10468 matches found
CVE-2024-36610
Removed by vendor...
SUSE-SU-2024:4105-1 Security update for tomcat10
This update for tomcat10 fixes the following issues: - Update to Tomcat 10.1.33 Fixed CVEs: + CVE-2024-52316: If the Jakarta Authentication fails with an exception, set a 500 status bsc1233434 Catalina + Add: Add support for the new Servlet API method HttpServletResponse.sendEarlyHints. markt +...
Vulnerability fixed in Zabbix
A vulnerability has been fixed in Zabbix. The vulnerability is in how the CUser class handles the addRelatedObjects function. This could allow non-administrators with API access to perform an SQL injection, which could lead to unauthorized access to sensitive data. The vulnerability could enable...
UBUNTU-CVE-2024-42327
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...
CVE-2024-42327
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...
Unbreakable Enterprise kernel security update
4.1.12-124.92.3 - memcgwriteeventcontrol: fix a user-triggerable oops Al Viro Orabug: 37070674 CVE-2024-45021 - ocfs2: fix races between hole punching and AIO+DIO Su Yue Orabug: 36835819 CVE-2024-40943 4.1.12-124.92.2 - fbdev: savage: Handle err return when savagefbcheckvar failed Cai Xinchen...
Zabbix SQL injection vulnerability
Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A SQL injection vulnerability exists in Zabbix versions 6.0.0 through 6.0.31, 6.4.0 through 6.4.16, and 7.0.0. The vulnerability stems fr...
Is Bitcoin Still a Secure and Reliable Trading Option?
Cryptocurrencies are a relatively new asset class, and over the years, they have continued to be the subject…...
PT-2024-40636 · Git +1 · Checker-Framework
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A security exception crash was reported, involving the org.checkerframework.checker.formatter.util.FormatUtil.formatParameterCategories function, as part...
CVE-2024-8899: Exposure of Sensitive Information to an Unauthorized Actor
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the rendercontent function in class/elements/views/class-tabs-view.php. This makes it possible for authenticated attackers, with Contributor-level access and...
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special "java-class" attribute...
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special "java-class" attribute...
HTML Injection
org.hibernate.validator, hibernate-validator is vulnerable to HTML Injection. The vulnerability is due to improper validation in the 'isValid' method of the SafeHtmlValidator class, where the tag ending can be omitted by using a less-than character, allowing invalid HTML to be rendered...
Eclipse Jetty SSRF
The vulnerability of the HttpURI class in Eclipse Jetty’s server container is related to improper syntax validation during input processing. Exploiting this vulnerability allows an attacker to perform an SSRF attack remotely...
Improper URI Parsing
symfony/http-foundation is vulnerable to Improper URI Parsing. The vulnerability is due to improper parsing of URIs with special characters by the Request class, which does not align with browser behavior, allowing attackers to exploit validators and redirect users to malicious domains...
CVE-2024-53057
In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisctreereducebacklog on TCHROOT In qdisctreereducebacklog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major...
CVE-2024-53057
CVE-2024-53057 affects Linux kernel net/sched: qdisc_tree_reduce_backlog can UAF when major handle ffff: exists (egress qdiscs). Root cause: ffff: assumed to be root/ingress, fixed by stopping at TC_H_ROOT; the fix updates to avoid iterating into an ingress qdisc and halts when parent is TC_H_ROO...
CVE-2024-53057 net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisctreereducebacklog on TCHROOT In qdisctreereducebacklog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major...
WordPress GD Rating System plugin <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via extraclass Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin GD Rating System versions = 3.6.1...