requests: subsequent requests to the same host ignore cert verification

An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification...

GHSA-V3VC-6QCV-4VRX Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bug: NULL pointer dereferencing in the kernel, address: 0000000000000020 PGD: 0 P4D 0 Oops: 0000 1 PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ 7 RIP: 0010: icegetqcoalesce+0x2e/0xa0 ice RSP:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: flowdissector: Use DEBUGNETWARNONONCE. This issue is easy to reproduce both upstream and in the -stable kernels. Florian Westphal provided the following commit: d1dab4f71d37 “net: add and use skbgethashsymmetricnet". However...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fixed the issue where a tainted pointer was deleted instead of the previously created rules when the flow rule creation failed. This issue occurs when the mlx5lagcreateportseltable function fails to create flow rules...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: A suspicious RCU usage warning was fixed in iptunnelinitflow. There are code paths where the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning 1. The issue was fixed...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT: Fixed the null-ptr-deref in addruleerrflow In the error flow of mlx5tcctentryaddrule, if the ctruleadd callback returns an error, zonerule-attr is used without initialization. This issue was fixed by using attr,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use This fix addresses the issue of missing initialization of extack in flow offload...

Azure Linux 3.0 Security Update: mariadb (CVE-2024-1544)

The version of mariadb installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1544 advisory. - Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular...

CVE-2022-23723

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...

CVE-2022-23457

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...

CVE-2022-36278

Insufficient control flow management in the IntelR Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-33902

Insufficient control flow management in the IntelR Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-13292

In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...

CVE-2024-38371

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been...

CVE-2024-47334

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through = 2.7.1...

CVE-2024-22408

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

Malicious code in flow-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95e93dd23f522075c8f46757a65625424d8ca39a6ecf846cc72b5eef35225347 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1124 Malicious code in flow-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95e93dd23f522075c8f46757a65625424d8ca39a6ecf846cc72b5eef35225347 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OSV-2025-88 Segv on unknown address in ___interceptor_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=393435814 Crash type: Segv on unknown address Crash state: interceptorfree ndpifreeflowdata ndpifreeflow...