Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a resource leak in ksmbdsessionrpcopen. When ksmbdrpcopen fails, it must call ksmbdrpcidfree to undo the results of ksmbdipcidalloc...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: hns3: do not allow calling hns3nicnetopen repeatedly The function hns3nicnetopen should not be called repeatedly, but there is no checking for this. When performing device reset and setting up traffic channels concurrently,...

Astra Linux – Vulnerability in HAPProxy

A vulnerability related to uncontrolled resource consumption was discovered in HAProxy, which could cause the service to crash. This issue could allow an authenticated remote attacker to run a specially crafted malicious server within an OpenShift cluster. The most significant impact is related t...

Astra Linux – Vulnerability in Jetty9

Eclipse Jetty is a lightweight, highly scalable Java-based web server and Servlet engine. It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class performs insufficient validation on the authority segment of a URI. However, the behavior of HttpURI differs from that of common...

Astra Linux – Vulnerability in Thunderbird

Thunderbird unprotects a secret OpenPGP key before using it for decryption, signing, or key import tasks. If the task fails, the secret key may remain in memory in an unprotected state. This vulnerability affects Thunderbird versions earlier than 78.8.1...

Astra Linux – Vulnerability in aom

It was discovered that AOM v2.0.1 contains a stack buffer overflow issue through the component stats/ratehist.c...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB Server before version 10.7 is vulnerable to Denial of Service attacks. In the file extra/mariabackup/dsxbstream.cc, when an error occurs e.g., streamctxt-destfile == NULL while executing the xbstreamopen method, the held lock is not released properly. This allows local users to trigger a...

Astra Linux – Vulnerability in Tomcat9

Improper handling of exceptional conditions, and uncontrolled resource consumption vulnerabilities in Apache Tomcat. When processing an HTTP/2 stream, Tomcat failed to correctly handle some cases of excessive HTTP headers. This resulted in an incorrect count of active HTTP/2 streams, leading to t...

Astra Linux – Vulnerability in Tomcat9

URL redirection to untrusted sites “open redirect” vulnerability in FORM authentication with Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.0.12, 9.0.0-M1 through 9.0.79, and 8.5.0 through 8.5.92. Older, end-of-life versions...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: lapbether: Fixed an issue with invalid opcode in lapbethopen. If lapbregister fails when the lapb device goes online for the first time, the NAPI is not disabled. As a result, the invalid opcode issue is reported when the la...

Astra Linux – Vulnerability in OVN

A flaw was discovered in Open Virtual Network, where the service monitor MAC does not properly implement rate limiting. This issue could allow an attacker to cause a denial of service, even in deployments with CoPP enabled and properly configured...

Astra Linux – Vulnerability in Linux, Linux 5.10

A race condition was identified in the Linux kernel’s perfeventopen function, which can be exploited by an unprivileged user to gain root privileges. This bug allows for the exploitation of several attack primitives, such as kernel address information leakage and arbitrary execution...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a NULL pointer dereference in ntfsextent inodeopen in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in open-vm-tools

A malicious actor who has been granted “Guest Operation Privileges” https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html can potentially elevate their privileges if the target virtual machine has been assigned a more privileged “Guest Alias...

CVE-2024-57609

Vulnerabilidad de Redirección Abierta en Kanaries Página del Proveedor: https://kanaries.net/ Video de Prueba de Concepto: https://drive.google.com/file/d/1kqfbmx1W6UgSs56gOLOsUFiGcvKrIyW9/view?usp=sharing Guía de Explotación Paso a Paso 1. Ir al Sitio Web Navegue al sitio web de Kanaries. 2...

CVE-2026-89321

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

conftest v0.70.0

Conftest Conftest helps you write tests against structured configuration data. Using Conftest you can write tests for your Kubernetes configuration, Tekton pipeline definitions, Terraform code, Serverless configs or any other config files. Conftest uses the Rego language from Open Policy Agent fo...

Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve

A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to...

CVE-2023-24034

An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...

EUVD-2026-77131

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...