PT-2024-39748

Name of the Vulnerable Software and Affected Versions Keycloak versions 26 and earlier Description Keycloak Server is susceptible to a denial of service DoS attack due to improper handling of proxy headers. When configured to accept incoming proxy headers, the server may accept non-IP values, suc...

USN-7057-1 ruby-webrick vulnerability

It was discovered that WEBrick incorrectly handled having both a Content- Length header and a Transfer-Encoding header. A remote attacker could possibly use this issue to perform a HTTP request smuggling attack...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.6.2

Red Hat OpenShift Service Mesh Containers for 2.6.2 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift...

CVE-2024-43683

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0...

CVE-2024-43683

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0...

CVE-2024-43683 Improper verification of the Host header in TimeProvider 4100

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0...

CVE-2024-43683

CVE-2024-43683 affects Microchip TimeProvider 4100 (from v1.0). The issue is an improper verification of the Host header leading to a URL Redirection to an untrusted site, enabling cross-site scripting via HTTP headers (open redirect). Public documents indicate affected versions start at 1.0, but...

CVE-2024-43683: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0...

Advisory ROSA-SA-2024-2479

Software: squid 3.5.20 OS: rosa-server79 packageevrstring: squid-3.5.20-17.0.1.res7.10 CVE-ID: CVE-2023-46728 BDU-ID: 2024-01221 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Squid proxy server is related to pointer dereferencing errors. Exploitation of the vulnerability could allow an attacke...

PT-2024-25955 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon version 4.1.6 Description: The issue allows API endpoint rate limiting to be bypassed by setting a crafted HTTP request header. Recommendations: For Mastodon version 4.1.6, as a temporary workaround, consider restricting access to AP...

Ubuntu: Security Advisory (USN-7015-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-30132

HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors...

CVE-2024-30132 Missing default HTTP security headers affect HCL Nomad server on Domino

HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors...

CVE-2024-30132 Missing default HTTP security headers affect HCL Nomad server on Domino

HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

HCL Nomad 安全漏洞

HCL Nomad is an application from HCL USA for using and managing the Domino application development platform in mobile devices. A security vulnerability exists in HCL Nomad that stems from the default failure to configure certain HTTP security headers on Domino, which could allow an attacker to...

PT-2024-23205

Name of the Vulnerable Software and Affected Versions HCL Nomad server on Domino version 1.0.12 Description The issue is related to the HCL Nomad server on Domino not configuring certain HTTP Security headers by default, which could allow an attacker to obtain sensitive information via unspecifie...

CVE-2024-30132: Insecure Storage of Sensitive Information

HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors...

CVE-2024-38809

CVE-2024-38809 is a Spring Framework DoS vulnerability arising when parsing ETags from If-Match/If-None-Match headers. Affected OpenPages advisory confirms remediation by upgrading Spring to a fixed package version (OpenPages uses Spring Framework 5.3.x; remediation version stated as 5.3.39.2511)...

SUSE-SU-2024:3470-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2024-6923: Fixed uncontrolled CPU resource consumption when in http.cookies module bsc1228780. - CVE-2024-5642: Fixed buffer overread when NPN is used and invalid values are sent to the OpenSSL API bsc1227233. - CVE-2024-7592: Fixed Email...