Discourse Security Breach

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email and chat room features. Discourse suffers from a security vulnerability that stems from the fact that moderators who review users using a moderation queue may be able to se...

PT-2024-37512

Name of the Vulnerable Software and Affected Versions: github.com/google/nftables version 0.1.0 Description: The issue arises from IP addresses being encoded in the wrong byte order, resulting in an nftables configuration that does not work as intended. This could lead to either blocking or not...

CVE-2022-25477

Vulnerability in Realtek RtsPer driver for PCIe Card Reader RtsPer.sys before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader RtsUer.sys before 10.0.22000.31274 leaks driver logs that contain addresses of kernel mode objects, weakening KASLR...

Moderate: Red Hat Security Advisory: go-toolset security update

An update for go-toolset is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...

Moderate: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2022-25477

Vulnerability in Realtek RtsPer driver for PCIe Card Reader RtsPer.sys before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader RtsUer.sys before 10.0.22000.31274 leaks driver logs that contain addresses of kernel mode objects, weakening KASLR...

Realtek RtsPer driver for PCIe Card Reader and Realtek RtsUer driver for USB Card Reader Security Vulnerabilities

Realtek RtsPer driver for PCIe Card Reader and Realtek RtsUer driver for USB Card Reader are both a card reader driver from Realtek Semiconductor Realtek of China. A security vulnerability exists in Realtek RtsPer driver for PCIe Card Reader and Realtek RtsUer driver for USB Card Reader. An...

ALSA-2024:4212 Moderate: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24790 For more details about the security...

traefik -- Bypassing IP allow-lists via HTTP/3 early data requests

The traefik authors report: There is a vulnerability in Traefik that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses...

Apache HTTP Server 安全漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server that can be exploited by an attacker to map URLs to file system locations th...

Apache HTTP Server 输入验证错误漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An input validation error vulnerability exists in Apache HTTP Server, which can be exploited by an attacker to cause insecure...

The vulnerability of the `filter_var` function in the PHP programming language allows attackers to replace URLs with erroneous data.

The vulnerability of the filtervar function in the PHP programming language is related to insufficient validation of data authenticity. Exploiting this vulnerability could allow an attacker to substitute URLs with erroneous data remotely...

PT-2024-28059 · Unknown · Zksync Era

Name of the Vulnerable Software and Affected Versions: ZKsync Era versions prior to 1.5.0 Description: ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. The issue arises from possible invalid stack access due to the addresses used to access the stack not properly...

October CMS Security Breach

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS prior to version 3.5.15, which stems from the possibility that the PageFinder framework may redirect to untrusted URLs...

UBUNTU-CVE-2024-6285

Integer Underflow Wrap or Wraparound vulnerability in Renesas arm-trusted-firmware. An integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses...

Medium: golang

Issue Overview: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip...

Amazon Linux 2 : golang (ALAS-2024-2576)

The version of golang installed on the remote host is prior to 1.22.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2576 advisory. The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip...

PT-2024-37513 · Renesas +1 · Arm Trusted Firmware +1

Name of the Vulnerable Software and Affected Versions: Renesas arm-trusted-firmware affected versions not specified Description: The issue is related to an integer underflow in image range check calculations, which could allow bypassing address restrictions and loading images to unallowed...

SUSE CVE-2021-47607

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg The implementation of BPFCMPXCHG on a high level has the following parameters: .-old-val .-new-val BPFR0 = cmpxchg32,64DSTREG + insn-off, BPFR0, SRCREG -mem-loc...