CVE-2024-11149 OpenBSD vmm GDTR limits

In OpenBSD 7.4 before errata 014, vmm4 did not restore GDTR limits properly on Intel VMX CPUs...

CVE-2024-11149

In OpenBSD 7.4 before errata 014, vmm4 did not restore GDTR limits properly on Intel VMX CPUs...

CVE-2024-11149: Undefined Security Weakness

In OpenBSD 7.4 before errata 014, vmm4 did not restore GDTR limits properly on Intel VMX CPUs...

PT-2024-16788

Name of the Vulnerable Software and Affected Versions OpenBSD version 7.4 before errata 014 Description The issue is related to the vmm4 not restoring GDTR limits properly on Intel VMX CPUs. This problem affects OpenBSD 7.4 before errata 014. No information is provided about the estimated number ...

CVE-2024-11316

Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

CVE-2024-48843: Allocation of Resources Without Limits or Throttling

Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

GHSA-GJGR-7834-RHXR Synapse's unauthenticated writes to the media repository allow planting of problematic content

Impact Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticate...

Synapse's unauthenticated writes to the media repository allow planting of problematic content

Impact Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticate...

Synapse denial of service through media disk space consumption

Impact Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging fro...

Mozilla Firefox Thunderbird Spoofing

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an improper limitation on the visually displayed user interface layers. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks using a specially created file with th...

Dell Wyse Management Suite Auth Bypass

The vulnerability of the hybrid cloud solution for managing thin clients in the Dell Wyse Management Suite is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to bypass security measures remotely...

Security Bulletin: Financial Transaction Manager v4 is impacted by multiple vulnerabilities in IBM Java SE

Summary Multiple vulnerabilities were addressed in Financial Transaction Manager v4.0.6.0 iFix4 Vulnerability Details CVEID:CVE-2024-21147 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality, high integrity...

Siemens SINEMA Remote Connect Component Credential Disclosure

The vulnerability of the Client Communication component in the Siemens SINEMA Remote Connect server is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to obtain encrypted user credentials remotely...

PT-2024-8789 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions WMS 4.4 and prior Description: The issue is related to an Improper Restriction of Excessive Authentication Attempts, which could be exploited by a high privileged attacker with remote access, leading to...

GHSA-R4PG-VG54-WXX4 cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

CVE-2024-52581: Allocation of Resources Without Limits or Throttling

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

Password Pusher 安全漏洞

Password Pusher is an open source application by Peter Giacomo Lombardo, an individual developer, used to deliver sensitive information over the web. A security vulnerability exists in Password Pusher prior to v1.49.0, which stems from the ability to bypass the rate limiter by spoofing the proxy...

SUSE CVE-2024-50297

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets in dql after dma engine starts causes race condition. Tx transfer starts once dma engine is started and may execute dql dequeue in completion...

DEBIAN-CVE-2024-50297

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets in dql after dma engine starts causes race condition. Tx transfer starts once dma engine is started and may execute dql dequeue in completion...

DEBIAN-CVE-2024-50271

In the Linux kernel, the following vulnerability has been resolved: signal: restore the overriderlimit logic Prior to commit d64696905554 "Reimplement RLIMITSIGPENDING on top of ucounts" UCOUNTRLIMITSIGPENDING rlimit was not enforced for a class of signals. However now it's enforced...