GHSA-G8M5-722R-8WHQ Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

Impact Remote DOS attack can cause out of memory Description There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote which can be exploited by unauthorized users to cause remote denial-of-service DoS attack. By repeatedly sending crafted requests, attackers can trigger...

CVE-2024-48909 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of...

CVE-2024-48909 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of...

CVE-2024-47831

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Neither t...

CVE-2024-47831

CVE-2024-47831 concerns Next.js image optimization DoS affecting Next.js branches 10.x–14.x prior to 14.2.7. The vulnerability allows high CPU usage under crafted image requests. Public details show remediation in Next.js 14.2.7. Workaround: ensure next.config.js sets either images.unoptimized, i...

CVE-2024-47831 Next.js image optimization has Denial of Service condition

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Neither t...

CVE-2024-47831 Next.js image optimization has Denial of Service condition

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Neither t...

PT-2024-33263 · Unknown · Opencanary

Name of the Vulnerable Software and Affected Versions: OpenCanary versions prior to 0.9.4 Description: OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed...

PT-2024-7156 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise version 9.2.0 through 9.2.3 Splunk Cloud Platform versions prior to 9.2.2403.103 Splunk Cloud Platform versions 9.1.2312.200 through 9.1.2312.110 Splunk Cloud Platform version...

PT-2024-35669

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue occurs when concurrently installing the f2fs.ko module and mounting the f2fs file system, resulting in a null-ptr-deref in the f2fs submit page bio function. This happens becau...

PT-2024-39967 · Newtype · Newtype Webeip

Name of the Vulnerable Software and Affected Versions: NewType WebEIP version 3.0 Description: The issue is related to improper validation of user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters. This results in a Reflected Cross-site...

PT-2024-7164

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6 Description The software potentially exposes sensitive HTTP parameters to the internal index if the REST Calls log...

PT-2024-13539 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions prior to 2024R1 Nagios XI versions prior to 5.11.3 2024R1 Description: The issue is related to the improper handling of API keys generation in Nagios XI, allowing attackers to possibly generate the same set of API keys for...

PT-2024-33057 · Wavelog · Wavelog

Name of the Vulnerable Software and Affected Versions: Wavelog version 1.8.5 Description: The issue is an SQL injection vulnerability in the Activated gridmap model.php file. This vulnerability can be exploited through the band, sat, propagation, or mode variables. Recommendations: For Wavelog...

PT-2024-7169 · Vercel · Next.Js

Name of the Vulnerable Software and Affected Versions: Next.js versions 10.x through 14.x before version 14.2.7 Description: The issue is related to the image optimization feature in Next.js, which contains a vulnerability allowing for a potential Denial of Service DoS condition that could lead t...

SUSE CVE-2024-47165

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

PT-2024-39868 · WordPress · The Imagepress – Image Gallery

Name of the Vulnerable Software and Affected Versions: The ImagePress – Image Gallery plugin for WordPress versions prior to 1.2.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization. This is due to a missing capability...

SUSE CVE-2024-47667

In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Add workaround for Errata i2037 AM65x SR 1.0 Errata i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0 SPRZ452DJuly 2018Revised December 2019 1 mentions when an inbound PCIe TLP spans more than two internal AXI...

PT-2024-38022 · Unknown · Parisneo/Lollms-Webui +1

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified parisneo/lollms affected versions not specified Description: A path traversal issue exists due to improper sanitization of the personality folder parameter in the "api open personality...

PT-2024-29690 · Atos · Atos Eviden Smc Xscale

Name of the Vulnerable Software and Affected Versions: Atos Eviden SMC xScale versions prior to 1.6.6 Description: An issue was discovered in Atos Eviden SMC xScale during initialization of nodes, where some configuration parameters are retrieved from management nodes. These parameters embed...