CVE-2024-33612

An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-32049

BIG-IP Next Central Manager CM may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-32049 BIG-IP Next Central Manager vulnerability

BIG-IP Next Central Manager CM may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000138634: BIG-IP Next Central Manager vulnerability CVE-2024-32049

Security Advisory Description BIG-IP Next Central Manager may allow an unauthenticated, remote attacker to obtain BIG-IP Next LTM/WAF instance credentials. CVE-2024-32049 Impact This vulnerability may allow an unauthenticated attacker in a man-in-the-middle MITM position between a BIG-IP Next...

PT-2024-25377 · F5 · Big-Ip Next Central Manager

Name of the Vulnerable Software and Affected Versions: BIG-IP Next Central Manager affected versions not specified Description: An improper certificate validation issue exists, potentially allowing an attacker to impersonate an Instance Provider system and cross a security boundary...

Oracle Linux 9 : bind (ELSA-2024-2551)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2551 advisory. - Prevent crashing at masterformat system test CVE-2023-6516 - Add downstream change complementing CVE-2023-50387 - Prevent increased CPU load on large...

F5 BIG-IP Next Central Manager 信任管理问题漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A man-in-the-middle attack vulnerability exists in F5 BIG-IP Next Central Manager, which can be exploited by an attacker to...

CVE-2024-33612: Improper Certificate Validation

An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

SUSE CVE-2022-48688

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix kernel crash during module removal The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host...

CVE-2022-48688 i40e: Fix kernel crash during module removal

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix kernel crash during module removal The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host...

CVE-2022-48688 i40e: Fix kernel crash during module removal

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix kernel crash during module removal The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host...

CVE-2022-48688

CVE-2022-48688 covers a Linux kernel i40e driver issue where removing modules after an offline ethtool test could crash the kernel. The root cause reported is that the driver frees the client instance incorrectly; during recursive removal (e.g., irdma removing i40e), i40e_lan_del_device dereferen...

kernel: bnxt_en: Avoid order-5 memory allocation for TPA data

In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data The driver needs to keep track of all the possible concurrent TPA GRO/LRO completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256 and the...

PT-2024-23686

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain version 0.1.5 Description A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component. The vulnerability arises because the Web Research Retriever does not restrict requests to remote...

CVE-2023-6717

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

CVE-2024-3625: Plaintext Storage of a Password

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance...

CVE-2023-6717: Improper Neutralization of Input During Web Page Generation

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

CVE-2024-31999 @fastify/secure-session: Reuse of destroyed secure session cookie

@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is...

CVE-2024-3625

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance...

GHSA-VXWR-WPJV-QJQ7 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

Impact Remote code execution is possible via PDF export templates. To reproduce on an installation, register a new user account with username PDFClass if XWiki.PDFClass does not exist. On XWiki.PDFClass, use the class editor to add a "style" property of type "TextArea" and content type "Plain...