CVE-2024-56202 Apache Traffic Server: Expect header field can unreasonably retain resource

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue...

CVE-2024-56202 Apache Traffic Server: Expect header field can unreasonably retain resource

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue...

CVE-2024-56202

Apache Traffic Server is susceptible to an Expected Behavior Violation vulnerability when processing the Expect header . This flaw arises from discrepancies in functionality compared to specifications, which could allow a remote attacker to compromise the accessibility of protected information . ...

CVE-2024-56202

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue...

CVE-2024-56202: Expected Behavior Violation

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue...

PT-2025-9866 · Apache +1 · Apache Traffic Server +1

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 9.0.0 through 9.2.8 Apache Traffic Server versions 10.0.0 through 10.0.3 Description: The issue is an Expected Behavior Violation vulnerability in Apache Traffic Server. Users are advised to upgrade to resolve t...

CVE-2024-21475

Memory corruption when the payload received from firmware is not as per the expected protocol size...

GO-2024-3248 KubeSphere IDOR vulnerability in github.com/kubesphere/kubesphere

An Insecure Direct Object Reference IDOR vulnerability in KubeSphere allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. NOTE: A fix is expected in v4.1.3 in January 2025...

CVE-2024-33030

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size...

CVE-2024-33030

Qualcomm chipsets with LPLH are affected by CVE-2024-33030. The issue is memory corruption caused by parsing IPC frequency table parameters when the input size is larger than expected. Impact is memory corruption (per the sources), with no public details on affected versions or a patch in the pro...

netfilter: ctnetlink: use helper function to calculate expect ID

...

Expected Behavior Violation

@backstage/plugin-app-backend is vulnerable to Expected Behavior Violation. The vulnerability is due to the handling of APPCONFIG environment variables, which ignores the visibility defined in the configuration schema. Note: This was an intended feature of the APPCONFIG way of supplying...

CVE-2024-47762: Expected Behavior Violation

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...

Incorrect context paths included in the fallback URL still pass you to the login form when enable-authentication-fallback is enabled.

h3. Issue Summary When using an incorrect fallback URL to bypass SAML, you are still passed to the login form. This can be reproduced using a context path in the URL when no context path is set in the server.xml or by using a misspelled/wrong context path when one is set. This is reproducible on...

CVE-2024-8690: Expected Behavior Violation

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity...

PT-2024-38739 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue was initially considered but further investigation showed it does not pose a security risk as it falls within the expected functionality and security controls of th...

PT-2024-5331 · Duckdb · Duckdb

Name of the Vulnerable Software and Affected Versions: DuckDB versions 1.0.0 and prior Description: The issue is related to the sniff csv function in DuckDB, which allows access to the filesystem even when enable external access is set to false. This provides an attacker with unauthorized access ...

Security Bulletin: Due to the use of IBM Websphere Application Server Liberty, IBM TXSeries for Multiplatforms is vulnerable to Denial of Service, Weaker than exected security, Cross-site scripting and Server-side request forgery (SSRF).

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty related packages that are shipped with IBM TXSeries for Multiplatforms. The version of IBM WebSphere Application Server Liberty shipped with IBM TXSeries for Multiplatforms has been updated to address the applicable...

CVE-2023-43524

Memory corruption when the bandpass filter order received from AHAL is not within the expected range...

CVE-2024-21475

CVE-2024-21475 affects Qualcomm chipsets; memory corruption occurs when the firmware payload length does not match the expected protocol size, due to improper handling of payload length. Impact is high (C/H/I/A) with a local attack vector, low privileges required, and no user interaction. Remedia...