Ivanti Connect Secure Code Execution

The vulnerability of the Ivanti Connect Secure previously Pulse Connect Secure and Ivanti Policy Secure access controls lies in the improper processing of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...

Siemens SINEMA Remote Connect Group Membership Handler Unauthorized Access

The vulnerability of the Group Membership Handler component in the Siemens SINEMA Remote Connect server is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected...

CLSA-2024-1732555216 Fix CVE(s): CVE-2024-52533

SECURITY UPDATE: Buffer overflow due to off-by-one error in gsocks4aproxy.c - debian/patches/CVE-2024-52533.patch: Fix single byte buffer overflow in connect messages due to incorrect calculation in SOCKS4CONNMSGLEN - CVE-2024-52533...

CVE-2024-41761

CVE-2024-41761 : IBM Db2 for Linux/UNIX/Windows (incl. Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial-of-service where a specially crafted query may crash the server. The IBM-connected bulletin confirms this DoS condition and associates a base CVSS of 5.3 (Medium). Affected pr...

CVE-2024-41761 IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query...

CVE-2024-41761: Memory Allocation with Excessive Size Value

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query...

CLSA-2024-1732196856 Fix CVE(s): CVE-2024-52533

SECURITY UPDATE: Buffer overflow - debian/patches/CVE-2024-52533.patch: Fix a single byte buffer overflow in connect messages in gsocks4aproxy - CVE-2024-52533...

CVE-2024-45663: Undefined Security Weakness

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query...

mptcp DoS

The vulnerability of the mptcp component in the Linux operating system’s kernel is related to errors in resource management within the subflowfinishconnect function. Exploiting this vulnerability can allow a attacker to cause a service failure...

Ivanti Neurons OIDC Man-in-the-Middle

The vulnerability of the OpenID Connect OIDC implementation in the IT service management tool Ivanti Neurons for ITSM is related to improper verification of certificates. Exploiting this vulnerability could allow a malicious actor to execute a “man-in-the-middle” attack...

Ivanti Neurons OIDC Unauthorized Access

The vulnerability of the OpenID Connect OIDC implementation of the IT service management tool Ivanti Neurons for ITSM is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

GHSA-2X2G-32R7-P4X8 Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also...

CVE-2024-31141

Apache Kafka Clients (versions 2.3.0 through 3.5.2, 3.6.2, and 3.7.0) are vulnerable to an improper privilege management flaw. The software includes ConfigProvider plugins, specifically FileConfigProvider , DirectoryConfigProvider , and EnvVarConfigProvider , which allow reading from the disk or ...

Siemens SINEMA Remote Connect Privilege Escalation

The vulnerability of the Siemens SINEMA Remote Connect server is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

io.debezium:debezium-microbenchmark (0.8.2), org.apache.pulsar:pulsar-io-debezium (>=2.3.0, <=2.3.2) +1 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (0.8.2)

io.debezium:debezium-connector-mysql MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - io.debezium:debezium-microbenchmark 0.8.2 - org.apache.pulsar:pulsar-io-debezium =2.3.0...

io.debezium:debezium-connect-rest-extension (1.9.0.alpha2), io.debezium:debezium-connector-db2 (1.9.0.alpha2) +22 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.9.0.alpha2)

io.debezium:debezium-core MAVEN version 1.9.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connect-rest-extension 1.9.0.alpha2 - io.debezium:debezium-connector-db2...

com.turbospaces.boot:bootstrap-debezium-core (>=1.0.60, <=1.0.63), io.debezium:debezium-connect-rest-extension (1.8.1.final) +39 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.8.1.final)

io.debezium:debezium-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - com.turbospaces.boot:bootstrap-debezium-core =1.0.60, =1.0.63 -...

io.debezium:debezium-connect-rest-extension (1.9.1.final), io.debezium:debezium-connector-db2 (1.9.1.final) +36 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.9.1.final)

io.debezium:debezium-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connect-rest-extension 1.9.1.final - io.debezium:debezium-connector-db2 1.9.1.fina...

CVE-2024-52512

useroidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0...

Pulse Connect Secure < 22.7R2.1 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.7R2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - Argument injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version...