SUSE CVE-2022-49697

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-24818

GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case,...

PT-2025-37962

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6 Description The Linux kernel contains a flaw in the efivarfs module related to an out-of-bounds write in the efivarfs d compare function. This issue occurs when dentry-d name.len is less than EFI VARIABLE GUI...

USN-7136-1 python-django vulnerabilities

jiangniao discovered that Django incorrectly handled the API to strip tags. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. CVE-2024-53907 Seokchan Yoon discovered that Django incorrectly handled HasKey lookups when using Oracl...

GHSA-PCX7-8HXG-J823 Duplicate Advisory: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jgwc-jh89-rpgq. This link is maintained to preserve external references. Original Description A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service DoS attack...

Fedora 37 : java-1.8.0-openjdk (2022-dedbb92a08)

"The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-dedbb92a08 advisory. New in release OpenJDK 8u352 2022-10-18 Release announcement Full release notes Security Fixes JDK-8282252: Improve BigInteger/Decimal validation...

The vulnerability of the External Lookups technology in the Splunk Enterprise platform for operational analysis allows a malicious actor to escalate their privileges and execute arbitrary commands.

The vulnerability of Splunk Enterprise’s External Lookups technology relates to the improper elimination of certain elements used in the operating system’s command set. This occurs due to the use of data models for detecting unauthorized searches called SearchActivity. Exploiting this vulnerabili...

GO-2024-3166 Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf

Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf...

PT-2024-39748 · Red Hat · Keycloak Server

Name of the Vulnerable Software and Affected Versions: Keycloak Server affected versions not specified Description: A denial of service DoS attack is possible due to improper handling of proxy headers in the Keycloak Server. When configured to accept incoming proxy headers, Keycloak may accept...

PT-2024-31685 · Apache · Apache Druid

Name of the Vulnerable Software and Affected Versions: Apache Druid versions prior to 30.0.1 Description: The issue allows users with certain permissions to bypass restrictions on JDBC connections, potentially reading data from other database systems. This is possible by crafting a specific JDBC...

CLSA-2024-1725554505 unbound: Fix of CVE-2022-3204

CVE-2022-3204: add max number of lookups in the cache for target nameserver names...

USN-6992-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. CVE-2024-8382, CVE-2024-8383,...

DNS Amplification Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DNS Amplification Scanner', 'Description' = %q This module can be used to discover DNS servers which expose recursive name lookups which can be...

DNS Record Scanner and Enumerator

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DNS Record Scanner and Enumerator', 'Description' = %q This module can be used to gather information about a domain from a given DNS server by...

bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content

A flaw was found in the bind9 package, where a client query triggers stale data and also requires local lookups may trigger a assertion failure. This issue results in a denial of service of the bind server...

AZL-48771 CVE-2022-48887 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two...

UBUNTU-CVE-2024-42272

In the Linux kernel, the following vulnerability has been resolved: sched: actct: take care of padding in struct zoneshtkey Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zoneshtkey got a struct net pointer. Make sure rhashtablelookup is not using the padding bytes whic...

bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content

A flaw was found in the bind9 package, where a client query triggers stale data and also requires local lookups may trigger a assertion failure. This issue results in a denial of service of the bind server...

SUSE CVE-2024-4076

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

AZL-46966 CVE-2024-4076 affecting package bind for versions less than 9.20.0-1

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...