Security Bulletin: Multiple Vulnerabilities in Expat component shipped with IBM Rational ClearCase ( CVE-2023-52426 )

Summary libexpat is a stream-oriented XML parser library used by IBM Rational ClearCase. IBM Rational ClearCase has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-52426 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by an XML entity expansion flaw if XMLDT...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in fast-xml-parser

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of fast-xml-parser. Vulnerability Details CVEID:CVE-2024-41818 DESCRIPTION: Natural Intelligence fast-xml-parser is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...

CVE-2025-26803

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...

mysql: Parser unspecified vulnerability (CPU Jan 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

Azure Linux 3.0 Security Update: python-tensorboard / reaper (CVE-2024-45590)

The version of python-tensorboard / reaper installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45590 advisory. - body-parser is Node.js body parsing middleware. body-parser 1.20.3 is vulnerable to...

CVE-2024-57071

CVE-2024-57071 affects php-parser v3.2.1 through a prototype pollution in the lib.combine function, enabling DoS with a crafted payload. Connected sources confirm the vulnerability and provide a workaround (disable lib.combine) while noting no public exploit details in the documents. Exploitation...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

Vulnerabilities fixed in Zimbra Collaboration

Zimbra has fixed several vulnerabilities in Zimbra Collaboration. The vulnerabilities included an SQL injection in the ZimbraSyncService SOAP endpoint and an SSRF vulnerability in the RSS feed parser that allowed unauthorized access and manipulation of the database, as well as unauthorized...

Authentication Bypass

github.com/tyktechnologies/tyk-identity-broker is vulnerable to Authentication Bypass. The vulnerability is due to the Go XML parser not guaranteeing integrity during the XML round-trip encoding/decoding XML data, which allows for the bypassing of SAML authentication...

CVE-2024-53981

CVE-2024-53981 affects Python package python-multipart, a streaming multipart parser. The issue occurs while parsing form data: the parser skips CR/LF line breaks in front of the first boundary and after the last boundary, emitting a log event for each byte processed. This can be abused by sendin...

CVE-2024-46935

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service DoS. Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser...

Stack-based Buffer Overflow

Overview google-protobuf is a Google's data interchange format. Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the parsing of nested groups or series of SGROUP tags as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against...

CVE-2024-34026

A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted EtherNet/IP request can lead to remote code execution. An attacker can send a series of EtherNet/IP requests to...

Denial Of Service (DoS)

body-parser is vulnerable to Denial Of Service DoS. The vulnerability is due to inadequate handling of url encoding in body-parser, which allows an attacker to flood the server with excessive requests, potentially disrupting the server’s availability...

AZL-49071 CVE-2024-45590 affecting package python-tensorboard for versions less than 2.16.2-5

body-parser is Node.js body parsing middleware. body-parser 1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in...

01-numacert (>=1.0.0 <=3.0.0), 10by10-react-app (=1.2.1) +16010 more potentially affected by CVE-2024-45590 via body-parser (>=1.0.0 <=1.20.2)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.2.0, =0.0.28, =0.0.1, =1.0.8, =1.0.15 and more Source cves: CVE-2024-45590 Source advisory: OSV:GHSA-QWCR-R2FM-QRC7...

body-parser 安全漏洞

body-parser is a Node.js parsing middleware open source by expressjs. A security vulnerability exists in body-parser versions prior to 1.20.3, which is rooted in a susceptibility to a denial of service attack, where an attacker can cause a denial of service by sending a large number of requests t...

The vulnerability of the vrrp_ipset_handler function (fglobal parser.c) in the network traffic balancing system of Keepalived, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vrrpipsethandler function fglobal parser.c in the network traffic balancing system Keepalived is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Expected Behavior Violation

Overview Affected versions of this package are vulnerable to Expected Behavior Violation via the HPackParser function when the gRPC client is communicating with an HTTP/2 proxy, allowing the attacker to poison the HPACK table. By manipulating the header encoding and poisoning the HPACK table...

The vulnerability of the yyparse() function in the syntax analyzer and tools for the YANG modeling language Libyang allows a perpetrator to execute arbitrary code or cause service failures.

The vulnerability of the yyparse function in the syntax analyzer and modeling tool of the YANG Libyang language is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures remotely...