mod_auth_openidc: DoS when using `OIDCSessionType client-cookie` and manipulating cookies

A flaw was found in modauthopenidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. Missing input validation in the modauthopenidcsessionchunks cookie value can make the server vulnerable to a denial of service attack. This issue may allow a remote attacke...

[BSA-120] Security Update for mosquitto

Philippe Coval uploaded new packages for mosquitto which fixed the following security problems: CVE-2024-8376 In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT",...

KB5046062 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: October 8, 2024

KB5046062 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: October 8, 2024 Applies To SQL Server 2016 Service Pack 3 Summary Improvements and fixes included in this update Known issues in this update How to obtain and install the update More information Fil...

KB5046856 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: November 12, 2024

KB5046856 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: November 12, 2024 Applies To SQL Server 2016 Service Pack 3 Summary Improvements and fixes included in this update How to obtain and install the update More information File information Information...

Bluetooth: L2CAP: Fix uaf in l2cap_connect

...

Ivanti Connect Secure security vulnerabilities

Ivanti Connect Secure is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Connect Secure that stems from the inclusion of a null pointer dereference issue...

Ivanti Connect Secure security vulnerabilities

Ivanti Connect Secure is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Connect Secure that stems from the inclusion of a use-after-release issue...

Ivanti Connect Secure security vulnerabilities

Ivanti Connect Secure is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Connect Secure that stems from the inclusion of a stack-based buffer overflow vulnerability...

Ivanti Connect Secure security vulnerabilities

Ivanti Connect Secure is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Connect Secure that stems from the inclusion of a stack-based buffer overflow vulnerability...

Moderate: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating...

CVE-2024-11006: Improper Neutralization of Special Elements used in an OS Command

Command injection in Ivanti Connect Secure before version 22.7R2.1 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.1 Not Applicable to 9.1Rx allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-11005: Improper Neutralization of Special Elements used in an OS Command

Command injection in Ivanti Connect Secure before version 22.7R2.1 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.1 Not Applicable to 9.1Rx allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-11004: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2024-8495: NULL Pointer Dereference

A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-47909: Stack-based Buffer Overflow

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service...

CVE-2024-47907: Stack-based Buffer Overflow

A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-47906: Privilege Defined With Unsafe Actions

Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.2 Not Applicable to 9.1Rx allows a local authenticated attacker to escalate privileges...

CVE-2024-47905: Stack-based Buffer Overflow

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service...

ALSA-2024:9180 Moderate: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating...

Microsoft SQL Server security vulnerabilities

Microsoft SQL Server is a large commercial database system from Microsoft Corporation USA that is used under Microsoft Windows. A security vulnerability exists in Microsoft SQL Server. An attacker exploiting this vulnerability could remotely execute code. The following products and editions are...