Moderate: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

com.ascentstream.pulsar:pulsar-io-debezium-mysql (>=2.10.6.9, <=2.10.7.4), io.debezium:debezium-microbenchmark (1.7.2.final) +2 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (1.7.2.final)

io.debezium:debezium-connector-mysql MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - com.ascentstream.pulsar:pulsar-io-debezium-mysql =2.10.6.9, =2.10.0.0-rc2, =2.10....

io.debezium:debezium-microbenchmark (0.8.2), org.apache.pulsar:pulsar-io-debezium (>=2.3.0, <=2.3.2) +1 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (0.8.2)

io.debezium:debezium-connector-mysql MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - io.debezium:debezium-microbenchmark 0.8.2 - org.apache.pulsar:pulsar-io-debezium =2.3.0...

com.ascentstream.pulsar:pulsar-io-debezium-core (>=2.10.6.9, <=2.10.7.4), com.ascentstream.pulsar:pulsar-io-debezium-mongodb (>=2.10.6.9, <=2.10.7.4) +37 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.7.2.final)

io.debezium:debezium-core MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - com.ascentstream.pulsar:pulsar-io-debezium-core =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9,...

io.debezium:debezium-microbenchmark (0.9.2.final), org.apache.pulsar:pulsar-io-debezium-mysql (>=2.4.0, <=2.4.2) potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (0.9.2.final)

io.debezium:debezium-connector-mysql MAVEN version 0.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - io.debezium:debezium-microbenchmark 0.9.2.final -...

io.debezium:debezium-microbenchmark (1.7.0.final), io.streamnative:pulsar-io-debezium-mysql (>=2.9.0.0-rc-1, <=2.10.0-rc-202111052205) +3 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (1.7.0.final)

io.debezium:debezium-connector-mysql MAVEN version 1.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - io.debezium:debezium-microbenchmark 1.7.0.final -...

io.streamnative:pulsar-io-debezium-mssql (>=2.9.1.1, <=2.10.0-rc-2021121511380612), org.apache.camel.springboot:camel-debezium-sqlserver-starter (>=3.14.0, <=3.14.10) +7 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.7.1.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.7.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - io.streamnative:pulsar-io-debezium-mssql =2.9.1.1, =3.14.0, =3.14.0,...

com.ververica:flink-connector-sqlserver-cdc (>=2.4.0, <=3.0.1), io.cdap.delta:sqlserver-delta-plugins (0.10.0) +2 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.9.7.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - com.ververica:flink-connector-sqlserver-cdc =2.4.0, =0.1.0,...

com.ascentstream.pulsar:pulsar-io-debezium-mssql (>=2.10.6.9, <=2.10.7.4), io.streamnative:pulsar-io-debezium-mssql (>=2.10.0.0-rc2, <=2.11.4.3-22cb86) +1 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (1.7.2.final)

io.debezium:debezium-connector-sqlserver MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-sqlserver and may be impacted: - com.ascentstream.pulsar:pulsar-io-debezium-mssql =2.10.6.9, =2.10.0.0-rc2...

CVE-2024-4311

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-4311 Lack of login attempt rate-limiting in zenml-io/zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

CVE-2024-4311

ZenML 0.56.4 is affected by CVE-2024-4311 due to no rate-limiting on the password-change flow, enabling brute-forcing of the current password via /api/v1/current-user and potentially taking over the user account. Affected component: password update function. Impact: account takeover with unauthen...

CVE-2024-4311 Lack of login attempt rate-limiting in zenml-io/zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader

A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed...

Security Bulletin: IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component uses third party libraries which is vulnerable to multiple CVEs

Summary IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component uses FlaskCors-4.0.1-py2.py3-none-any.whl, requests-2.31.0-py3-none-any.whl, express-4.19.2.tgz, commons-compress-1.22.jar, commons-io-2.11.0.jar, urllib3-1.26.18-py2.py3-none-any.whl,...

kernel: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags

A vulnerability was found in the Linux kernel's iouring subsystem within the iowq handling functions, where the issue stems from concurrent access to worker-flags, which can lead to data races when multiple tasks manipulate this structure simultaneously, which result in crashes, impacting the...

CVE-2024-51577

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Camunda Services GmbH bpmn.Io allows Stored XSS.This issue affects bpmn.Io: from n/a through 1.0...

PT-2024-34720 · Bpmn Io · Bpmn.Io

Name of the Vulnerable Software and Affected Versions: bpmn.Io versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacker can inject malicious...

UBUNTU-CVE-2024-50225

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix error propagation of split bios The purpose of btrfsbbiopropagateerror shall be propagating an error of split bio to its original btrfsbio, and tell the error to the upper layer. However, it's not working well on some...

CVE-2024-50225 btrfs: fix error propagation of split bios

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix error propagation of split bios The purpose of btrfsbbiopropagateerror shall be propagating an error of split bio to its original btrfsbio, and tell the error to the upper layer. However, it's not working well on some...