SUSE CVE-2024-10846

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

AZL-55947 CVE-2024-10846 affecting package docker-compose for versions less than 2.27.0-4

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

compose-go 输入验证错误漏洞

compose-go is a Compose Specification open source reference library for parsing and loading Compose YAML files. A security vulnerability exists in compose-go that stems from an authorized user sending a malicious YAML payload causing compose-go to consume excessive memory and CPU cycles when...

MongoDB Buffer Over-Read Vulnerability (SERVER-96419) - Linux

MongoDB is prone to a buffer over-read vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

UBUNTU-CVE-2024-10921

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to...

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to...

CVE-2024-5918

An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you...

Palo Alto Networks PAN-OS 信任管理问题漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A trust management issue vulnerability exists in Palo Alto Networks PAN-OS that stems from the presence of an incorrect certificate validation vulnerability, which allows an...

MongoDB 安全漏洞

MongoDB is a document-oriented database management system from the American company MongoDB. A security vulnerability exists in MongoDB that originates from an authorized user may be able to trigger a crash or receive an over-read of the server's memory buffer by issuing a specially crafted reque...

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-44082

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data...

CVE-2024-20497

Cisco Expressway Edge (Expressway-E) is affected by an improper authorization vulnerability. An authenticated MRA user can masquerade as another user and potentially intercept calls or spoof caller IDs due to inadequate authorization checks for Mobile and Remote Access users. Exploitation require...

SUSE CVE-2024-6540

Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has be...

CVE-2024-6540 Information exlosure in external interface

Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has be...

CVE-2024-6540 Information exlosure in external interface

Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has be...

OTRS Security Vulnerabilities

OTRS is a software application from the German company OTRS. A service management software. A security vulnerability exists in OTRS that stems from improper field filtering, which could allow an authorized user to download work order lists that contain information about other customers' work orde...

PT-2024-28729 · Thruk · Thruk

Name of the Vulnerable Software and Affected Versions: Thruk versions prior to 3.16 Description: This issue allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the url...

Command Injection

github.com/cea-hpc/sshproxy is vulnerable to Command Injection. The vulnerability is due to missing input santization when constructing the ssh command string, which allows an authorized user to inject options into the ssh command executed by sshproxy...

PT-2024-12304 · Amc2-2Wcf +1 · Amc2-2Wcf +1

Name of the Vulnerable Software and Affected Versions: AMC2-4WCF and AMC2-2WCF affected versions not specified Description: The issue is related to a firmware bug that may cause misinterpretation of data, allowing an adversary to grant access to the last authorized user. Recommendations: At the...