Juniper Networks Junos OS and Juniper Networks Junos OS Evolved Security Vulnerabilities

Juniper Networks Junos OS and Juniper Networks Junos OS Evolved are both products of Juniper Networks, Inc.Juniper Networks Junos OS is a network operating system dedicated to the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. Juniper...

FreeBSD : go -- net/http: denial of service due to improper 100-continue handling (b0374722-3912-11ef-a77e-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b0374722-3912-11ef-a77e-901b0e9408dc advisory. The Go project reports: net/http: denial of service due to improper 100-continue handling The net/http...

CVE-2024-24791

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...

GO-2024-2963 Denial of service due to improper 100-continue handling in net/http

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

...

GHSA-869C-J7WC-8JQV Gin mishandles a wildcard at the end of an origin string

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/ is allowed when the intention is that only https://example.com/ should be allowed, and http://localhost.example.com/ is allowed when the intention is...

SUSE SLES15: frr / frr-devel / libfrr0 / libfrr_pb0 / libfrrcares0 / etc (SUSE-SU-2024:2245-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2245-1 advisory. - CVE-2023-38406: Fixed nlri length of zero mishandling, aka 'flowspec overflow'. bsc1216900 - CVE-2023-47235: Fixed a crash on...

OESA-2024-1756 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: url.c in GNU Wg...

PT-2024-9820 · Microsoft · High Definition Audio Bus Driver

Name of the Vulnerable Software and Affected Versions: Microsoft High Definition Audio Bus Driver version 10.0.19041.3636 Description: A mishandling of IRP requests vulnerability exists in the HDAudBus DMA interface of Microsoft High Definition Audio Bus Driver. This vulnerability can be exploite...

CVE-2022-48746

In CVE-2022-48746, the Linux kernel mlx5e bond netevent path incorrectly verified netdev origin: the code only checked for a VF representor and lacked a check that the VF representor was on the same physical device as the bond handling the netevent. The fix adds the missing check and optimizes th...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel due to a null pointer error and memory leak in a function that mishandles the state of a network device...

GPAC Resource Management Error Vulnerability

GPAC is an open source multimedia framework. A resource management error vulnerability exists in GPAC version 2.5-DEV-rev228-g11067ea92-master, which stems from mishandling of related functions, leading to reuse after release...

CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent...

CVE-2024-38428

CVE-2024-38428 affects GNU Wget up to 1.24.5 and is caused by improper handling of semicolons in the userinfo subcomponent of a URI, which can cause data intended for userinfo to be misinterpreted as part of the host. The Connected documents confirm multiple advisories (Brocade SANnav/SANnav v2.x...

Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

CVE-2024-5452 RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

CVE-2024-24789 Mishandling of corrupt central directory record in archive/zip

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...

Improper Input Validation

github.com/ollama/ollama is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of the digest format sha256 with 64 hex digits when getting the model path, which results in the mishandling of the TestGetBlobsPath test cases with fewer than 64 hex digits, more...

GO-2024-2888 Mishandling of corrupt central directory record in archive/zip

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...

RHEL 9 : ghostscript (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ghostscript: dangling pointer in gdevprnopenprinterseekable CVE-2023-46751 Note that Nessus has not tested for this...