ROS-20240329-10

Vulnerability of http2 package of Go programming language is related to uncontrolled server resources consumption as a result of resetting Server.MaxConcurrentStreams parameter during request stream processing. as a result of resetting the Server.MaxConcurrentStreams parameter when processing a...

ROS-20240329-01

A vulnerability in the vim text editor is related to improper handling of exceptional conditions. Exploitation of the vulnerability could allow an attacker to cause a denial of service The vim text editor vulnerability is related to an attempt by vim to access an already freed structure window...

The vulnerability of the fromDhcpListClient() function (/goform/DhcpListClient) in the Tenda AC15 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromDhcpListClient function /goform/DhcpListClient in the Tenda AC15 router’s software is related to the operation of writing data beyond the buffer in memory when processing the page parameter. Exploiting this vulnerability could allow an attacker to compromise the...

Advisory ROSA-SA-2024-2380

Software: rpm 4.14.3 OS: ROSA Virtualization 2.1 packageevrstring: rpm-4.14.3-26.rv3 CVE-ID: CVE-2021-3521 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: There is a flaw in RPM's proprietary functionality. OpenPGP connections are bound to the primary key via a "binding signature". RPM does not verify t...

The vulnerability of the Windows Compressed Folder component in Windows operating systems allows attackers to compromise the integrity of protected information.

The vulnerability of the Windows Compressed Folder component in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information through a specially created file...

The vulnerability of the formSetQosBand() function (/goform/SetNetControlList) in the Tenda AC18 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetQosBand function /goform/SetNetControlList of the Tenda AC18 router’s software lies in the fact that the operation’s output goes beyond the buffer in memory when processing the list parameter. Exploiting this vulnerability could allow an attacker to compromise the...

How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

In today's digital-first business environment dominated by SaaS applications, organizations increasingly depend on third-party vendors for essential cloud services and software solutions. As more vendors and services are added to the mix, the complexity and potential vulnerabilities within the Sa...

FriendlyWrt Security Vulnerability

FriendlyWrt is a customized system based on OpenWrt by FriendlyWrt. It is used for enterprise IoT secondary development, personal customization of NAS and so on. A security vulnerability exists in FriendlyWrt version 2022-11-16.51b3d35, which stems from the presence of a plain text key...

The vulnerability of the PowerScale OneFS operating system, related to the use of cryptographic algorithms containing defects, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the PowerScale OneFS operating system is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the microprogrammed software of the wireless modems Hitron CODA-4582 and CODA-4589, related to insufficient entropy due to the default use of PSK, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the microprogrammed wireless modems Hitron CODA-4582 and CODA-4589 relates to insufficient entropy due to the use of default PSKs which are generated from 5-digit hexadecimal values combined using the “Hitron” substring. Exploiting this vulnerability could allow an attacker t...

U.S. Dept Of Defense: Authentication Bypass on https://███████/

An authentication bypass vulnerability was discovered on https://████████/. By visiting /███████/GxSessionIfc.php, a valid session was created for the user, allowing them to bypass the authentication requirement and access the site...

CVE-2024-27135

A vulnerability in Apache Pulsar allows a malicious authenticated user to perform remote arbitrary code execution on Pulsar's function worker. A successful attack impacts the data integrity and confidentiality, as well as system availability. Pulsar broker is also susceptible to this attack when...

The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in HTTP request processing errors, which allow attackers to compromise data integrity.

The vulnerability of cloud-based data storage software from IBM Watson CP4D Data Stores relates to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of data...

The vulnerability of Veritas NetBackup IT Analytics’ data analytics software lies in errors during the verification of cryptographic signatures. This allows attackers to compromise the integrity of the data.

The vulnerability of Veritas NetBackup IT Analytics data analysis software is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

The vulnerability of the `check_stack_slot_within_bounds()` function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the checkstackslotwithinbounds function in the kernel/bpf/verifier.c module of the Linux operating system is related to reading memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the function `of_pwm_single_xlate()` in the drivers/pwm/core.c file of the Linux operating system’s PWM device driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the PWM device driver in the Linux operating system involves reading memory beyond the allocated buffer. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the dlpar_memory_remove_by_index() function in the Linux operating system’s PowerPC PSeries kernel driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dlparmemoryremovebyindex function in the Linux operating system’s PowerPC PSeries kernel memory driver relates to reading memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the sock_orphan() function in Linux operating systems allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the sockorphan function in Linux operating systems exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

PT-2024-6136 · Аврора · Аврора

Name of the Vulnerable Software and Affected Versions: Аврора affected versions not specified Description: The issue is related to a component validation vulnerability in the Аврора operating system, which is caused by the lack of control over public write permissions for installed application...

SUSE CVE-2023-52588

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to tag gcing flag on page during block migration It needs to add missing gcing flag on page during block migration, in order to garantee migrated data be persisted during checkpoint, otherwise out-of-order persistency...