CVE-2025-24970 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead...

org.jboss.narayana.rts:lra-coordinator (>=5.10.0.Final <=5.10.6.Final), org.jboss.narayana.rts:lra-coordinator-jar-jakarta (>=5.13.1.Alpha1 <=5.13.1.Final) +7 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (>=5.10.0.Final <=7.0.2.Final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version =5.10.0.Final, =5.10.0.Final, =5.13.1.Alpha1, =5.11.0.Final, =5.10.5.Final, =5.12.1.Final, =29.0.0.Alpha1, =28.0.0.Beta1, =28.0.0.Beta1, =28.0.0.Beta1, =28.0.1.Final Source cves: CVE-2024-8447 Source advisory: OSV:GHSA-QQ9F-Q439-2574...

CVE-2024-56584

In the Linux kernel, the following vulnerability has been resolved: iouring/tctx: work around xastore allocation error issue syzbot triggered the following WARNON: WARNING: CPU: 0 PID: 16 at iouring/tctx.c:51 iouringfree+0xfa/0x140 iouring/tctx.c:51 which is the WARNONONCE!xaempty&tctx-;xa; sanit...

cn.tenmg:flink-connector-sqlserver-cdc-log (=1.0.0), com.ascentstream.pulsar:pulsar-io-debezium-mssql (>=2.10.6.9 <=2.10.7.4-SNAPSHOT-35e64fa) +28 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-sqlserver (>=1.0.0.Final <=2.2.1.Final)

io.debezium:debezium-connector-sqlserver MAVEN version =1.0.0.Final, =2.10.6.9, =2.2.0, =0.1.0, =0.4.1, =2.9.0-candidate-4, =0.1.0, =1.0.0, =1.0.0, =1.0.0-CR2, =3.1.0, =3.1.0, =3.1.0, =3.6.0-2.2 and more Source cves: CVE-2023-1419 S...

SUSE CVE-2024-46867

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: fix deadlock in showmeminfo There is a real deadlock as well as sleeping in atomic bug in here, if the bo put happens to be the last ref, since bo destruction wants to grab the same spinlock and sleeping locks. Fix...

SUSE CVE-2024-47197

Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype...

kernel: serial: core: fix transmit-buffer reset and memleak

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...

kernel: serial: core: fix transmit-buffer reset and memleak

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...

Grafana plugin SDK Information Leakage

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI for instance, to allow for fetching of private...

CVE-2024-8986

CVE-2024-8986 is tied to Grafana’s grafana-plugin-sdk-go which embeds build metadata in binaries, including the repository URL obtained via git remote get-url origin. If credentials are present in that URL, the final binary may contain the full URI with credentials, creating a risk of credential ...

kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.0...

WordPress Image Photo Gallery Final Tiles Grid Plugin < 3.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Image Photo Gallery Final Tiles Grid Type Plugin Vulnerable versions 3.6.0 Fixed in 3.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3710 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID af002133dcff Credits Dmitr...

CVE-2024-3710

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be use...

CVE-2024-3710

CVE-2024-3710 used details: The WordPress plugin “Image Photo Gallery Final Tiles Grid” (Final Tiles Grid Gallery Lite) is affected in versions before 3.6.0. The issue stems from insufficient validation/escaping of shortcode attributes, allowing Stored XSS when outputting attributes back into the...

PT-2024-37282 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow affected versions not specified Description: A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent, but the client would continue waiting as Undert...

The vulnerability of Citrix Hypervisor and XenServer platform-related server virtualization solutions lies in improper speed limits at the final point, which allows attackers to trigger service failures.

The vulnerability of Citrix Hypervisor and XenServer platform-related servers is related to improper speed limits at the final point. Exploiting this vulnerability can allow an attacker to cause service failures...

final-fantasy.ch Cross Site Scripting vulnerability OBB-3936340

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the Cisco Nexus Dashboard, a platform for analytics and automation of cloud computing data centers, stems from deficiencies in access control. This allows unauthorized individuals to gain unauthorized access to protected information.

The vulnerability of the Cisco Nexus Dashboard analytics and cloud-based data center automation platform is related to deficiencies in access control to the final API endpoint. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending...

DEBIAN-CVE-2021-47527

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...