9046 matches found
CVE-2024-46756
Removed by vendor...
CVE-2024-46745 Input: uinput - reject requests with unreasonable number of slots
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in inputmtinitslot...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly limiting the number of slots...
PT-2024-11699 · WordPress · Wp Limit Login Attempts
Name of the Vulnerable Software and Affected Versions: Limit Login Attempts Plus plugin for WordPress versions up to, and including, 1.1.0 Description: The issue arises from insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions...
Intel Processors 安全漏洞
Intel Processors are American Intel Corporation's provide for interpreting computer instructions and processing data in computer software. A security vulnerability exists in Intel Processors that stems from a potential security flaw in the Running Average Power Limit RAPL interface that could lea...
MGASA-2024-0297 Updated botan2 packages fix security vulnerability
An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at mos...
PT-2024-34100
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises when the caller supplies an iocb-ki pos value close to the filesystem upper limit, and an iterator with a count that causes an overflow of that limit, resulting in...
The vulnerability of the LibGD graphics library, related to reading beyond the allowed buffer data limits, allows attackers to cause service interruptions.
The vulnerability of the LibGD graphics library is related to reading data beyond the acceptable buffer limit. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
CVE-2024-23185
Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "fullvalue" buffer out of the smaller chunks. The fullvalue buffer has no si...
Fedora: Security Advisory (FEDORA-2024-e23e8a3f1e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
path-to-regexp outputs backtracking regular expressions
Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period .. For example, /:a-:b. Patches For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. These versions add backtrack protection...
CLSA-2024-1725871927 kernel: Fix of 30 CVEs
gfs2: Fix potential glock use-after-free on unmount CVE-2024-38570 - gfs2: Remove ill-placed consistency check CVE-2024-38570 - gfs2: introduce new gfs2glockassertwithdraw CVE-2024-38570 - gfs2: simplify gdlmputlock with outfree label CVE-2024-38570 - wifi: mt76: replace skbput with skbputzero...
PT-2024-6387 · Zyxel · Zyxel Nas326 +1
Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 versions through V5.21AAZF.18C0 Zyxel NAS542 versions through V5.21ABAG.15C0 Description: A command injection vulnerability in the export-cgi program of Zyxel NAS326 and NAS542 firmware could allow an unauthenticated attacker to...
CVE-2024-45300
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply...
CVE-2024-45300
Vulnerability summary (CVE-2024-45300) : alf.io prior to version 2.0-M5 contains a race condition that lets an attacker bypass the promo-code usage limit and apply a discount coupon multiple times. The underlying issue is a timing gap between checking code usage and enforcing the limit, enabling ...
alf.io 安全漏洞
Alf.io is a free and open source event attendance management system open-sourced by Alf.io. A security vulnerability exists in versions of alf.io prior to 2.0-M5, which stems from a race condition that could allow a user to bypass the quantity limit of a promotional code and use a discount coupon...
Allocation Of Resources Without Limits
Eclipse Vert.x gRPC server is vulnerable to Allocation Of Resources Without Limits. The vulnerability is due to the gRPC server not limiting the maximum length of the message payload, allowing excessively large messages to be processed...
SUSE CVE-2024-45008
In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at inputmtinitslots, for numslots is supplied from userspace using ioctlUIDEVCREATE. Since nobody knows possible max slots, this patch chose 1024...
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack
Impact sigstore-go is susceptible to a denial of service attack when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these...