CVE-2024-47059 Users enumeration - weak password login

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

DEBIAN-CVE-2024-46783

In the Linux kernel, the following vulnerability has been resolved: tcpbpf: fix return value of tcpbpfsendmsg When we cork messages in psock-cork, the last message triggers the flushing will result in sending a skmsg larger than the current message size. In this case, in tcpbpfsendverdict, 'copie...

SUSE CVE-2024-45770

A vulnerability was found in Performance Co-Pilot PCP. This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges...

Triangle Microworks TMW IEC 61850 security vulnerability

The SICAM 8 power automation platform is a universal, hardware and software based, all-in-one solution for all applications in the power sector. the SICAM A8000 RTUs Remote Terminal Units are modular devices for remote control and automation applications in all areas of energy supply. SICAM EGS...

Ubuntu: Security Advisory (USN-7016-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-32780

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description A vulnerability in the Linux kernel has been resolved, specifically in the bonding module. The issue was reported by syzbot and involved unnecessary warnings and logs from the bond xdp get xmit...

USN-7016-1: FRR vulnerability

Iggy Frankovic discovered that FRR incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service...

CVE-2024-8751

creationtimestamp| type| source ---|---|--- 2024-09-13 00:49:14+00:00| seen| https://t.me/cvedetector/5530 2024-09-13 08:39:50+00:00| seen| https://t.me/HackerArsenal/352...

Zabbix universal monitoring system Command Injection

The vulnerability of the Zabbix universal monitoring system lies in the execution of test SMS messages, by providing a specially created phone number, and executing additional AT commands on the modem. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute addition...

Ansible Configuration Management Information Disclosure

The vulnerability of the ansible-connection module in the Ansible Configuration Management system, including Ansible Core, Ansible, and Ansible Base, relates to the disclosure of information in error messages. Exploiting this vulnerability can allow attackers to access confidential data...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE/EE versions prior to 17.0 to...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2024-2374)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ESP-NOW buffer error vulnerability

ESP-NOW is a Wi-Fi communication protocol open-sourced by Espressif Systems. A buffer error vulnerability exists in ESP-NOW versions 2.5.1 and earlier, which stems from a failure to check the addrsnum field when implementing ESP-NOW group type messages, which could lead to memory corruption relat...

PT-2024-29981 · Espressif · Esp-Now

Name of the Vulnerable Software and Affected Versions: ESP-NOW Component affected versions not specified Description: The ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound OOB vulnerability was discovered in the implementation of the ESP-NOW group type...

Shim: out-of-bounds read printing error messages

...

CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

CVE-2024-23184

CVE-2024-23184 affects the Dovecot IMAP/POP3 server. The root issue is that parsing a large number of email address headers (From, To, Cc, Bcc, etc.) is highly CPU-intensive, leading to potential denial of service when attackers send crafted messages that trigger resource exhaustion. The availabl...

Open-Xchange Dovecot security vulnerability

Open-Xchange Dovecot is an open source mail server from the German company Open-Xchange. A security vulnerability exists in Open-Xchange Dovecot that stems from parsing messages with very large headers that can lead to resource exhaustion...

Open-Xchange Dovecot security vulnerability

Open-Xchange Dovecot is an open source mail server from the German company Open-Xchange. A security vulnerability exists in Open-Xchange Dovecot that originates from an external attacker who can send specially crafted messages to consume target system resources and cause an interruption...