PT-2023-4571 · Python +11 · Python +11

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.11.4 Description: A critical issue in the urllib.parse component of Python allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters, enabling domain filter bypass, file...

Allocation of Resources Without Limits or Throttling

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder,...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

PT-2023-12921 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham versions prior to 103.30221005.0 Description: The issue concerns an unauthenticated endpoint in Palantir Gotham that lists all active usernames on the stack with an active session. The affected services have been patched and...

PT-2023-13447 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC versions prior to 0.72 Description: The issue is an out of bounds read in the firmware for OpenBMC in some Intel platforms, which may allow an unauthenticated user to potentially enable denial of service via network access...

PT-2023-13326 · Intel · Intel Sur

Name of the Vulnerable Software and Affected Versions: IntelR SUR software versions prior to 2.4.8902 Description: The issue is related to improper authentication, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions...

PT-2023-16567

Name of the Vulnerable Software and Affected Versions modoboa/modoboa-installer versions prior to 2.0.4 Description The issue is related to improper restriction of excessive authentication attempts. This can potentially lead to exploitation. Recommendations For versions prior to 2.0.4, update to...

PT-2023-12923 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham versions prior to 3.22.11.2 Description: The issue concerns an unauthenticated endpoint that loads portions of maliciously crafted zip files to memory. An attacker could exploit this by repeatedly uploading a malicious zip fil...

PT-2023-12858 · Intel · Intel Trace Analyzer/Collector

Name of the Vulnerable Software and Affected Versions: IntelR Trace Analyzer and Collector versions prior to 2021.6 for IntelR oneAPI HPC Toolkit Description: The issue is related to an uncontrolled search path element in the IntelR Trace Analyzer and Collector, which may allow an authenticated...

PT-2023-1606 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.4.10 and earlier, 7.0.0 through 7.0.8, 7.2.0 through 7.2.2 FortiProxy versions 2.0.10 and earlier, 7.0.0 through 7.0.7, 7.2.0 through 7.2.1 FortiSwitchManager versions 7.0.0 and earlier, 7.2.0 Description: A relative path...

PT-2023-3053 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.0 through 7.0.3 Description: The issue is related to a double free in the software, which may allow an attacker to execute unauthorized code or commands via specially crafted commands. This can potentially enable an...

SUSE CVE-2020-5236

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...

SUSE CVE-2021-21350

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to set...

SUSE CVE-2021-43797

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fa...

SUSE CVE-2022-1941

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...

SUSE CVE-2022-24706

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front o...

SUSE CVE-2022-24836

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue...

SUSE CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

SUSE CVE-2022-42896

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may allow code execution and leaking kernel memory respectively remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via...

PT-2023-2270 · Solarwinds · Solarwinds Server/Application Monitor

Name of the Vulnerable Software and Affected Versions: Solarwinds Server & Application Monitor affected versions not specified Description: The issue is related to weaknesses in the authentication procedure, allowing a remote attacker to bypass authentication and access confidential information...