CVE-2021-234550

CVE-2021-234550 affects IBM Spectrum Control (versions 5.4.0–5.4.5.2). The issue is a Dojo prototype pollution in setObject that could allow a remote attacker to execute arbitrary code by sending a specially crafted request. IBM lists a fix in Spectrum Control v5.4.6. Other related advisories not...

CVE-2023-47342

CVE-2023-47342 is associated with FFmpeg. Multiple connected advisories report an out-of-bounds/out-of-array access in avformat/rtsp that could enable denial of service or remote code execution in affected FFmpeg versions. Slackware Mageia and MageiaOSV entries reference this CVE in the context o...

CVE-2023-47342

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux 2 : golang (ALAS-2024-2388)

The version of golang installed on the remote host is prior to 1.20.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2388 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

LinkedIn: Employee-only Area Bypass

An improper access control issue allowed unauthorized access to an employee-only area, leading to information disclosure...

CVE-2023-50569

DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2023-50250. Reason: This record is a reservation duplicate of CVE-2023-50250. Notes: All CVE users should reference CVE-2023-50250 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2023:4931-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4931-1 advisory. Update to version 1.21.5.1: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20-openssl (SUSE-SU-2023:4930-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4930-1 advisory. Update to version 1.20.12.1: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses...

CVE-2023-50459

CVE-2023-50459 corresponds to a Broken Access Control issue in the TYPO3 extension femanager (in2code). The connected advisories identify the vulnerable components as the check_edit_user component (improper access checks) and a missing backend access check, enabling an authenticated frontend user...

CVE-2021-44910

CVE-2021-44910 is described in the NUCLEI template as an information-leak issue in the SpringBlade framework. The root cause is a default SIGN_KEY used for JWT signing, which can be exploited to forge tokens and access sensitive data (e.g., user credentials, password hashes, and logs) within Spri...

CVE-2023-50462

The connected sources confirm CVE-2023-50462 corresponds to an Insecure Direct Object Reference (IDOR) in the TYPO3 extension Content Consent (content_consent). Root cause: the extension fails to verify whether a requested content element identifier is permitted, allowing unauthenticated users to...

CVE-2023-50461

CVE-2023-50461 corresponds to a TYPO3 Direct Mail extension vulnerability. The Direct Mail backend’s Configuration module allows an authenticated backend user to write arbitrary TSConfig for folders configured as Direct Mail, which can lead to Configuration Injection and Arbitrary Code Execution....

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4708-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4708-1 advisory. Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// sche...

CVE-2023-43020

CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...

CVE-2021-26292

The CVE-2021-26292 entry maps to AfterLogic Aurora and WebMail Pro

MGASA-2023-0323 Fix u-boot reading file would overwrite reserved memory error

U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...

Fix u-boot reading file would overwrite reserved memory error

U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...