31069 matches found
Updated golang packages fix security vulnerability
CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...
MGASA-2024-0124 Updated varnish packages fix security vulnerability
Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 and before 6.0.13 LTS, and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack. CVE-2024-30156...
CVE-2024-30390 Junos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforced
An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited Denial of Service DoS to the management plane. When an incoming connection was blocked because it exceeded the...
Sensitive Data Exposure
github.com/kopia/kopiais vulnerable to Sensitive Data Exposure. This vulnerability is due to the "repository status" CLI command with JSON output containing sensitive storage connection credentials which are inadvertently exposed to the console...
OESA-2024-1392 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: Fix memory leak in dvbmediadevicefree dvbmediadevicefree is leaking memory. Free dvbdev-adapter-conn before setting it to NULL, as documented in...
ROS-20240412-02
A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection negotiation process and remove an arbitrary number of SSH service messages. during the connection negotiation process and cause an arbitrary number of SSH service...
Advisory ROSA-SA-2024-2394
Software: spice 0.14.3 OS: ROSA Virtualization 2.1 packageevrstring: spice-0.14.3-4.rv3 CVE-ID: CVE-2021-20201 BDU-ID: 2022-05884 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the SPICE remote virtual desktop rendering system is associated with significantly less resource consumption at the clie...
Denial Of Service (DoS)
Node.js is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of HTTP/2 CONTINUATION frames, where sending a small amount of HTTP/2 frames packets can cause data to be left in nghttp2 memory after a reset, leading to a race condition when the Http2Session destructo...
Broke Window Attack
Varnish Cache, Varnish Enterprise is vulnerable to a Broke Window Attack. The vulnerability is due to exhaustion of credits for an HTTP/2 connection control flow window...
Security Bulletin: Improper integrity checking might affect IBM Storage Defender – Resiliency Service (CVE-2024-27261)
Summary IBM Storage Defender – Resiliency Service is vulnerable and that can result in data integrity issues. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-27261 DESCRIPTION: IBM Storage Defender - Resiliency Service could allow a privileged user to install a...
UBUNTU-CVE-2021-47199
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts CT clear action offload adds additional mod hdr actions to the flow's original mod actions in order to clear the registers which hold ctstate. When such flow also...
Vulnerabilities fixed in Micorosft SQL Server
Microsoft has fixed vulnerabilities in SQL Server. The vulnerabilities are located in the various ODBC and OLE DB drivers and allow a malicious party to execute arbitrary code execute application privileges, potentially gaining access gain access to sensitive data. Successful abuse requires the...
CVE-2023-6964
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadenceimportgetnewconnectiondata' AJAX action. This makes it possible for authenticated attackers, with...
Apache Zeppelin remote code execution by adding malicious JDBC connection string
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...
CVE-2024-28901
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-28902
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-28902
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-26255
Windows Remote Access Connection Manager Information Disclosure Vulnerability...