python: incorrect IPv4 and IPv6 private ranges

A flaw was found in Python. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. Due to this issue, it is possible that values will not be returned in accordance with the latest information from th...

CVE-2024-45806 Potential manipulate `x-envoy` headers from external sources in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration ...

UBUNTU-CVE-2024-8641

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CIJOBTOKEN to obtain a GitLab session token belonging to the victim...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab EE versions 12.9 through before...

Payara Server 安全漏洞

Payara Server is a cloud-native, innovative, open source middleware platform from Payara UK. A security vulnerability exists in Payara Server that stems from allowing sensitive credentials to be published in plain text in server logs. The following versions are affected: version 6.0.0 through to...

PT-2024-10355

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.8 Open Social versions 12.4.0 through 12.4.5 Open Social versions 13.0.0 through 13.0.0-alpha11 Description The issue is related to improper neutralization of input during web page generation, allowing...

CVE-2024-42057

A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50W series firmware versions from V4.16 through V5.38, and USG20W-VPN series firmware versions from V4.16...

CVE-2024-42058

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50W series firmware versions from V5.20 through V5.38, and USG20W-VPN series firmware versions from V5.20 through V5.38 cou...

Apache Range Header Denial of Service (Apache Killer)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Range Header DoS Apache Killer', 'Description' = %q The byterange filter in the Apache HTTP Server 2.0.x through 2.0.64, and 2.2.x through...

python: incorrect IPv4 and IPv6 private ranges

A flaw was found in Python. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. Due to this issue, it is possible that values will not be returned in accordance with the latest information from th...

python: incorrect IPv4 and IPv6 private ranges

A flaw was found in Python. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. Due to this issue, it is possible that values will not be returned in accordance with the latest information from th...

VMware Spring Boot 安全漏洞

VMware Spring Boot is a set of open source frameworks from VMware. A security vulnerability exists in VMware Spring Boot that stems from vulnerability to signature forgery attacks. The following products and versions are affected: Versions 2.7.0 through 2.7.21, 3.0.0 through 3.0.16, 3.1.0 through...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. An Access Control Error vulnerability exists in Mattermost versions 9.5.x through 9.5.7 and 9.10.x through 9.10.0, which stems from a failure to enforce proper access control and can be exploited by an...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 17.0 through 17.1.6, 17.2 through 17.2.4, and 17.3 through 17.3.1, which stems from an arbitrary command that can be executed via...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 9.9.x through 9.9.1, 9.5.x through 9.5.7, 9.10.x through 9.10.0, and 9.8.x through 9.8.2, which stems from an inability to restrict which roles ca...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2024:2959-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2959-1 advisory. - CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges bsc1226448. - Stop using %%defattr, it seems to be breaking proper executable...

SUSE-SU-2024:2959-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges bsc1226448. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts bsc1227378...

DEBIAN-CVE-2024-43823

In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in kspciesetuprcappregs If IORESOURCEMEM is not provided in Device Tree due to any error, resourcelistfirsttype will return NULL and pciparserequestofpciranges will...

CVE-2024-43823 PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()

In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in kspciesetuprcappregs If IORESOURCEMEM is not provided in Device Tree due to any error, resourcelistfirsttype will return NULL and pciparserequestofpciranges will...

CVE-2023-20584

IOMMU improperly handles certain special address ranges with invalid device table entries DTEs, which may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest integrity...