:0090-1 Security update for gstreamer-plugins-rs

This update for gstreamer-plugins-rs fixes the following issues: - CVE-2022-31394: Fixed a potential denial of service in the HTTP/2 implementation bsc1208556...

AZL-35134 CVE-2024-22195 affecting package python-jinja2 for versions less than 3.1.2-2

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...

[SECURITY] Fedora 38 Update: python2.7-2.7.18-37.fc38

Python 2 is an old version of the language that is incompatible with the 3.x line of releases. The language is mostly the same, but many details, especial ly how built-in objects like dictionaries and strings work, have changed considerably, and a lot of deprecated features have finally been...

[SECURITY] Fedora 39 Update: python2.7-2.7.18-37.fc39

Python 2 is an old version of the language that is incompatible with the 3.x line of releases. The language is mostly the same, but many details, especial ly how built-in objects like dictionaries and strings work, have changed considerably, and a lot of deprecated features have finally been...

Ubuntu 20.04 LTS : Firefox regressions (USN-6562-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6562-2 advisory. USN-6562-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience...

GitLab Password Reset Account Takeover

This module exploits an account-take-over vulnerability that allows users to take control of a gitlab account without user interaction. The vulnerability lies in the password reset functionality. Its possible to provide 2 emails and the reset code will be sent to both. It is therefore possible to...

Ubuntu: Security Advisory (USN-6541-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.5)

The version of AOS installed on the remote host is prior to 6.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.5 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through...

Upgraded Q -> 2 from #341 [1705001382135]

Judge has assessed an item in Issue 341 as 2 risk. The relevant finding follows: L03: Auction parameters can be changed during an auction --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #530 [1705001094273]

Judge has assessed an item in Issue 530 as 2 risk. The relevant finding follows: QA-04 owner of AuctionHouse should not be allowed to change parameters for the ongoing auction --- The text was updated successfully, but these errors were encountered: All reactions...

Ubuntu 16.04 ESM / 18.04 ESM : OpenSSH vulnerabilities (USN-6560-2)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6560-2 advisory. USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...