Cisco Firepower Threat Defense Software TCP Snort 3 Detection Engine Bypass Vulnerability

A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system. Devices that are configured with Snort 2 are no...

PT-2024-7507 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A logic error in the interaction between the TCP Intercept feature and the Snort 3 detection engine could allow an unauthenticated, remote attacker to...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Ubuntu 24.10 : cups-browsed vulnerability (USN-7042-3)

The remote Ubuntu 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7042-3 advisory. USN-7042-2 released an improved fix for cups-browsed. This update provides the corresponding update for Ubuntu 24.10. Tenable has extracted the preceding description...

OPENSUSE-SU-2024:14416-1 libopenssl-3-devel-3.1.4-15.1 on GA media

These are all security issues fixed in the libopenssl-3-devel-3.1.4-15.1 package on the GA media of openSUSE Tumbleweed...

JVN#31982676: MUSASI version 3 performing authentication on client-side

MUSASI provided by NEUMANN CO.LTD. is an e-learning system for driving schools. MUSASI version 3 performs authentication within the client-side code CWE-603, and the client in pre-authentication state retrieves the credential information from the server just when a user ID is input. This behavior...

openSUSE: Security Advisory for the Linux Kernel (Live Patch 3 for SLE 15 SP6) (SUSE-SU-2024:3708-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-32149 affecting package cni for versions less than 1.1.2-3

CVE-2022-32149 affecting package cni for versions less than 1.1.2-3. A patched version of the package is available...

AZL-50629 CVE-2024-9676 affecting package skopeo for versions less than 1.14.4-3

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...

Ubuntu: Security Advisory (USN-7014-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in shmam-mw-test-3-test-package-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b51f76988cbf6f57115b148f6bc499d56997dcb2eef0257e563fffbef11fd982 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2015-3207

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes...

CVE-2024-49214

A flaw was found in HAProxy's QUIC listener. This vulnerability can allow an attacker to bypass the IP allow/block list via a spoofed IP address in a 0-RTT session. The attacker could exploit this by obtaining a TLS session ticket using their real IP, then initiating a 0-RTT session with a spoofe...

PT-2024-32322 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 15.13.99.40 Tuleap Enterprise Edition versions prior to 15.13-3 Tuleap Enterprise Edition versions prior to 15.12-6 Description: Tuleap is a tool for end to end traceability of application and system...

Ubuntu 14.04 LTS / 18.04 LTS : PostgreSQL vulnerability (USN-6968-3)

The remote Ubuntu 14.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6968-3 advisory. USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and PostgreSQL-16. This update provides the corresponding updates for PostgreSQL-9.3 i...

Ubuntu 14.04 LTS : nginx vulnerability (USN-7014-3)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7014-3 advisory. USN-7014-1 fixed a vulnerability in nginx. This update provides the corresponding update for Ubuntu 14.04 LTS. Tenable has extracted the preceding description blo...

CVE-2024-45403 H2O assertion failure when HTTP/3 requests are cancelled

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, th...

CVE-2024-45403 H2O assertion failure when HTTP/3 requests are cancelled

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, th...

CVE-2024-45403

CVE-2024-45403 affects the H2O HTTP server when configured as a reverse proxy. The issue is an assertion failure caused by cancelled HTTP/3 requests, enabling a denial-of-service attack. By default, the standalone H2O server restarts automatically, which mitigates impact, but concurrent requests ...

CVE-2024-45403

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, th...