BIT-MEDIAWIKI-2021-46150

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October...

BIT-MYSQL-CLIENT-2021-46666

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause...

CVE-2024-24784 Comments in display names are incorrectly handled in net/mail

The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...

USN-6678-1: libgit2 vulnerabilities

It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated system were tricked into cloning a specially crafted repository, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.0...

go -- multiple vulnerabilities

The Go project reports reports: crypto/x509: Verify panics on certificates with an unknown public key algorithm Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. net/http: memory exhaustion in...

CentOS 9 : libreswan-4.9-4.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the libreswan-4.9-4.el9 build changelog. - remote DoS via crafted TS payload with an incorrect selector length rhbz2173674 CVE-2023-23009 - pluto in Libreswan before 4.11 allows a...

CVE-2024-26328

An issue was discovered in QEMU 7.1.0 through 8.2.1. registervfs in hw/pci/pciesriov.c does not set NumVFs to PCISRIOVTOTALVF, and thus interaction with hw/nvme/ctrl.c is mishandled...

CVE-2024-26327

An issue was discovered in QEMU 7.1.0 through 8.2.1. registervfs in hw/pci/pciesriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations...

Design/Logic Flaw

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

Summary: CVE-2024-25678 affects the LiteSpeed QUIC (LSQUIC) Library prior to 4.0.4, due to mishandled DCID validation. The issue is tied to the authentication/DCID handling behavior in LSQUIC. Affected software: LiteSpeed QUIC (LSQUIC) Library versions before 4.0.4. Root cause (as stated): Mishan...

CVE-2024-25450

imlib2 v1.9.1 was discovered to mishandle memory allocation in the function initimlibfonts...

PT-2024-11055 · Meinberg · Meinberg Lantime-Firmware +1

Name of the Vulnerable Software and Affected Versions: Meinberg LANTIME-Firmware versions 6.24.029 and earlier Meinberg LANTIME-Firmware versions 7.04.008 and earlier Description: An issue was discovered in the LTOS-Web-Interface where path validation is mishandled. This allows an admin to read o...

SUSE SLES15: erlang / erlang-debugger / erlang-debugger-src / erlang-dialyzer / etc (SUSE-SU-2024:0210-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0210-1 advisory. - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity aka Terrapin Attack bsc1218192 Tenable has extracted...

CVE-2024-22705

A vulnerability was found in ksmbd in the Linux kernel's smb2getdataarealen in fs/smb/server/smb2misc. This flaw allows an attacker to cause an smbstrndupfromutf16 out-of-bounds access due to mishandling the relationship between Name data and CreateContexts data...

CVE-2023-52353

An issue was discovered in Mbed TLS through 3.5.1. In mbedtlssslsessionreset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum...

CVE-2023-52353

An issue was discovered in Mbed TLS through 3.5.1. In mbedtlssslsessionreset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum...

OESA-2024-1089 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...

CVE-2023-44077

Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636...

OESA-2024-1059 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...