30983 matches found
ROS-20240412-02
A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection negotiation process and remove an arbitrary number of SSH service messages. during the connection negotiation process and cause an arbitrary number of SSH service...
Advisory ROSA-SA-2024-2394
Software: spice 0.14.3 OS: ROSA Virtualization 2.1 packageevrstring: spice-0.14.3-4.rv3 CVE-ID: CVE-2021-20201 BDU-ID: 2022-05884 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the SPICE remote virtual desktop rendering system is associated with significantly less resource consumption at the clie...
Denial Of Service (DoS)
Node.js is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of HTTP/2 CONTINUATION frames, where sending a small amount of HTTP/2 frames packets can cause data to be left in nghttp2 memory after a reset, leading to a race condition when the Http2Session destructo...
Broke Window Attack
Varnish Cache, Varnish Enterprise is vulnerable to a Broke Window Attack. The vulnerability is due to exhaustion of credits for an HTTP/2 connection control flow window...
Security Bulletin: Improper integrity checking might affect IBM Storage Defender – Resiliency Service (CVE-2024-27261)
Summary IBM Storage Defender – Resiliency Service is vulnerable and that can result in data integrity issues. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-27261 DESCRIPTION: IBM Storage Defender - Resiliency Service could allow a privileged user to install a...
UBUNTU-CVE-2021-47199
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts CT clear action offload adds additional mod hdr actions to the flow's original mod actions in order to clear the registers which hold ctstate. When such flow also...
Vulnerabilities fixed in Micorosft SQL Server
Microsoft has fixed vulnerabilities in SQL Server. The vulnerabilities are located in the various ODBC and OLE DB drivers and allow a malicious party to execute arbitrary code execute application privileges, potentially gaining access gain access to sensitive data. Successful abuse requires the...
CVE-2023-6964
The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadenceimportgetnewconnectiondata' AJAX action. This makes it possible for authenticated attackers, with...
Apache Zeppelin remote code execution by adding malicious JDBC connection string
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...
CVE-2024-28901
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-28902
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-28902
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-26255
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-26255
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-26217
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-26207
Windows Remote Access Connection Manager Information Disclosure Vulnerability...
CVE-2024-28900 Windows Remote Access Connection Manager Information Disclosure Vulnerability
...
CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...
CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to versio...
