1395 matches found
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an inode in the ocfs2 component not being removed from the cache when joining a group fails, resulting in a...
The vulnerability of the wilc1000 component in the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the wilc1000 component in the Linux operating system arises due to synchronization errors when using a common resource in the wilcparsejoinbssparam function. Exploiting this vulnerability can allow an attacker to cause a service failure...
SUSE CVE-2024-10394
A local user can bypass the OpenAFS PAG Process Authentication Group throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG...
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
...
CVE-2024-8185 Vault Vulnerable to Denial of Service When Processing Raft Join Requests
Vault Community and Vault Enterprise “Vault” clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service DoS attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vaul...
Vault Vulnerable to Denial of Service Through Memory Exhaustion When Processing Raft Cluster Join Requests
Summary Vault Community and Vault Enterprise “Vault” clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service DoS attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may...
CVE-2024-8185: Not Failing Securely
Vault Community and Vault Enterprise “Vault” clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service DoS attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vaul...
PT-2024-7644
Name of the Vulnerable Software and Affected Versions Vault Community versions prior to 1.18.1 Vault Enterprise versions prior to 1.18.1, 1.17.8, and 1.16.12 Description The issue is related to the Raft Consensus Algorithm in the Integrated Storage of HashiCorp Vault and Vault Enterprise, which c...
SUSE CVE-2024-49766
Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...
CVE-2024-49766
A flaw was found in Werkzeug. In Python versions below v3.11 on Windows, os.path.isabs does not catch UNC paths such as //server/share. Werkzeug's safejoin relies on this check and can produce a path that is not safe, which can allow unintended access to data...
SUSE CVE-2024-47712
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilcparsejoinbssparam In the wilcparsejoinbssparam function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to...
AZL-51184 CVE-2024-47712 affecting package kernel for versions less than 5.15.173.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilcparsejoinbssparam In the wilcparsejoinbssparam function, the TSF field of the ies structure is accessed after the RCU read-side critical section is unlocked. According to...
mptcp: pm: only decrement add_addr_accepted for MPJ req
...
SUSE CVE-2024-47167
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio's asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...
Server-side Request Forgery (SSRF)
Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the asyncsaveurltocache function in the /queue/join endpoint. An attacker can send HTTP requests to...
CVE-2024-47167: Server-Side Request Forgery (SSRF)
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...
PT-2024-32807 · Idurar · Idurar
Name of the Vulnerable Software and Affected Versions: IDURAR affected versions not specified Description: The issue exists in the corePublicRouter.js file of IDURAR, an open-source ERP CRM accounting invoicing software. A public endpoint is accessible to unauthenticated users, and user input is...
VulnCheck KEV: CVE-2024-4325
A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...
PT-2024-32292 · Opendaylight · Opendaylight Authentication
Name of the Vulnerable Software and Affected Versions: OpenDaylight Authentication, Authorization and Accounting AAA versions through 0.19.3 Description: An issue was discovered in OpenDaylight Authentication, Authorization and Accounting AAA. A rogue controller can join a cluster to impersonate ...
CVE-2024-46943: .NET Misconfiguration: Use of Impersonation
An issue was discovered in OpenDaylight Authentication, Authorization and Accounting AAA through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information...