Medium: python-idna

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-idna Issue Correction: Run dnf update python-idna --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-763 --releasever...

Fedora 41 : python-django4.2 (2024-b08735561c)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b08735561c advisory. urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Tenable has extract...

Fedora 41 : python-django (2024-396c94f0a3)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-396c94f0a3 advisory. urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Tenable has extract...

CVE-2024-46890

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code...

Reliance On Untrusted Inputs In A Security Decision

Sinatra is vulnerable to Reliance on Untrusted Inputs in a Security Decision. The vulnerability is due to improper handling of the X-Forwarded-Host header via the X-Forwarded-Host header, allowing attackers to exploit Open Redirect Attacks, Cache Poisoning, or Routing-based SSRF through untrusted...

SQL Injection

langchain-ai/langchain is vulnerable to SQL injection. The vulnerability is due to insufficient input validation in the GraphCypherQAChain class, which allows user-controlled inputs to be embedded in SQL queries without proper sanitization...

WordPress plugin Postcasa Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

SUSE CVE-2023-50570

An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs...

PT-2024-34858 · Saragna · Saragna

Name of the Vulnerable Software and Affected Versions: Saragna versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For Saragna...

Regular Expression Denial Of Service (ReDoS)

rexml is vulnerable to a Regular Expression Denial of Service ReDoS vulnerability. The vulnerability is due to inefficient regular expression handling when parsing XML inputs that contain a large number of digits in hex numeric character references &x...;, allows an attacker to craft inputs that...

SUSE CVE-2024-21510

Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...

CVE-2024-51560

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message...

CVE-2024-51560

The CVE-2024-51560 issue affects Wave 2.0, stemming from improper exception handling for invalid inputs in a specific API endpoint that processes the userId parameter. An authenticated remote attacker could trigger error messages that leak sensitive information about the targeted system. Document...

CVE-2024-51560 Improper Error Handling Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message...

CVE-2024-23386

memory corruption when WiFi display APIs are invoked with large random inputs...

CVE-2024-23386

CVE-2024-23386 is a memory corruption vulnerability in WiFi Display API handling; when these APIs process large random inputs, a vulnerability arises. The issue is described across multiple sources as affecting Qualcomm chipsets, with the root cause being improper handling of large inputs leading...

Node.js: Improper error handling in async cryptographic operations crashes process

The C++ method SignTraits::DeriveBits incorrectly called ThrowException based on user-supplied inputs when executing in a background thread, crashing the Node.js process...

GO-2024-3244 Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark

Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark...

Medium: python-idna

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-idna Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Medium: python-idna

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-idna Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...