GHSA-RCM4-JV5G-WCCM zfr authentication adapter did not verify validity of tokens

Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a release 0.1.2, tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials...

GHSA-CXF7-M5G2-V594 Zend-Mail remote code execution in zend-mail via Sendmail adapter

When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they c...

ZendFramework potential remote code execution in zend-mail via Sendmail adapter

When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they c...

GHSA-GFF2-P6VM-3P8G ZendFramework potential remote code execution in zend-mail via Sendmail adapter

When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they c...

ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations

The Zend\Db component in Zend Framework 2 provides platform abstraction, which is used in particular for SQL abstraction. Two methods defined in the platform interface, quoteValue and quoteValueList, allow users to manually quote values for creating SQL statements; these are in turn consumed by...

dagster-dbt (>=0.20.5 <=0.21.6), dbt-dremio (=1.7.0) +9 more potentially affected by CVE-2024-36105 via dbt-core (>=1.7.0 <=1.7.14)

dbt-core PYPI version =1.7.0, =0.20.5, =1.7.0, =0.0.2, =1.7.0, =0.0.4, =0.203.0.dev5, =0.0.1rc8, =0.4.2, =0.8.0 Source cves: CVE-2024-36105 Source advisory: OSV:GHSA-PMRX-695R-4349...

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

A potential SQL injection vulnerability was identified by using the silverstripe/postgresql database adapter. While unlikely to be exploitable, we have patched silverstripe/framework to ensure that table names are safely escaped before being passed to database adapters or user code...

GHSA-265Q-222X-52M6 silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

A potential SQL injection vulnerability was identified by using the silverstripe/postgresql database adapter. While unlikely to be exploitable, we have patched silverstripe/framework to ensure that table names are safely escaped before being passed to database adapters or user code...

PT-2024-40009 · Silverstripe · Silverstripe/Framework +1

Name of the Vulnerable Software and Affected Versions: silverstripe/framework affected versions not specified Description: A potential SQL injection issue was identified when using the silverstripe/postgresql database adapter. Although it is unlikely to be exploitable, the issue has been patched ...

SUSE CVE-2021-47425

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpii2cfindadapterbyhandle calls busfinddevice which takes a reference on the adapter which is never released which will result in a reference count leak and render...

UBUNTU-CVE-2024-36010

In the Linux kernel, the following vulnerability has been resolved: igb: Fix string truncation warnings in igbsetfwversion Commit 1978d3ead82c "intel: fix string truncation warnings" fixes '-Wformat-truncation=' warnings in igbmain.c by using kasprintf...

kernel: Kernel: Memory leak in IPMI SSIF module leads to Denial of Service

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI SSIF module. A local user can exploit this vulnerability by repeatedly calling the ssifinfofind function. This improper handling of memory allocation leads to a memory leak, which can result in a Denial of Servi...

DEBIAN-CVE-2021-47425

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpii2cfindadapterbyhandle calls busfinddevice which takes a reference on the adapter which is never released which will result in a reference count leak and render...

DEBIAN-CVE-2021-47306

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fzaprobe fp is netdev private data and it cannot be used after freenetdev call. Using fp after freenetdev can cause UAF bug. Fix it by moving freenetdev after error message. TURBOchannel adapter"...

CVE-2021-47306

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fzaprobe fp is netdev private data and it cannot be used after freenetdev call. Using fp after freenetdev can cause UAF bug. Fix it by moving freenetdev after error message. TURBOchannel adapter"...

CVE-2021-47425

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpii2cfindadapterbyhandle calls busfinddevice which takes a reference on the adapter which is never released which will result in a reference count leak and render...

UBUNTU-CVE-2021-47425

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpii2cfindadapterbyhandle calls busfinddevice which takes a reference on the adapter which is never released which will result in a reference count leak and render...

CVE-2021-47425 i2c: acpi: fix resource leak in reconfiguration device addition

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak in reconfiguration device addition acpii2cfindadapterbyhandle calls busfinddevice which takes a reference on the adapter which is never released which will result in a reference count leak and render...

CVE-2021-47306 net: fddi: fix UAF in fza_probe

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fzaprobe fp is netdev private data and it cannot be used after freenetdev call. Using fp after freenetdev can cause UAF bug. Fix it by moving freenetdev after error message. TURBOchannel adapter"...

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12. A patched version of the package is available...