GHSA-X7G6-RWHC-G7MJ Wildfly vulnerable to denial of service

A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections...

CVE-2024-4029

Summary: CVE-2024-4029 affects Red Hat/JBoss WildFly-based platforms via the EAP management interface. The vulnerability arises from no limit on sockets/connections to the management interface, potentially causing denial of service when hitting the nofile limit. The issue is referenced in Red Hat...

DELL ECS Connection Manager 安全漏洞

DELL ECS Connection Manager is a software for managing enterprise cloud storage from Dell DELL USA. A security vulnerability exists in DELL ECS Connection Manager that stems from the use of a reversible password encryption algorithm that allows an attacker to decrypt passwords...

Hitachi Energy's RTU500 series Unrestricted Upload of File with Dangerous Type (CVE-2024-1532)

A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could enforce diagnostic texts being displayed as empty strings, if an authorized user uploads a specially crafted stb-language file. This plugin only works wit...

CVE-2024-27024

A flaw was found in the Linux kernel’s rds module. Under some conditions, a warning can be triggered in the rdsconnconnectifdown function if the connection is not yet established, causing system instability and resulting in a denial of service...

GHSA-3999-5FFV-WP2R Yamux Memory Exhaustion Vulnerability via Active::pending_frames property

Summary Attack scenario The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a numbe...

CVE-2023-49606

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make ...

CVE-2023-49606

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make ...

CVE-2023-49606

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make ...

CVE-2024-27024

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rdsconnconnectifdown If connection isn't established yet, getmr will fail, trigger connection after getmr...

DEBIAN-CVE-2024-27024

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rdsconnconnectifdown If connection isn't established yet, getmr will fail, trigger connection after getmr...

UBUNTU-CVE-2024-27024

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rdsconnconnectifdown If connection isn't established yet, getmr will fail, trigger connection after getmr...

CVE-2024-27024

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rdsconnconnectifdown If connection isn't established yet, getmr will fail, trigger connection after getmr...

CVE-2024-27024

CVE-2024-27024 concerns the Linux kernel vulnerability in net/rds where a WARNING in rds_conn_connect_if_down could cause get_mr() to fail and trigger a connection after get_mr(). This is a local-attack surface (LOCAL) with high impact on confidentiality, integrity, and availability (CVE score in...

CVE-2024-27024

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rdsconnconnectifdown If connection isn't established yet, getmr will fail, trigger connection after getmr...

CVE-2024-32967

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

CVE-2024-32967 Zitadel exposes internal database user name and host information

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

PT-2024-25014 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: Zitadel versions prior to 2.45.7 Zitadel versions 2.46.x prior to 2.46.7 Zitadel versions 2.47.x prior to 2.47.10 Zitadel versions 2.48.x prior to 2.48.5 Zitadel versions 2.49.x prior to 2.49.5 Zitadel versions 2.50.x prior to 2.50.3...

CentOS 7 : rhc-worker-script (RHSA-2024:2625)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2625 advisory. - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK sta...

Tinyproxy HTTP Connection Headers use-after-free vulnerability

Talos Vulnerability Report TALOS-2023-1889 Tinyproxy HTTP Connection Headers use-after-free vulnerability May 1, 2024 CVE Number CVE-2023-49606 SUMMARY A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP...