RedisRaft Security Vulnerability

RedisRaft is a Redis module from Redis, Inc. A security vulnerability exists in RedisRaft that stems from an ODR violation in the component hiredisAllocFns...

CLSA-2024-1705927642 kernel: Fix of 7 CVEs

netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 - netfilter: nftables: do not allow RULEID to refer to another chain CVE-2022-2586 - netfilter: nftables: do not allow SETID to refer to another table CVE-2022-2586 - netfilter: nftables: prevent OOB access in nftbyteordereval...

PT-2024-40691 · Icu · Icu

Name of the Vulnerable Software and Affected Versions: icu 75 affected versions not specified Description: The issue is related to a stack-buffer-overflow crash in the icu 75::PluralRuleParser::parse function, which is called by icu 75::PluralRules::createRules. This crash occurs due to a write...

CVE-2023-50950

IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709...

IBM QRadar SIEM Information Disclosure Vulnerability

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

Tenda W9 安全漏洞

Tenda W9 is a wireless in-wall access point from Tenda, China. An out-of-bounds write vulnerability exists in Tenda W9 version 1.0.0.7, which is caused by a stack-based buffer overflow in the sysRulenEn parameter of the formAddSysLogRule function. An attacker can exploit this vulnerability to...

PT-2024-1460 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda A15 version 15.13.07.13 Description: A critical issue affects the Web-based Management Interface of the Tenda A15, specifically an unknown part of the file /goform/setBlackRule. The manipulation of the deviceList argument leads to a...

What Is Policy-as-Code

Decoding the Enigma: Policy-as-Code Explained The Information Technology IT sector can often feel like a maze of intricate jargon and theories. A phrase gaining traction in this field is Policy-as-Code PaC. However, what does Policy-as-Code entail? Let's demystify this enigma. Policy-as-Code...

Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2024-008)

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2024-008 advisory. HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive...

CVE-2023-52269

MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators...

CVE-2023-52269: Improper Neutralization of Input During Web Page Generation

MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators...

GHSA-FGWC-3J6W-CH22 easy-rules-mvel vulnerable to remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component mVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

Easy Rules Security Vulnerability

Easy Rules is a Java rules engine from Jeasy open source. A security vulnerability exists in Easy Rules version v4.1.0, which originates from the ability to execute remote code via the component MVELRule...

PT-2023-31594 · Unknown · Easy-Rules-Mvel

Name of the Vulnerable Software and Affected Versions: easy-rules-mvel version 4.1.0 Description: The issue is related to a remote code execution RCE vulnerability via the component MVELRule. This allows for potential exploitation, but specific details about the estimated number of affected devic...

SUSE CVE-2023-5197

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit...

Debian dla-3688 : haproxy - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3688 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3688-1 [email protected] https://www.debian.org/lts/security/...

Microsoft releases lightest Patch Tuesday in three years, no zero-days disclosed

Microsofts monthly security update released Tuesday is the companys lightest in four years, including only 33 vulnerabilities. Perhaps more notable is that there are no zero-day vulnerabilities included in Decembers Patch Tuesday, a rarity for Microsoft this year. The companys regular set of...

PSA: Critical POP Chain Allowing Remote Code Execution Patched in WordPress 6.4.2

WordPress 6.4.2 was released today, on December 6, 2023. It includes a patch for a POP chain introduced in version 6.4 that, combined with a separate Object Injection vulnerability, could result in a Critical-Severity vulnerability allowing attackers to execute arbitrary PHP code on the site. We...

SUSE-SU-2023:4645-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2023-45539: Fixed misinterpretation of a pathend rule with as part of the URI component bsc1217653...