3827 matches found
UBUNTU-CVE-2024-51755
Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the isset method is now called after the security check. This is a BC break. This issue has...
PT-2024-34886 · Twig +1 · Twig +1
Name of the Vulnerable Software and Affected Versions: Twig versions prior to 3.11.2 Twig versions prior to 3.14.1 Description: In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and t...
Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations
Summary Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only...
AZL-52254 CVE-2024-51744 affecting package jx for versions less than 3.2.236-21
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
CVE-2024-51744
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52221 CVE-2024-51744 affecting package moby-engine for versions less than 24.0.9-17
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
CVE-2024-51744 Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
CVE-2024-51744 Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
Fedora 39 : glibc (2024-df41d584d0)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-df41d584d0 advisory. Auto-sync with upstream branch release/2.38/master - Add BuildRequires:gzip for compressed character maps and info files. Upstream commit:...
[SECURITY] Fedora 41 Update: python-starlette-0.40.0-1.fc41
Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: =E2=80=A2 A lightweight, low-complexity HTTP web framework. =E2=80=A2 WebSocket support. =E2=80=A2 In-process background tasks. =E2=80=...
The vulnerability of the entry_SYSCALL_compat() function in the Linux operating system’s kernel on the x86 platform allows a hacker to trigger a service failure.
The vulnerability of the entrySYSCALLcompat function in the arch/x86/entry/entry64compat.S module of the Linux operating system’s kernel on the x86 platform is related to an infinite loop. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2024-47700 ext4: check stripe size compatibility on remount as well
In the Linux kernel, the following vulnerability has been resolved: ext4: check stripe size compatibility on remount as well We disable stripe size in ext4fillsuper if it is not a multiple of the cluster ratio however this check is missed when trying to remount. This can leave us with cases where...
Linux kernel 数字错误漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a failure to check for stripe size compatibility when remounting in the ext4 file system...
CVE-2024-21244
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Telemetry. Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
[SECURITY] Fedora 39 Update: rust-nu-protocol-0.96.1-3.fc39
Nushell's internal protocols, including its abstract syntax tree...
Fedora 39 : python-cramjam / rust-async-compression / rust-brotli / etc (2024-8831059030)
The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-8831059030 advisory. Update rust-brotli-decompressor to 4.0.1, rust-brotli to 7.0.0, and rust-async-compression to 0.4.13. Patch dependent packages as needed to avoid compat...
Fedora 40 : python-cramjam / rust-async-compression / rust-brotli / etc (2024-b9fc60e1f0)
The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-b9fc60e1f0 advisory. Update rust-brotli-decompressor to 4.0.1, rust-brotli to 7.0.0, and rust-async-compression to 0.4.13. Patch dependent packages as needed to avoid compat...
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
Impact A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. Patches Please use version 4.0.0 or later github.com/codeclysm/extract/v4. Any previous version is affected by the bug. Workarounds No knows workarounds. Backward compatibility...
Cybercriminals Use Unicode to Hide Mongolian Skimmer in E-Commerce Platforms
Cybersecurity researchers have shed light on a new digital skimmer campaign that leverages Unicode obfuscation techniques to conceal a skimmer dubbed Mongolian Skimmer. "At first glance, the thing that stood out was the script's obfuscation, which seemed a bit bizarre because of all the accented...
