6923 matches found
UBUNTU-CVE-2024-29415
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...
CVE-2024-29415
CVE-2024-29415 affects the npm package ip (Node.js) up to version 2.0.1, enabling SSRF due to an incomplete fix of CVE-2023-42282. The root cause is the incorrect categorization of certain IPs as globally routable by isPublic. Exploitation details and affected versions beyond 2.0.1 are not provid...
CVE-2024-29415
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...
CVE-2024-29415
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...
tomcat: Leaking of unrelated request bodies in default error page
An information disclosure vulnerability was found in Apache Tomcat. Incomplete POST requests triggered an error response that could contain data from a previous HTTP request. This flaw allows a remote attacker to access files from another user that should be otherwise prevented by limits or...
Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update
An update for etcd is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
golang: crypto/tls: panic when processing post-handshake message on QUIC connections
A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic...
etcd: Incomplete fix for CVE-2021-44716 in OpenStack Platform
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning ...
Tomcat: WebSocket DoS with incomplete closing handshake
A denial of service DoS vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability...
Tomcat: WebSocket DoS with incomplete closing handshake
A denial of service DoS vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability...
golang: crypto/tls: panic when processing post-handshake message on QUIC connections
A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic...
RHEL 9 : Red Hat OpenStack Platform 17.1 (etcd) (RHSA-2024:2729)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2729 advisory. A highly-available key value store for shared configuration Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and...
CVE-2021-47383
In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUTVSCREENINFO passing the fbvarscreeninfo struct containing only the fields xres, yres, and bitsperpixel with values...
CVE-2024-35980
A vulnerability affecting the Linux kernel on ARM64 systems, specifically in its KVM Kernel-based Virtual Machine module during live migration was found. An issue in the TLB Translation Lookaside Buffer invalidation process causes incomplete flushing of entries due to a miscalculated operand. Thi...
UBUNTU-CVE-2024-35937
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more...
Security Bulletin: Multiple vulnerabilities in Apache Tomcat affects App Connect Professional
Summary App Connect Professional has addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2024-24549 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by improper input validation by the HTTP/2 header. By sending specially crafte...
PT-2024-34328 · Apache Friends · Xampp
Name of the Vulnerable Software and Affected Versions: XAMPP Windows versions 7.3.2 and earlier Description: The issue exists when XAMPP attempts to process many incomplete HTTP requests, resulting in resource consumption and system crashes. This is an uncontrolled resource consumption...
GitLab 11.8 < 16.1.5 / 16.2 < 16.2.5 / 16.3 < 16.3.1 (CVE-2023-4378)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A...
PT-2024-34296 · Unknown · Cerberus Enterprise
Name of the Vulnerable Software and Affected Versions: Cerberus Enterprise version 8.0.10.3 Description: A Denial of Service DoS issue exists in the web administration of Cerberus Enterprise. This occurs when the web server, which uses default port 10001, attempts to process a large number of...