8503 matches found
Bref Security Vulnerabilities
Bref is an open source project by Matthieu Napoli Individual Developer that helps you go serverless on AWS using PHP. A security vulnerability exists in versions prior to Bref 2.1.13 that stems from inconsistent parsing of body text by the Bref and Event-Driven functions...
Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.4.0 Vulnerability Details CVEID:CVE-2022-46337 DESCRIPTION: Apache Derby could allow a remote attacker to bypass security restrictions, caused by a LDAP injection vulnerability in authenticator. By sending a...
AZL-34735 CVE-2023-6246 affecting package glibc for versions less than 2.38-6
A heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name the basename of...
SUSE CVE-2023-46839
PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context...
TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass Vulnerability
TELSAT marKoni FM Transmitter version 1.9.5 implements client-side restrictions that can be bypassed by editing the HTML source page that enable administrative operations. TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass Vendor: TELSAT Srl Product web page:...
SUSE-SU-2024:0270-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
SUSE-SU-2024:0269-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
SUSE-SU-2024:0265-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
SUSE-SU-2024:0264-1 Security update for xen
This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...
pci: phantom functions assigned to incorrect contexts
ISSUE DESCRIPTION PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions nee...
Microsoft Executives Hacked
Microsoft is reporting that a Russian intelligence agency--the same one responsible for SolarWinds--accessed the email system of the companys executives. Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and ga...
Moderate: Red Hat Security Advisory: sqlite security update
An update for sqlite is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
Prototype Pollution
hoolock is vulnerable to Prototype Pollution. The vulnerability is due to utility functions failing to block attempts to access or alter object prototypes. An attacker can modify application data or perform a Denial of Service by exploiting this vulnerability...
Prototype pollution not blocked by object-path related utilities in hoolock
Impact Utility functions related to object paths get, set and update did not block attempts to access or alter object prototypes. Patches The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions =2.2.1...
GHSA-4C2G-HX49-7H25 Prototype pollution not blocked by object-path related utilities in hoolock
Impact Utility functions related to object paths get, set and update did not block attempts to access or alter object prototypes. Patches The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions =2.2.1...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
Code injection
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An attacker may be able to decrypt legacy RSA PKCS1 v1.5 ciphertexts without having the...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
PT-2024-1476 · Redis · Redis
Name of the Vulnerable Software and Affected Versions: Redis versions master-1b8bd86 through master-7b46079 Description: The issue is related to an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c. This is associated with a buffer overflow in memory, which...