protobuf-java: timeout in parser leads to DoS

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted...

CLSA-2024-1717087024 bind: Fix of CVE-2023-4408

CVE-2023-4408: use hashtable when parsing a message...

CVE-2024-22274

creationtimestamp| type| source ---|---|--- 2024-05-30 09:14:27+00:00| seen| https://t.me/CyberSecurity026/4856 2024-07-06 18:17:25+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7890 2024-07-07 00:00:38+00:00| published-proof-of-concept| https://t.me/RalfHackerChannel/1508...

PT-2024-4750 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207...

CVE-2024-36369

creationtimestamp| type| source ---|---|--- 2024-05-29 18:53:28+00:00| seen| https://t.me/DARKSPOTTEAM/581 2024-05-29 18:53:28+00:00| seen| Telegram/DASdBAzdyFqiCt-TEWD5i84DOJh0xCyfOR9Q3VL29Y...

CVE-2024-36366

creationtimestamp| type| source ---|---|--- 2024-05-29 18:53:28+00:00| seen| https://t.me/DARKSPOTTEAM/581 2024-05-29 18:53:28+00:00| seen| Telegram/DASdBAzdyFqiCt-TEWD5i84DOJh0xCyfOR9Q3VL29Y 2024-06-05 05:59:45+00:00| seen| https://t.me/ZeroEthicalCourse/320...

Updated perl-Email-MIME packages fix security vulnerabilities

An excessive memory use issue CWE-770 exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set from 2020 and 2024 limits excessive depth and the total number of parts. CVE-2024-4140...

Oracle Linux 8 : bind / and / dhcp (ELSA-2024-3271)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3271 advisory. - Speed up parsing of DNS messages with many different names CVE-2023-4408 - Prevent increased CPU consumption in DNSSEC validator CVE-2023-50387...

CVE-2024-22590

The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established...

CVE-2024-22590

The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established...

USN-6790-1 amavisd-new vulnerability

It was discovered that amavisd-new incorrectly handled certain MIME email messages with multiple boundary parameters. A remote attacker could possibly use this issue to bypass checks for banned files or malware...

Information Disclosure

github.com/huandu/facebook is vulnerable to an Information Disclosure vulnerability. The vulnerability is due to the accesstoken being exposed in error messages upon failing HTTP requests, which could allow an attacker with log access to obtain sensitive access tokens by exploiting error messages...

GHSA-G84Q-CQ55-XWGP silverstripe/framework member disclosure in login form

There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue...

CVE-2024-36384

Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages...

CVE-2024-36384

Pointsharp Cryptshare Server versions prior to 7.0.0 are vulnerable to a Cross-site Scripting (XSS) issue (CWE-79) located within the notification messages . This vulnerability allows for the improper neutralization of input during web page generation. To remediate this issue, users are recommend...

CVE-2024-36384

Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages...

Fedora: Security Advisory (FEDORA-2024-032e16360b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-36384: Improper Neutralization of Input During Web Page Generation

Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages...

Fedora: Security Advisory (FEDORA-2024-38fb541a75)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-26397

Name of the Vulnerable Software and Affected Versions github.com/huandu/facebook versions prior to 2.7.2 Description The issue concerns the exposure of access token in error messages when HTTP requests fail. This can occur when the module sends HTTP requests with a query parameter ?access token=...