acir (>=0.44.0 <=0.46.0), age (>=0.9.0 <=0.9.3) +113 more potentially affected by unknown CVE via pprof (>=0.10.1 <=0.13.0)

pprof CARGO version =0.10.1, =0.44.0, =0.9.0, =0.4.2, =0.1.0, =0.3.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.0.9, =0.1005.0, =0.44.0, =0.46.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GW5W-5J7F-JMJJ...

RHSA-2024:10806 Red Hat Security Advisory: Satellite 6.15.5 Async Update

Bulletin has no description...

CVE-2024-53140

CVE-2024-53140 affects the Linux kernel netlink dump path. The vulnerability arises because dumps can be left incomplete if a user closes the netlink socket, and the prior cleanup deferred via a workqueue could end up releasing a socket reference still in an unsafe state. The fix removes the work...

io.github.shoothzj:http-client-facade (=0.0.1), io.github.taikonaut3:virtue-demo (>=0.0.1-alpha <=1.0.0-alpha) +7 more potentially affected by CVE-2024-53990 via org.asynchttpclient:async-http-client (>=3.0.0.Beta1 <=3.0.0.Beta3)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.Beta1, =0.0.1-alpha, =0.3.1, =0.0.1, =3.0.0-M2, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =3.0.0-RC2 Source cves: CVE-2024-53990 Source advisory: OSV:GHSA-MFJ5-CF8G-G2FV...

UBUNTU-CVE-2024-53990

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

Async Http Client 授权问题漏洞

Async Http Client is AsyncHttpClient open source asynchronous Http and WebSocket client library for Java. An authorization issue vulnerability exists in Async Http Client version 3.0.0, which stems from an automatically enabled and self-managed CookieStore handling mechanism that can lead to...

Race Condition

Overview fastapi-sso is a FastAPI plugin to enable SSO to most common providers such as Facebook login, Google login and login via Microsoft Office 365 Account Affected versions of this package are vulnerable to Race Condition. When multiple concurrent login requests are processed simultaneously,...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

DEBIAN-CVE-2024-53090

In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afswakeupasynccall can incur lock recursion. The problem is that it is called from AFRXRPC whilst holding the -notifylock, but it tries to take a ref on the afscall struct in order to pass it to a work que...

SUSE CVE-2024-53073

In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pendingasynccopies on error The error flow in nfsd4copy calls cleanupasynccopy, which already decrements nn-pendingasynccopies...

ailingo (>=0.2.0 <=0.4.0), async-scrape (>=0.1.19 <=0.1.20) +22 more potentially affected by CVE-2024-52595 via lxml-html-clean (>=0.1.0 <=0.3.1)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.3.1, =0.0.550, =0.1.0, =0.0.7, =0.6.0, =0.2.0, =12.0.15, =1.0.1, =0.1.0, =0.1.0, =1.10.0, =1.19.0 and more Source cves: CVE-2024-52595 Source advisory: OSV:PYSEC-2024-160...

DEBIAN-CVE-2024-53073

In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pendingasynccopies on error The error flow in nfsd4copy calls cleanupasynccopy, which already decrements nn-pendingasynccopies...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from unreduced pendingasynccopies in the error flow...

The vulnerability of the CurlAsyncHTTPClient component in the asynchronous networking library Tornado allows a hacker to execute arbitrary code.

The vulnerability of the CurlAsyncHTTPClient component in the Tornado asynchronous networking library is related to the lack of measures taken to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted HTTP requests ...

CVE-2024-52304 aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installe...

Siemens SCALANCE and RUGGEDCOM Devices Improper Locking (CVE-2024-26925)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: release mutex after nftgcseqend from abort path The commit mutex should not be released during the critical section between nftgcseqbegin and nftgcseqend, otherwise, async GC worker could collect expired...

Security Bulletin: Multiple Vulnerabilities in IBM Event Endpoint Management

Summary Multiple vulnerabilities were addressed in IBM Event Endpoint Management version 11.3.1 Vulnerability Details CVEID:CVE-2024-47561 DESCRIPTION: Apache Avro could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in schema parsing in the Java...

Security Bulletin: Due to use of Async, IBM Event Streams is vulnerable to Regular Expression denial of service

Summary Async is used by IBM Event Streams CVE-2024-39249 Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of service, caused by the ReDoS Regular Expression Denial of Service while parsing function in autoinject function. By sending a specially crafted...

Security Bulletin: Due to use of Async, IBM Event Processing is vulnerable to Regular Expression Denial of Service

Summary Async is used by IBM Event Processing as part of the frontend. CVE-2024-39249 Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of service, caused by the ReDoS Regular Expression Denial of Service while parsing function in autoinject function. By...

kernel: powerpc/64s: Fix unrecoverable MCE calling async handler from NMI

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unrecoverable MCE calling async handler from NMI The machine check handler is not considered NMI on 64s. The early handler is the true NMI handler, and then it schedules the machinecheckexception handler to run...