Security Bulletin: IBM Maximo Application Suite uses bcprov-jdk15on-1.70.jar which is vulnerable to CVE-2024-29857.

Summary IBM Maximo Application Suite uses bcprov-jdk15on-1.70.jar which is vulnerable to CVE-2024-29857. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-29857 DESCRIPTION: The Bouncy Castle Crypto Package For Java is vulnerable ...

SUSE SLES15 / openSUSE 15 Security Update : containerd (SUSE-SU-2024:3221-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3221-1 advisory. - Update to containerd v1.7.21 - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc uncontrolled resource consumptio...

The vulnerability of the Linux operating system’s kernel, related to uncontrolled resource consumption, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Linux operating system’s kernel is related to uncontrolled resource consumption. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of the Samba networking communication package and the ldb database, related to uncontrolled resource consumption, allows a hacker to cause service failures.

The vulnerability of the Samba networking communication package and the ldb database is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Botan cryptographic library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the Botan cryptographic library is related to uncontrolled resource consumption. Exploiting this vulnerability allows a remote attacker to trigger a service failure using a specially created ECDSA X.509 certificate...

EulerOS 2.0 SP9 : expat (EulerOS-SA-2024-2363)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for...

CVE-2024-44459

CVE-2024-44459 concerns VerneMQ 2.0.1 with a memory allocation issue that allows an attacker to cause a Denial of Service via excessive memory consumption. Connected sources (Red Hat, NVD, OSV, CNNVD, CVE records) consistently describe the same vulnerable version and impact, with no publicly docu...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2024-2363)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-35361

Name of the Vulnerable Software and Affected Versions: GNOME libsoup versions prior to 3.6.1 Description: The issue is related to an infinite loop and memory consumption during the reading of certain patterns of WebSocket data from clients. Recommendations: For versions prior to 3.6.1, update to...

CVE-2024-45412

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

SUSE-SU-2024:3188-1 Security update for containerd

This update for containerd fixes the following issues: - Update to containerd v1.7.21 - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc uncontrolled resource consumption due to unbound cardinality metrics. bsc1217070 - CVE-2023-45142: Fixed DoS vulnerability in otelhttp. bsc1228553...

ROS-20240910-08

Vulnerability in DecodeConfig component of Golang programming language is related to uncontrolled consumption of resources. resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial-of-service condition. denial of service A vulnerability in the Gstream...

Siemens SIMATIC S7-200 SMART Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-708)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-708 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100187)

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.100187 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory. - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in...

The vulnerability of the Aardvark-dns DNS server lies in its uncontrolled resource consumption during open TCP connections that are not time-limited. This allows attackers to cause service failures.

The vulnerability of the Aardvark-dns DNS server is related to an uncontrolled resource consumption during open TCP connections with unlimited duration. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Denial Of Service (DoS)

sigstore-go is vulnerable to Denial Of Service DoS. The vulnerability is due to lack of limits on the amount of verifiable data that can be included in a Sigstore Bundle, allowing to consume excessive resource during the verification process...