CVE-2024-31217

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause ...

Azure Storage Movement Client Library Denial of Service Vulnerability

Azure Storage Movement Client Library Denial of Service Vulnerability...

Mattermost: Posts sent via websockets aren't sanitized properly

The posts sent via websockets in the Mattermost application were not properly sanitized, allowing attackers to inject malicious content. The vulnerability enabled the creation of customized permalink embeds and YouTube embeds with arbitrary content, which could lead to denial-of-service issues an...

CVE-2024-36732

CVE-2024-36732 affects OneFlow-Inc. Oneflow v0.9.1 where processing an empty array with oneflow.tensordot can trigger a Denial of Service. The linked sources across NVD/Red Hat/CNNVD/PT Security detail the same issue without providing a patched version or explicit exploit details. The precise roo...

CVE-2024-36742

An issue in the oneflow.scatternd parameter OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service DoS when index parameter exceeds the range of shape...

RHEL 4 : iputils (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - iputils: denial of service vulnerability in ping CVE-2010-2529 Note that Nessus has not tested for this issue but h...

RHEL 8 : pcs (RHSA-2024:3431)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3431 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: rubygem-rack: Denial ...

CVE-2024-34952

taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata function at /src/ncmcrypt.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted .ncm file...

PT-2024-4720 · Microsoft · Net Core

Name of the Vulnerable Software and Affected Versions: .NET Core versions affected versions not specified Description: The issue is related to an incorrect restriction of directory path names in the .NET Core software component "Сервис обновлений". This could allow a remote attacker to gain read...

Microsoft Windows CNG Key Isolation Service 资源管理错误漏洞

Microsoft Windows is a suite of operating systems used by Microsoft Corporation USA for personal devices. A resource management error vulnerability exists in Microsoft Windows CNG Key Isolation Service. The following products and editions are affected: Windows 10 Version 1809 for 32-bit...

PT-2024-3576 · Microsoft · Windows Routing/Remote Access Service +1

Name of the Vulnerable Software and Affected Versions: Windows Routing and Remote Access Service RRAS affected versions not specified Description: The issue is related to numerical truncation errors in the Windows Routing and Remote Access Service RRAS. It allows remote attackers to execute...

Microsoft Windows Routing and Remote Access Service 安全漏洞

Microsoft Windows Routing and Remote Access Service is a network service from Microsoft Corporation USA that is used to implement features such as network routing, virtual private networks VPNs, and dial-up connections. A security vulnerability exists in Microsoft Windows Routing and Remote Acces...

GHSA-G49Q-JW42-6X85 thelounge may publicly disclose of all usernames/idents via port 113

Per RFC 1413, The unique identifying tuple includes not only the ports, but also the both addresses. Without the addresses, the information becomes both non-unique and public: - If multiple connections happen to use the same local port number which is possible if the addresses differ, the usernam...

RLSA-2024:1939 Low: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.10.0. Security Fixes: Mozilla: Denial of Service using HTTP/2 CONTINUATION frames CVE-2024-3302 For more details about the security issues, including the impact, a CVSS score,...

PT-2024-18772 · Unknown · Sveservice

Name of the Vulnerable Software and Affected Versions: SveService versions prior to SMR May-2024 Release 1 Description: The issue is related to a use after free vulnerability that allows local privileged attackers to cause memory corruption. Recommendations: For versions prior to SMR May-2024...

CVE-2024-34483

OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via OFPBucket.len=0...

CVE-2023-50205

D-Link G416 awsfile chmod Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-37317

D-Link DAP-2622 DDP Set IPv6 Address Primary DNS Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-35756

D-Link DAP-2622 DDP Set Date-Time Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this...

CVE-2023-50199 D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability

D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The...