6418 matches found
AZL-52631 CVE-2024-50095 affecting package kernel for versions less than 5.15.173.1-1
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handler of mad agent acquires/releases madagentpriv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be...
Mastodon 4.1.x < 4.1.15 Unrestricted File Upload
According to its self-reported version number, the version of Mastodon running on the remote host is prior to 3.5.19 or 4.0.x prior to 4.0.15 or 4.1.x prior to 4.1.15 or 4.2.x prior to 4.2.7. Therefore, it may be affected by a lack of media type verification of Activity Streams objects allows...
Mastodon < 4.1.20 Regular Expression Denial of Service
According to its self-reported version number, the version of Mastodon running on the remote host is prior to 4.1.20 or 4.2.x prior to 4.2.12. Therefore, it may be affected by a regular expression denial of service vulnerability. Note that the scanner has not tested for these issues but has inste...
AZL-52227 CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52192 CVE-2024-51744 affecting package influxdb for versions less than 2.7.5-4
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52248 CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-25
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52171 CVE-2024-51744 affecting package coredns for versions less than 1.11.4-1
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52260 CVE-2024-51744 affecting package azcopy for versions less than 10.25.1-5
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Zaidan Rizaki Patchstack Alliance in WordPress Plugin Responsive Filterable Portfolio versions = 1.0.22...
CVE-2024-36485
Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option...
VulnCheck KEV: CVE-2024-36991
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows...
WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Woocommerce Quote Calculator versions = 1.1...
PT-2024-33091 · Qualitor · Qualitor
Name of the Vulnerable Software and Affected Versions: Qualitor versions 8.24 and below Description: The issue is related to a Server-Side Request Forgery SSRF in the component /request/viewValidacao.php. This allows for an unauthenticated server-side request forgery vulnerability. Recommendation...
SUSE CVE-2024-10459
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...
SUSE CVE-2024-10466
By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...
SUSE CVE-2024-10468
Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox 132 and Thunderbird 132...
Drupal OhDear Integration module < 2.0.4 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by casey in WordPress Module OhDear Integration versions 2.0.4...
AZL-51831 CVE-2024-49769 affecting package python-waitress for versions less than 3.0.1-1
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer...