Advisory ROSA-SA-2024-2387

Software: slapi-nis 0.56.6 OS: ROSA Virtualization 2.1 packageevrstring: slapi-nis-0.56.6-2.rv3 CVE-ID: CVE-2021-3480 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: Dereferencing a null pointer during DN binding analysis could allow an unauthenticated attacker to cause the 389-ds-base directory server to...

Medium: rpm

Issue Overview: A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data...

KLA67585 DoS vulnerability in Wireshark

Denial of service vulnerability was found in Wireshark. Malicious users can exploit this vulnerability to cause denial of service. Original advisories wnpa-sec-2024-06 · T.38 dissector crash Related products Wireshark CVE list CVE-2024-2955 critical Solution Update to the latest version Download...

The vulnerability of Dell PowerEdge server BIOS microprogramming software, related to the possibility of buffer overflows, allows attackers to compromise its integrity and accessibility.

The vulnerability of Dell PowerEdge server BIOS microprogramming software is related to the possibility of buffer overflow attacks. Exploiting this vulnerability can allow an attacker to compromise the integrity and availability of the system...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2024-573)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-573 advisory. A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501,...

Oracle Linux 7 : python-cryptography (ELSA-2024-19480)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-19480 advisory. 3.2.1-1.0.1 - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates Orabug: 36143838 Tenable has extracted the preceding description block...

edk2: Buffer overflow in the DHCPv6 client via a long Server ID option

A security flaw was identified in EDK2, the open-source reference implementation of the UEFI specification, involving a buffer overflow vulnerability. This particular weakness enables an unauthorized attacker within the vicinity of the network to transmit a specifically crafted DHCPv6 message...

Important: edk2

Issue Overview: A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERALNAMEcmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to...

U.S. Dept Of Defense: Authentication Bypass on https://███████/

An authentication bypass vulnerability was discovered on https://████████/. By visiting /███████/GxSessionIfc.php, a valid session was created for the user, allowing them to bypass the authentication requirement and access the site...

CVE-2024-27135

A vulnerability in Apache Pulsar allows a malicious authenticated user to perform remote arbitrary code execution on Pulsar's function worker. A successful attack impacts the data integrity and confidentiality, as well as system availability. Pulsar broker is also susceptible to this attack when...

The vulnerability of the `check_stack_slot_within_bounds()` function in the kernel/bpf/verifier.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the checkstackslotwithinbounds function in the kernel/bpf/verifier.c module of the Linux operating system is related to reading memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2021-42373

A flaw was found in BusyBox where it did not properly sanitize certain page arguments, leading to a denial of service. The highest threat from this vulnerability is to system availability...

BIT-WILDFLY-2020-25689

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory OOM issue...

BIT-PYTHON-2020-10735

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int"text", a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits float, decimal, int.frombytes, and int for binary bases 2, 4, 8, 16, and 32 are no...

BIT-SQLITE-2021-20227

A flaw was found in SQLite's SELECT query functionality src/select.c. This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerabilit...

BIT-POSTGRESQL-2020-25694

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportuni...

BIT-PYTHON-2021-3737

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability...

BIT-POSTGRESQL-2020-25695

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest...

BIT-POSTGRESQL-2020-25696

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating...

BIT-NODE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...