golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

ROS-20240626-14

Vulnerability of REFRESH MATERIALIZED VIEW CONCURRENTLY function of PostgreSQL database management system is related to privilege management errors in processing and checking command line parameters. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary SQ...

Malicious code in Stl.CommandLine.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2612 Malicious code in line-configs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in line-configs (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2479 Malicious code in historic-rates-line-chart (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in historic-rates-line-chart (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in eslint-disable-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4badfe1d87068f4cc3cb6bd441258d5caebd50c951f1e4c1ec43729eb79a08d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-2325 Malicious code in eslint-disable-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4badfe1d87068f4cc3cb6bd441258d5caebd50c951f1e4c1ec43729eb79a08d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DoS)

ZenML is vulnerable to a Denial Of Service DoS. The vulnerability is due to improper handling of line feed \n characters in component names, allowing an attacker to cause uncontrolled resource consumption by adding a component through an API endpoint api/v1/workspaces/default/components...

PT-2024-6532 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 21.4R3 through 21.4R3-S5 Junos OS versions 22.1R3 through 22.1R3-S4 Junos OS versions 22.2R2 through 22.2R3 Junos OS versions 22.3R1 through 22.3R2-S2, 22.3R3 Junos OS versions 22.4R1 through 22.4R2 Description: An Improper...

Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

LINE client for iOS vulnerable to universal cross-site scripting

Overview The in-app browser of LINE client for iOS provided by LY Corporation contains a universal cross-site scripting vulnerability CWE-79, CVE-2024-5739. LY Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact If a user clicks a malicious...

PT-2024-31195

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.3 Description A denial of service issue exists due to improper handling of line feed characters in component names. When a low-privileged user adds a component through the API endpoint...

The vulnerability of the Command Line Interface (CLI) of the Cisco Crosswork Network Services Orchestrator software environment allows a malicious actor to escalate their privileges.

The vulnerability of the command-line interface CLI of the Cisco Crosswork Network Services Orchestrator software environment relates to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root user by sending a specially...

Military-themed Email Scam Spreads Malware to Infect Pakistani Users

Cybersecurity researchers have shed light on a new phishing campaign that has been identified as targeting people in Pakistan using a custom backdoor. Dubbed PHANTOMSPIKE by Securonix, the unknown threat actors behind the activity have leveraged military-related phishing documents to activate the...

CVE-2024-31890

IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system. IBM X-Force ID: 288171...

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

Debian dla-3838 : composer - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3838 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3838-1 [email protected]...

[SECURITY] [DLA 3838-1] composer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3838-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb June 19, 2024 https://wiki.debian.org/LTS -...