CVE-2024-11741

A flaw was found in Grafana Alerting VictorOps, Integration is not properly protected and could be exposed to users with Viewer permission. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...

CVE-2024-0136

An improper isolation vulnerability was found in the NVIDIA Container Toolkit, where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a non-defaul...

CVE-2024-12747

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass...

CVE-2024-21980

A flaw was found in SNP firmware. This vulnerability allows a malicious hypervisor to overwrite a guest's memory or UMC seed, resulting in loss of confidentiality and integrity via improper restriction of write operations. Mitigation Available mitigation requires to update BIOS for updating...

CVE-2024-40896

A flaw was found in libxml2. In the affected versions of libxml2, the SAX parser can generate events for external entities, even if custom SAX handlers try to override entity content by setting it to "checked." This vulnerability allows classic XML External Entity XXE attacks. Mitigation Mitigati...

CVE-2024-54479

A flaw was found in webkitgtk. In affected versions of this package, processing maliciously crafted web content may lead to an unexpected process crash. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteri...

CVE-2024-12840

A server-side request forgery exists in Satellite. When a PUT HTTP request is made to /httpproxies/testconnection, when supplied with the httpproxies variable set to localhost, the attacker can fetch the localhost banner. Mitigation Mitigation for this issue is either not available or the current...

CVE-2024-53270

A flaw was found in Envoy. In systems where http1serverabortdispatch is configured, Envoy does not properly handle the control flow during H1 stream resets. This can trigger a null pointer error and lead to an application crash. Mitigation Mitigation for this issue is either not available or the...

CVE-2024-50152

A doubly freeing memory vulnerability exists in the Linux kernel smb client. After the first successful memory allocation for 'ea', the second memory release for 'ea' will result in double free, leading to loss of availability of the system. Mitigation Mitigation for this issue is either not...

CVE-2021-44549

A vulnerability was found in Apache Sling Commons Messaging Mailangus-mail, which provides a simple interface for sending emails via SMTPS in OSGi, does not offer an option to enable server identity checks, leaving connections vulnerable to "man-in-the-middle" attacks and can allow insecure email...

CVE-2024-40866

A flaw was found in WebKit. This flaw allows a remote attacker to conduct spoofing attacks by exploiting an inconsistent user interface issue. The attacker could perform address bar spoofing by tricking a victim into visiting a specially crafted website. Mitigation Mitigation for this issue is...

CVE-2024-8097

An exposure of sensitive information flaw via an unauthorized actor vulnerability was found in the Payara Platform Payara Server logging modules. This issue allows sensitive credentials to be posted in plain text on the server log. Mitigation Mitigation for this issue is either not available or t...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

CVE-2024-3772

A flaw was found in Pydantic, where it did not properly validate regular expressions containing white spaces. This flaw allows remote users to cause a denial of service attack via a crafted email string. Mitigation Mitigation for this issue is either not available or the currently available optio...

CVE-2023-49994

A flaw was found in the espeak-ng package. A local attacker can use a specially crafted payload to trigger a floating point exception error, which may lead to a denial of service. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red H...

CVE-2023-39017

A code injection vulnerability was found in quartz-jobs. The issue resides in the org.quartz.jobs.ee.jms.SendQueueMessageJob.execute component, where an unchecked argument can trigger the vulnerability. Mitigation Mitigation for this issue is either not available or the currently available option...

CVE-2022-48571

A buffer overflow flaw was found in memcached. This issue occurs via multi-packet uploads in UDP, leading to a denial of service. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use...

CVE-2023-26125

A flaw was found in Gin-Gonic Gin. This flaw allows a remote attacker to bypass security restrictions caused by improper input validation. An attacker can perform cache poisoning attacks by sending a specially-crafted request using the X-Forwarded-Prefix header. Mitigation Mitigation for this iss...

PT-2023-33042 · Unknown · Xmlrpc Client

Name of the Vulnerable Software and Affected Versions: xmlrpc Client affected versions not specified Description: The issue allows an attacker to force the client to access local files or connect to undesired URLs instead of the intended target server's URL. This is possible by abusing the $metho...

When user of GroupBuy is a contract, refunds will be permanently frozen.

Lines of code Vulnerability details Description claim function is used in GroupBuy to mint Raes proportional to user's contribution to the purchased NFT. withdrawBalance is used to get back funds which are not part of the contribution. They both contain an unsafe call with ETH. For example:...