6418 matches found
AZL-48929 CVE-2024-34158 affecting package golang for versions less than 1.18.8-6
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...
CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed)
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server. Exploitation is facilitated by bypassing...
AZL-48627 CVE-2024-44987 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...
AZL-48745 CVE-2024-45618 affecting package opensc for versions less than 0.26.1-1
A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have...
AZL-48804 CVE-2024-45619 affecting package opensc for versions less than 0.23.0-5
A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer...
AZL-48721 CVE-2024-45616 affecting package opensc for versions less than 0.26.1-1
A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. The following problems were caused by insufficient control of the response AP...
AZL-48792 CVE-2024-6119 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-2
Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...
CVE-2024-8389
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 130...
DEBIAN-CVE-2024-8385
A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
WordPress Web Directory Free plugin < 1.7.3 - Unauthenticated LFI vulnerability
Unauthenticated LFI vulnerability discovered by Simone Onofri, Kim Cerra, Andrea De Dominicis in WordPress Plugin Web Directory Free versions 1.7.3...
AZL-48369 CVE-2024-45490 affecting package expat for versions less than 2.6.3-1
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...
WordPress CoBlocks plugin < 3.1.13 - Editor+ Stored XSS vulnerability
Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin CoBlocks versions 3.1.13...
WordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Seb Patchstack Alliance in WordPress Plugin Super Store Finder versions 6.9.8...
Drupal Advanced Varnish module < 4.0.11 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by Heine Deelstra in WordPress Module Advanced Varnish versions 4.0.11...
AZL-48365 CVE-2024-43788 affecting package python-tensorboard for versions less than 2.16.2-3
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2026-33515 affecting package squid for versions less than 6.13-4
CVE-2026-33515 affecting package squid for versions less than 6.13-4. A patched version of the package is available...
AZL-48333 CVE-2024-43806 affecting package kata-containers for versions less than 3.2.0.azl4-1
Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linuxraw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::readmore, this can cause quick and...
AZL-48264 CVE-2024-43908 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer dereference to rasmanager Check rasmanager before using it...