CLSA-2024-1707919380 openssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" in ssh and sshd - Moved ELS patches to the top to avoid patch conflicts...

`conrod` is unmaintained

The crate conrod has been deprecated since version 0.62.0 released in December 2018. The functionality was split across multiple different crates, with the core functionality being transferred to conrodcore. An overview can be found in the conrod repository. If you have this crate in your...

AZL-34898 CVE-2023-5408 affecting package kubernetes for versions less than 1.29.1-2

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the clust...

SUSE CVE-2015-3187

The svnrepostracenodelocations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path...

RUSTSEC-2021-0134 rental is unmaintained, author has moved on

The author encourages users to explore other solutions, or maintain a fork. Maintained alternatives include: ouroboros fortify escher...

GHSA-GPFH-JVF9-7WG5 Use after free / memory leak in `CollectiveReduceV2`

Impact The async implementation of CollectiveReduceV2 suffers from a memory leak and a use after free: python import tensorflow as tf tf.rawops.CollectiveReduceV2 input=, groupsize=-10, -10, -10, groupkey=-10, -10, instancekey=-10, orderingtoken=, mergeop='Mul', finalop='Div' This occurs due to t...

Google TensorFlow 资源管理错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A resource management error vulnerability exists in Google TensorFlow due to a memory leak and post-release usage issue in the asynchronous implementation of CollectiveReduceV2. This occurs due to...

GHSA-RXR4-X558-X7HW Double free in smallvec

If an iterator passed to SmallVec::insertmany panicked in Iterator::next, destructors were run during unwinding while the vector was in an inconsistent state, possibly causing a double free a destructor running on two copies of the same value. This is fixed in smallvec 0.6.3 by ensuring that the...

CVE-2020-4039 Directory Traversal Vulnerability in SUSI.AI Server

SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved o...

PT-2021-8003 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a potential out of bounds condition in the do format function of the ataflop component. The function uses the type variable as an array index, but the bounds...

h1-ctf: Hacky Holidays Writeup

On December 12th, 2020, the CTF became live and the scope that we are allowed to attack was In Scope Domain - hackyholidays.h1ctf.com Our main motive was to infiltrate his network and take him down. The challenges appeared one by one till 24th of December. Here we will be going through all the...

Prototype Pollution

Overview eivindfjeldstad-dot is a module that Gets and sets object properties with dot notation. Note: this package has been deprecated and moved into @eivifj/dot. Affected versions of this package are vulnerable to Prototype Pollution. The function set could be tricked into adding or modifying...

Open Network Operating System (ONOS) Code Unexpected Execution Vulnerability

Open Network Operating System ONOS is a carrier-grade SDN network operating system for service providers and enterprise backbones. A code unintended execution vulnerability exists in Open Network Operating System ONOS 1.14. The vulnerability stems from a host event listener in the Ethernet VPN...

Open Network Operating System (ONOS) Code Unexpected Execution Vulnerability (CNVD-2020-14220)

Open Network Operating System ONOS is a carrier-grade SDN network operating system for service providers and enterprise backbones. A code unintended execution vulnerability exists in Open Network Operating System ONOS 1.14. The vulnerability stems from a host event listener in the P4 tutorial...

Open Network Operating System (ONOS) Code Unexpected Execution Vulnerability (CNVD-2020-14221)

Open Network Operating System ONOS is a carrier-grade SDN network operating system for service providers and enterprise backbones. A code unintended execution vulnerability exists in Open Network Operating System ONOS 1.14. The vulnerability stems from a host event listener not handling the...

CVE-2019-16301

An issue was discovered in Open Network Operating System ONOS 1.14. In the virtual tenant network application org.onosproject.vtn, the host event listener does not handle the following event types: HOSTMOVED. In combination with other applications, this could lead to the absence of intended code...

CVE-2019-16297

An issue was discovered in Open Network Operating System ONOS 1.14. In the P4 tutorial application org.onosproject.p4tutorial, the host event listener does not handle the following event types: HOSTMOVED, HOSTREMOVED, HOSTUPDATED. In combination with other applications, this could lead to the...

CVE-2019-16298

An issue was discovered in Open Network Operating System ONOS 1.14. In the virtual broadband network gateway application org.onosproject.virtualbng, the host event listener does not handle the following event types: HOSTMOVED, HOSTREMOVED, HOSTUPDATED. In combination with other applications, this...

CVE-2019-16302

An issue was discovered in Open Network Operating System ONOS 1.14. In the Ethernet VPN application org.onosproject.evpnopenflow, the host event listener does not handle the following event types: HOSTMOVED, HOSTUPDATED. In combination with other applications, this could lead to the absence of...

PT-2019-6800

Name of the Vulnerable Software and Affected Versions libuser affected versions not specified Description The issue is related to information disclosure when the user's home directory is moved. Recommendations At the moment, there is no information about a newer version that contains a fix for th...