CVE-2024-21233

Oracle Database Server Core vulnerability CVE-2024-21233 affects Core in Oracle Database Server versions 19.3–19.24, 21.3–21.15, and 23.4–23.5. The flaw stems from improper authorization in the Database Core Component, enabling a low-privileged attacker with Create Session privilege and network a...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

[SECURITY] [DLA 3920-1] php7.4 security update

Debian LTS Advisory DLA-3920-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 14, 2024 https://wiki.debian.org/LTS Package : php7.4 Version : 7.4.33-1+deb11u6 CVE ID : CVE-2022-4900 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927 CVE-2024-9026 Debian Bug : 10728...

ROS-20241015-16

A vulnerability in the Networking component of Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM for JDK and Oracle Java SE software platform is related to incorrect authorization. Exploitation of the vulnerability could allow an attacker acting remotely to impact data integrity ...

ROS-20241015-05

Nano text editor vulnerability is related to temporary file handling errors. Exploitation exploitation of the vulnerability could allow an attacker to affect data integrity...

ROS-20241015-17

A vulnerability in the Networking component of Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM for JDK and Oracle Java SE software platform is related to incorrect authorization. Exploitation of the vulnerability could allow an attacker acting remotely to impact data integrity ...

ROS-20241015-04

A vulnerability in the Hotspot component of Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM for JDK and Oracle Java SE software platform is related to incorrect resource clearing or release. Exploitation of the vulnerability could allow an attacker acting remotely to cause a...

CVE-2021-20254

...

The vulnerability of the tcp_metrics_nl_policy structure in the Linux operating system’s kernel-based IPv4 protocol allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcpmetricsnlpolicy structure in the net/ipv4/tcpmetrics.c file of the Linux operating system’s IPv4 protocol implementation is related to the lack of checks on the length of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

The vulnerability of the dml2_calculate_rq_and_dlg_params() function in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dml2calculaterqanddlgparams function in the Linux operating system is related to reading memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the ata_host_alloc() function (drivers/ata/libata-core.c) in the Linux ATA driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the atahostalloc function driver/ata/libata-core.c in the Linux ATA driver is related to the repeated release of memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. An attacker with administrative privileges can bypass security measures and impact data integrity by exploiting this vulnerability. Remediation Upgra...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. A low-privileged attacker can bypass security measures and compromise data integrity by exploiting these settings. Remediation Upgrade...

The vulnerability of AI software platforms based on Git for collaborative code development on GitLab allows attackers to compromise data integrity.

The vulnerability of AI-based software platforms built on Git for collaborative code development on GitLab is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

The vulnerability of the add_ra_bio_pages() function in the file system of the Linux operating system’s kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the addrabiopages function in the fs/btrfs/compression.c file of the btrfs file system in the Linux kernel relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CentOS 7 : grub2 (RHSA-2021:0699)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0699 advisory. - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This fla...

The vulnerability of the MX-ONE Provisioning Manager tool, a corporate communication platform from Mitel MiVoice, allows a perpetrator to bypass authentication procedures and compromise the integrity of the protected information.

The vulnerability of the MX-ONE Provisioning Manager PM tool, a component of the corporate communication platform Mitel MiVoice MX-ONE, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to bypass authentication procedures and compromise the...

PHP 安全漏洞

PHP is a scripting language in which PHP is executed server-side. A security vulnerability exists in PHP that stems from incorrectly parsing multipart form data contained in an HTTP POST request could result in legitimate data not being processed, thereby compromising data integrity...

CVE-2024-8925

A flaw was found in PHP's parsing of multipart form data contents, which affects both file and input form data. This may lead to legitimate data not being processed, violating data integrity. For example, if a multipart form data payload contains a valid prefix 'X' of the defined boundary B such...

PHP 环境问题漏洞

PHP is a scripting language for PHP that executes on the server side. A security vulnerability exists in PHP versions prior to 8.1.30, 8.2.24, and 8.3.12, which stems from a flaw in the parsing of the data content of multi-part forms, which could result in legitimate data being left unprocessed,...