dovecot: using a large number of address headers may trigger a denial of service

A flaw was found in Dovecot. Processing a large number of address headers From, To, Cc, Bcc, etc can be excessively CPU intensive. This flaw allows a remote attacker to trigger a denial of service...

kernel: udp: do not accept non-tunnel GSO skbs landing in a tunnel

CVE-2024-35884 highlights a flaw in the Linux kernel's handling of UDP packets when Generic Receive Offload GRO forwarding is enabled. The issue occurs because non-tunnel UDP packets are sometimes mistakenly processed as if they belong to a tunnel. This can lead to data corruption or kernel...

kernel: firmware: cs_dsp: Validate payload length before processing block

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

The vulnerability of the amazon.aws.ec2_instance configuration management module in Ansible, related to parameter processing errors, allows an attacker to access sensitive data.

The vulnerability of the amazon.aws.ec2instance configuration management module in Ansible is related to an error in parameter processing involving the towercallback. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

The vulnerability of the Leptonica image processing library, related to the lack of checks for division by zero, allows a hacker to trigger a service failure.

The vulnerability of the Leptonica image processing library is related to the lack of checks for division by zero. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created JPEG file...

The vulnerability of the startread() function in the hcom.c component of the SoX sound processing software allows a hacker to cause a service failure.

The vulnerability of the startread function in the hcom.c component of the SoX sound processing program is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows a attacker to cause a service failure using a specially created file...

The vulnerability of the startread() function in the wav.c component of the SoX sound processing program allows a hacker to cause a service failure.

The vulnerability of the startread function in the SoX sound processing component wav.c is related to the lack of checks for division by zero. Exploiting this vulnerability allows a attacker to cause a service failure using a specially created file...

The vulnerability of the lsx_read_w_buf() function in the formats_i.c component of the SoX sound processing program allows a hacker to cause a service failure.

The vulnerability of the lsxreadwbuf function in the formsi.c component of the SoX sound processing program is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to cause a service failure using a specially created file...

ROS-20240923-05

A vulnerability in the interpreter of the software suite for processing, transforming, and generating Ghostscript documents is related to errors in relative directory path handling. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code using a special...

CVE-2024-9079

A vulnerability was found in code-projects Student Record System 1.0 and classified as critical. This issue affects some unknown processing of the file /marks.php. The manipulation of the argument coursename leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2024-9076

CVE-2024-9076 (DedeCMS) affects DedeCMS versions up to 5.7.115. The vulnerability is a command-injection in the article_string_mix.php (or similar) processing path, enabling remote execution due to improper handling of command input. Public exploits/poC are noted, and vendor contact was ineffecti...

LinkedIn Halts AI Data Processing in U.K. Amid Privacy Concerns Raised by ICO

The U.K. Information Commissioner's Office ICO has confirmed that professional social networking platform LinkedIn has suspended processing users' data in the country to train its artificial intelligence AI models. "We are pleased that LinkedIn has reflected on the concerns we raised about its...

BIT-ENVOY-2024-45809 Jwt filter crash in the clear route cache with remote JWKs in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clearroutecache is enabled on the provider; 3. header...

CVE-2024-9031 CodeCanyon CRMGo SaaS show cross site scripting

A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file /project/task/taskid/show. The manipulation of the argument comment leads to cross site scripting. The attack may be initiated remotely...

CVE-2024-9031

CodeCanyon CRMGo SaaS (up to 7.2) has a cross-site scripting flaw in the /project/task/{task_id}/show endpoint triggered by the comment parameter. The issue may be exploited remotely and exploits have been disclosed publicly. Current remediation guidance in the connected docs is to disable access...

File-Unpumper - Tool That Can Be Used To Trim Useless Things From A PE File Such As The Things A File Pumper Would Add

file-unpumper is a powerful command-line utility designed to clean and analyze Portable Executable PE files. It provides a range of features to help developers and security professionals work with PE files more effectively. Features PE Header Fixing : file-unpumper can fix and align the PE header...

CVE-2024-45809

A flaw was found in Envoy. JWT filter will lead to a crash in Envoy when clearing the route cache with remote JWKs in the following cases: 1. Remote JWKs are used, which requires async header processing 2. clearroutecache is enabled on the provider 3. Header operations are enabled in JWT filter,...

[SECURITY] Fedora 39 Update: ruby-3.2.5-183.fc39

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

The vulnerability of the flow processing daemon (flowd) in Juniper Networks’ Junos routers of the SRX4600 and SRX5000 series allows a hacker to circumvent existing security restrictions.

The vulnerability of the flow processing daemon flowd in Juniper Networks’ Junos routers of the SRX4600 and SRX5000 series is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions by...

Moderate: Red Hat Security Advisory: ruby:3.3 security update

An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...