CVE-2024-6387-Mitigation

文档标题 - OpenSSH 中 CVE-2024-6387 的缓解指南 简介 本文档概述了缓解 CVE-2024-6387 的步骤，该安全漏洞影响 OpenSSH 8.5p1 至 9.8p1 版本。该漏洞可通过两种方式缓解： 1. 调整 SSH 配置中的 LoginGraceTime 设置，以缩短攻击可利用的时间窗口。 2. 升级到已针对 CVE-2024-6387 打补丁的 OpenSSH 版本（如果此类版本可用且与你的系统兼容）。 缓解方案 1 - 配置 LoginGraceTime LoginGraceTime 参数指定 SSH 客户端成功进行身份验证的时间限制。将该参数设置为 ...

CVE-2026-49365

A flaw was found in the Apache Camel Netty HTTP component. An unauthenticated remote attacker can exploit this vulnerability by sending a malformed request that triggers an exception during route processing. Due to a misconfiguration where muteException is set to false by default, the system...

GHSA-W832-W3P8-CW29 z-push/z-push-dev SQL Injection Vulnerability

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...

CVE-2025-24032

A flaw was found in the pampkcs11 Linux-PAM login module. If the certpolicy is set to none, which is the default value, then pampkcs11 will only check if the user is capable of logging into the token. This flaw allows an attacker to create a different token with the user's public data, for exampl...

GHSA-9J5W-2CQC-CWJ9 Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

From HackerOne report 1948040 by Halit AKAYDIN hltakydn Impact What kind of vulnerability is it? Who is impacted? The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags. Patches Has the problem been patched? What versions should users upgrade to?...

CVE-2021-29478 Vulnerability in the COPY command for large intsets

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. Redis 6.0 and earlier are not directly...

CVE-2019-10082

A read-after-free vulnerability was discovered in Apache httpd, in modhttp2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash. Mitigation This flaw is only exploitable if Apache htt...

UBUNTU-CVE-2017-0450

An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Moderate because it is mitigated by current platform configurations. Product: Android. Versions: N/A...