aiohttp 3.10.6 < 3.10.11 Memory Leak Vulnerability - Windows

aiohttp is prone to a memory leak vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

Critical Windows Kerberos Flaw Exposes Millions of Servers to Attack

A critical vulnerability in the Windows Kerberos authentication protocol poses a significant risk to millions of servers. Microsoft…...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

Apache Tomcat XSS Vulnerability (Nov 2024) - Windows

Apache Tomcat is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat...

The vulnerability of Siemens SCALANCE and RUGGEDCOM industrial router web servers allows attackers to enhance their privileges.

The vulnerability of Siemens SCALANCE and RUGGEDCOM industrial router web servers lies in the inadequate isolation between user sessions. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2024-3760

In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can exploit this by automating forgot password requests to flood targeted user accounts with a high volume of password reset emails. This not only...

CVE-2024-3760

In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can exploit this by automating forgot password requests to flood targeted user accounts with a high volume of password reset emails. This not only...

CVE-2024-3760 Email Bombing Vulnerability in lunary-ai/lunary

In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can exploit this by automating forgot password requests to flood targeted user accounts with a high volume of password reset emails. This not only...

CVE-2024-3760 Email Bombing Vulnerability in lunary-ai/lunary

In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can exploit this by automating forgot password requests to flood targeted user accounts with a high volume of password reset emails. This not only...

CVE-2024-3760

CVE-2024-3760 concerns lunary-ai/lunary v1.2.7, where the forgot-password page lacks rate limiting, enabling an email bombing vulnerability. The root cause is an unauthenticated, high-volume request path that can flood target user mailboxes and strain mail servers, potentially degrading service a...

ALPINE-CVE-2024-10977

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistake...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is vulnerable to cross-site scripting in the administrative console.

Summary The security issue described in CVE-2024-45087 has been identified in the WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

NetworkManager security update

1.48.10-2.0.1 - disable MPTCP handling by default Orabug: 34801142 - add connectivity check via Oracle servers Orabug: 32051972 1:1.48.10-2 - cloud-setup: Allow bigger restart bursts RHEL-56740 - cloud-setup: Fix Azure swap of primary and secondary IP addresses RHEL-56387 1:1.48.10-1 - Unblock th...

CVE-2024-52010 Zoraxy has an authenticated command injection in the Web SSH feature

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...

Low: Red Hat Security Advisory: cockpit security update

An update for cockpit is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Siemens OZW672和OZW772 跨站脚本漏洞

OZW devices web servers are used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning. A cross-site scripting vulnerability exists in Siemens OZW devices web servers, which can be exploited by an attacker to inject arbitrary JavaScript code...

HPESBHF04750 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01076, UPLR1 - Intel TDX Seamldr Software Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Performance - Prior to v2.2005-29-2024 HPE StoreEasy 1470 Storage - Prior to v2.2005-29-2024 HPE StoreEasy 1570 Performance - Prior to v2.2005-29-2024 HPE...

HPESBHF04741 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01085, UPLR2 - Intel UEFI Firmware Advisory, Local Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Storage - Prior to 2.3008-09-2024 HPE StoreEasy 1470 Performance - Prior to 2.3008-09-2024 HPE StoreEasy 1570 Storage - Prior to 2.3008-09-2024 HPE StoreEasy...

ALSA-2024:9325 Low: cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fixes: cockpit: Authenticated user can kill any process when enabling...

Microsoft DWM Core Library 安全漏洞

Microsoft DWM Core Library is a core library for Microsoft windows from Microsoft Corporation, USA. A security vulnerability exists in the Microsoft DWM Core Library. An attacker can exploit the vulnerability to elevate privileges. The following products and versions are affected:Windows Server...