Fedora 38 : prometheus-podman-exporter (2024-45f0a1df95)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-45f0a1df95 advisory. release v1.11.0 ---- release v1.10.1 ---- release v1.10.0 Tenable has extracted the preceding description block directly from the Fedora security advisory...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

RHEL 8 / 9 : OpenShift Container Platform 4.13.38 (RHSA-2024:1456)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1456 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

The vulnerability of the Windows Compressed Folder component in Windows operating systems allows attackers to compromise the integrity of protected information.

The vulnerability of the Windows Compressed Folder component in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information through a specially created file...

GO-2024-2631 Decompression bomb vulnerability in github.com/go-jose/go-jose

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

Design/Logic Flaw

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language lies in its improper handling of highly compressed input data. This allows attackers to trigger service failures.

The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language is related to incorrect processing of highly compressed input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

CVE-2024-26185

Windows Compressed Folder Tampering Vulnerability...

CVE-2024-26185

Windows Compressed Folder Tampering Vulnerability...

Design/Logic Flaw

Windows Compressed Folder Tampering Vulnerability...

CVE-2024-26185

CVE-2024-26185 is the Windows Compressed Folder Tampering vulnerability. Supported data in connected sources notes that Windows 11 (22H2/23H2) systems are affected, with impact described as data manipulation. The issue is covered in Microsoft KB5035853 and appears among multiple vulnerabilities p...

CVE-2024-26185 Windows Compressed Folder Tampering Vulnerability

...

CVE-2024-26185 Windows Compressed Folder Tampering Vulnerability

...

Windows Compressed Folder Tampering Vulnerability

...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User rights...

Microsoft Windows Compressed Folder Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in the Microsoft Windows Compressed Folder. The following products and versions are affected: Windows 11 Version 22H2 for ARM64-based Systems,Windows 11...

PT-2024-2252 · Microsoft · Windows Compressed Folder +1

Name of the Vulnerable Software and Affected Versions: Windows Compressed Folder affected versions not specified Description: The issue is related to insufficient input validation in the Windows Compressed Folder component, which can be exploited by creating a specially crafted file. This allows ...

CVE-2024-28180

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Mitigation Mitigation for this issue is either...

CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...