CVE-2024-21085

CVE-2024-21085 is described across multiple sources as a low-severity issue affecting Oracle Java SE and GraalVM/OpenJDK components. Affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13, 21.3.9 (plus related OpenJDK/OpenJDK11 advisories). The vulnera...

CVE-2024-21011

CVE-2024-21011 affects Oracle Java SE platforms (Hotspot) and Oracle GraalVM for JDK/Enterprise Edition. Affected versions include Java SE: 8u401, 11.0.22, 17.0.10, 21.0.2, 22; GraalVM for JDK: 17.0.10, 21.0.2, 22; GraalVM EE: 20.3.13, 21.3.9. The vulnerability is exploitable over a network by un...

PT-2024-4911

Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology versions 8.5.6 through 8.5.7 Description: The issue is related to insufficient input validation in the Outside In Core component of Oracle Outside In Technology, allowing a low-privileged attacker with logon to th...

CVE-2024-2756

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

PT-2024-13985 · Accredible · Accredible Credential.Net

Name of the Vulnerable Software and Affected Versions: Accredible Credential.net affected versions not specified Description: The API in Accredible Credential.net allows an Insecure Direct Object Reference attack, which discloses partial information about certificates and their respective holders...

Oracle MySQL 安全漏洞

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server, which can be exploited by an attacker to cause unauthorized update, insert, or delete access to MySQL Server-accessible data, as well as unauthorized read access to a subs...

PT-2024-4349 · Oracle +1 · Oracle Graalvm For Jdk +2

Name of the Vulnerable Software and Affected Versions: Oracle GraalVM for JDK versions 17.0.10, 21.0.2, 22 Oracle GraalVM Enterprise Edition versions 20.3.13, 21.3.9 Description: The issue is related to a vulnerability in the Compiler component of Oracle GraalVM for JDK and Oracle GraalVM...

Slackware: Security Advisory (SSA:2024-103-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2024-1442 libgsasl security update

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms. Security Fixes: GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API...

GHSA-J85Q-46HG-36P2 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...

SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...

CVE-2024-1412

The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all versions up to, and including, 1.11.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-0080

NVIDIA nvTIFF Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted input file. A successful exploit of this vulnerability might lead to a partial denial of service...

SUSE CVE-2024-26665

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in docsum+0x220/0x240 Read of size 4 at addr...

PT-2024-12257 · Nvidia · Nvidia Nvjpeg2000 Library

Name of the Vulnerable Software and Affected Versions: NVIDIA nvJPEG2000 Library for Windows and Linux affected versions not specified Description: The NVIDIA nvJPEG2000 Library contains a vulnerability due to improper input validation, which could allow an attacker to use a specially crafted inp...

The vulnerability of the software for implementing the hypertext environment MediaWiki, related to improper input cancellation during page creation, allows a violator to carry out cross-site scripting attacks.

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to the possibility of exploiting XSS attacks in the partial block function. Exploiting this vulnerability could allow a malicious actor, operating remotely, to carry out cross-site scripting attacks...

PT-2024-15333 · Nvidia +1 · Nvidia Cuda Toolkit +1

Name of the Vulnerable Software and Affected Versions: NVIDIA CUDA toolkit affected versions not specified Description: The NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm. An attacker may cause a crash by tricking a user into reading a malformed ELF file,...

UBUNTU-CVE-2023-52636

In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all readpartial...

UBUNTU-CVE-2024-26665

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in docsum+0x220/0x240 Read of size 4 at addr...

CVE-2023-52636 libceph: just wait for more data to be available on the socket

In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all readpartial...