PT-2025-15373 · Sap · Sap Netweaver +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver and ABAP Platform Application Server ABAP affected versions not specified Description: The issue arises from incorrect memory address handling in ABAP SQL, allowing an authenticated attacker with high privileges to execute...

Linux Distros Unpatched Vulnerability : CVE-2025-1795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also...

Linux Distros Unpatched Vulnerability : CVE-2024-35969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu...

AZL-57893 CVE-2025-27221 affecting package ruby for versions less than 3.3.5-3

In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host...

mctp i2c: handle NULL header address

...

The vulnerability of the NWS_PF_setMacAddrExceptionIP handler of the NetworkingService service in the Mercedes-Benz User Experience (MBUX) system allows a hacker to execute arbitrary commands.

The vulnerability of the NWSPFsetMacAddrExceptionIP handler of the NetworkingService service in the Mercedes-Benz User Experience MBUX system is related to insufficient validation of input data during MAC address processing. Exploiting this vulnerability can allow an attacker to execute arbitrary...

DEBIAN-CVE-2024-53100

In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queuelock lock and destroy Commit 76d54bf20cdc "nvme-tcp: don't access released socket during error recovery" added a mutexlock call for the queue-queuelock in nvmetcpgetaddress. However, the mutexlo...

Fedora 40 : python3.8 (2024-6dedbc5cf9)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6dedbc5cf9 advisory. This is a security release of Python 3.11 ----------------------------------------- Note: The release you're looking at is Python 3.11.10, a securit...

DEBIAN-CVE-2024-43840

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPFTRAMPFCALLORIG When BPFTRAMPFCALLORIG is set, the trampoline calls bpftrampenter and bpftrampexit functions, passing them the struct bpftrampimage im pointer as an argument in R0. The trampoline...

The vulnerability of the SSH service on the SmartOS Wi-Fi router AdTran SRG 834-5 allows a attacker to execute arbitrary operating system commands with root privileges.

The vulnerability of the SSH service on the SmartOS Wi-Fi router AdTran SRG 834-5 is related to the use of pre-installed credentials due to incorrect processing of the MAC address sequence. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the operating syste...

DEBIAN-CVE-2024-38602

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25dev The ax25addrax25dev and ax25devdevicedown exist a reference count leak issue of the object "ax25dev". Memory leak issue in ax25addrax25dev: The reference count of the object...

Ruijie Networks RG-UAC 操作系统命令注入漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. An operating system command injection vulnerability exists in Ruijie Networks RG-UAC version 20240428 and earlier versions,...

DEBIAN-CVE-2024-26733

In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arpreqget. syzkaller reported an overflown write in arpreqget. 0 When ioctlSIOCGARP is issued, arpreqget looks up an neighbour entry and copies neigh-ha to struct arpreq.arpha.sadata. The arpha here is...

The vulnerability of the Rack module in the Ruby programming language lies in the use of a regular expression with high computational complexity, which allows attackers to trigger a service failure.

The vulnerability of the Ruby interpreter’s Rack module is related to the incorrect handling of invalid URL addresses. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Ruby programming language components rfc2396 parser.rb and rfc3986 parser.rb allows a hacker to cause a service failure.

The vulnerability of the Ruby programming language components rfc2396 Parser.rb and rfc3986 Parser.rb is related to the incorrect handling of invalid URL addresses. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

AZL-32314 CVE-2023-26159 affecting package reaper for versions less than 3.1.1-8

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

UBUNTU-CVE-2023-26159

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

The vulnerability of the get_parentControl_list_Info() function in the Tenda AC10 router’s microprogramming software allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the getparentControllistInfo function in the Tenda AC10 router’s microprogramming software is related to the execution of operations outside the buffer in memory when processing the urls parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary co...

The vulnerability of the Squid proxy server is related to improper conversion between numerical types and uncontrolled resource consumption, allowing attackers to cause service failures.

The vulnerability of the Squid proxy server is related to the issue of sending FTP URL addresses in HTTP requests, or creating FTP URL addresses from input data of the FTP Native. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

curl: heap based buffer overflow in the SOCKS5 proxy handshake

A heap-based buffer overflow flaw was found in the SOCKS5 proxy handshake in the Curl package. If Curl is unable to resolve the address itself, it passes the hostname to the SOCKS5 proxy. However, the maximum length of the hostname that can be passed is 255 bytes. If the hostname is longer, then...