Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

GitLab CE/EE - Information Disclosure

GitLab CE/EE is susceptible to information disclosure. An attacker can access runner registration tokens using quick actions commands, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. Affected versions are from 12.10 before 14.6.5,...

XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

CVE-2024-36991

CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-36991 with Asychronous Performance. Installation git clone https://github.com/th3gokul/CVE-2024-36991.git...

Astra Linux – vulnerability in PostgreSQL 11

A flaw was found in PostgreSQL versions prior to 13.3, prior to 12.7, prior to 11.12, prior to 10.17, and prior to 9.6.22. When modifying certain SQL array values, missing bounds checks allow authenticated database users to write arbitrary bytes to a large portion of the server’s memory. The...

Astra Linux – Vulnerability in Firefox, Thunderbird

By using a link with rel="localization", a use-after-free could occur if an object is destroyed during JavaScript execution, and then the object is referenced through a freed pointer, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 91.8, Firefox 99, and Firefo...

Astra Linux – vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Affected versions include Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, and 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5, and 22.3.1. Exploitation is difficult, allowin...

Astra Linux – vulnerability in openjdk-11

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products under Oracle Java SE component: Hotspot. Affected versions include Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, and 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, and 22; and Oracle...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Libraries. The supported versions affected include Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerability allows an...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected by this vulnerability are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle Graal...

Astra Linux – vulnerability in openjdk-11

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products under Oracle Java SE component: Networking. Affected versions include Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalV...

Astra Linux – vulnerability in LibreOffice

LibreOffice supports storing passwords for web connections in the user’s configuration database. The stored passwords are encrypted using a single master key provided by the user. There was a flaw in LibreOffice wherein the master key was poorly encoded, reducing its entropy from 128 to 43 bits...

Astra Linux – Vulnerability in Tomcat9

Apache Tomcat has a Relative Path Traversal vulnerability. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This created the possibility that, for rewrite rules that modify query parameters into the URL, an attacker could manipulate the...

Astra Linux – vulnerability in OpenSSL

Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data. Specifically, an ASN1TYPE union member is accessed without first validating its type, leading to an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An...

Astra Linux – vulnerability in Ansible

A vulnerability has been identified in Ansible Engine affecting Ansible Engine versions 2.7.x prior to 2.7.17, 2.8.x prior to 2.8.11, and 2.9.x prior to 2.9.7. It also affects Ansible Tower versions 3.4.5 and 3.5.5, 3.6.3, and earlier, when using modules that decrypt vault files such as assemble,...

Astra Linux – vulnerability in python-django

In Django 2.2 prior to 2.2.20, 3.0 prior to 3.0.14, and 3.1 prior to 3.1.8, MultiPartParser allowed directory traversal via uploaded files with specially crafted filenames. The built-in upload handlers were not affected by this vulnerability...

Astra Linux – vulnerability in Firefox and Thunderbird

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption; we assume that with sufficient effort, some of them could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird 78.1...

Astra Linux – Vulnerability in Samba

A null pointer dereference flaw was detected in Samba’s Winbind service in versions prior to 4.11.15, before 4.12.9, and before 4.13.1. A local user could exploit this flaw to crash the Winbind service, resulting in a denial of service...

Astra Linux – vulnerability in node-moment

Moment.js is a JavaScript date library designed for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability affects npm server users of Moment.js between versions 1.0.1 and 2.29.1, particularly when a user-supplied locale string is directly used to switch the...