CVE-2023-48362: Improper Restriction of XML External Entity Reference

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...

CVE-2024-40767: Files or Directories Accessible to External Parties

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced...

PT-2024-13606 · Apache · Apache Drill

Name of the Vulnerable Software and Affected Versions: Apache Drill versions 1.19.0 through 1.21.1 Description: The issue allows a user to read any file on a remote file system or execute commands via a malicious XML file. This is due to an XXE vulnerability in the XML Format Plugin...

CVE-2024-40767

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced...

USN-6911-1: Nova vulnerability

Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information...

CVE-2024-41655

TF2 Item Format helps users format TF2 items to the community standards. Versions of tf2-item-format since at least 4.2.6 and prior to 5.9.14 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. This vulnerability can be exploited by an attacker t...

CVE-2024-41655 TF2 Item Format Regular Expression Denial of Service vulnerability

TF2 Item Format helps users format TF2 items to the community standards. Versions of tf2-item-format since at least 4.2.6 and prior to 5.9.14 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. This vulnerability can be exploited by an attacker t...

CVE-2024-41655

CVE-2024-41655 affects the tf2-item-format library. Versions from at least 4.2.6 up to 5.9.13 are vulnerable to a Regular Expression Denial of Service (ReDoS) when parsing crafted user input, allowing DoS of services that use this library. Version 5.9.14 contains a fix. Upgrading to 5.9.14 or app...

CVE-2024-41655 TF2 Item Format Regular Expression Denial of Service vulnerability

TF2 Item Format helps users format TF2 items to the community standards. Versions of tf2-item-format since at least 4.2.6 and prior to 5.9.14 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. This vulnerability can be exploited by an attacker t...

@automatedtf/catalog (>=0.0.1, <=0.0.27), @automatedtf/reactor (>=0.0.1, <=0.0.9) +3 more potentially affected by CVE-2024-41655 via tf2-item-format (4.3.5)

tf2-item-format NPM version 4.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on tf2-item-format and may be impacted: - @automatedtf/catalog =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.25 - @vendortf/catalog 0.0.27 Source cves: CVE-2024-41655 Source advisory...

CVE-2024-41655

TF2 Item Format helps users format TF2 items to the community standards. Versions of "tf2-item-format" since at least "4.2.6" and prior to "5.9.14" are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. This vulnerability can be exploited by an...

CVE-2024-41655 TF2 Item Format Regular Expression Denial of Service vulnerability

TF2 Item Format helps users format TF2 items to the community standards. Versions of tf2-item-format since at least 4.2.6 and prior to 5.9.14 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. This vulnerability can be exploited by an attacker t...

@automatedtf/catalog (>=0.0.1, <=0.0.27), @automatedtf/reactor (>=0.0.1, <=0.0.9) +3 more potentially affected by CVE-2024-41655 via tf2-item-format (4.3.5)

tf2-item-format NPM version 4.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on tf2-item-format and may be impacted: - @automatedtf/catalog =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.25 - @vendortf/catalog 0.0.27 Source cves: CVE-2024-41655 Source advisory...

GHSA-8H55-Q5QQ-P685 (ReDoS) Regular Expression Denial of Service in tf2-item-format

Summary Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. Tested Versions - 5.9.13 - 5.8.10 - 5.7.0 - 5.6.17 - 4.3.5 - 4.2.6 v5 Upgrade package to ^5.9.14 v4 No patch exists. Please consult the v...

(ReDoS) Regular Expression Denial of Service in tf2-item-format

Summary Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. Tested Versions - 5.9.13 - 5.8.10 - 5.7.0 - 5.6.17 - 4.3.5 - 4.2.6 v5 Upgrade package to ^5.9.14 v4 No patch exists. Please consult the v...

@automatedtf/catalog (>=0.0.1, <=0.0.27), @automatedtf/reactor (>=0.0.1, <=0.0.9) +3 more potentially affected by CVE-2024-41655 via tf2-item-format (4.3.5)

tf2-item-format NPM version 4.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on tf2-item-format and may be impacted: - @automatedtf/catalog =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.25 - @vendortf/catalog 0.0.27 Source cves: CVE-2024-41655 Source advisory...

CVE-2024-41655: Executable Regular Expression Error

TF2 Item Format helps users format TF2 items to the community standards. Versions of tf2-item-format since at least 4.2.6 and prior to 5.9.14 are vulnerable to a Regular Expression Denial of Service ReDoS attack when parsing crafted user input. This vulnerability can be exploited by an attacker t...

PT-2024-33734

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to an index out of bounds problem in the cm helper translate curve to degamma hw format function, which could occur when the index 'i' exceeds the number of transfer...

PT-2024-33735

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to a potential index out of bounds problem in the cm3 helper translate curve to degamma hw format function within the DCN30 color management module. This could occur when...

PT-2024-7808 · Jt2Go · Jt2Go

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to V2406.0003 Description: A stack-based buffer overflow issue has been identified in the affected application. This issue could be triggered while parsing specially crafted PDF files, potentially allowing an attacker to...