CVE-2024-3381

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2023-7259

DISPUTED A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown part of the component Adduser Page. The manipulation of the argument username with the input alert1 leads to cross site scripting. It is possible to initiate the...

CVE-2023-7259

CVE-2023-7259 concerns zzdevelop lenosp, Adduser Page, where the username parameter can be manipulated to trigger cross-site scripting. Affected versions are stated as up to 20230831. Descriptions across sources indicate the vulnerability may be exploitable remotely and involve XSS in the Adduser...

kernel: netfilter: nf_tables: disallow anonymous set with timeout flag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFTSETEVAL to ensure legacy meters still work...

CVE-2021-47441 mlxsw: thermal: Fix out-of-bounds memory accesses

In the Linux kernel, the following vulnerability has been resolved: mlxsw: thermal: Fix out-of-bounds memory accesses Currently, mlxsw allows cooling states to be set above the maximum cooling state supported by the driver: cat /sys/class/thermal/thermalzone2/cdev0/type mlxswfan cat...

CVE-2021-47441

CVE-2021-47441 concerns the Linux kernel mlxsw thermal driver. The issue arises when cooling state is set above the driver’s maximum state (e.g., cur_state=18 while max_state=10), which triggers out-of-bounds memory accesses in thermal statistics code. The thermal maintainer indicates it is the d...

UBUNTU-CVE-2021-47300

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix tailcallreachable rejection for interpreter when jit failed During testing of f263a81451c1 "bpf: Track subprog poke descriptors correctly and fix use-after-free" under various failure conditions, for example, when...

DEBIAN-CVE-2024-35900

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table existing and new. The following configuration allows...

Debian dsa-5684 : gir1.2-javascriptcoregtk-4.0 - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5684 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5684-1 [email protected]...

CVE-2023-52651

A potential NULL pointer dereference flaw was found in ath10kwmitlvoppullmgmttxcomplev in the Linux kernel. This issue may lead to a crash...

CentOS 7 : rhc-worker-script (RHSA-2024:2625)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2625 advisory. - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK sta...

AlmaLinux 9 : golang (ALSA-2024:1963)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1963 advisory. - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state...

CVE-2024-30708

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability...

CVE-2024-2866

Rejected reason: REJECT Accidental reservation. Please use CVE-2024-2509...

GO-2024-2687 HTTP/2 CONTINUATION flood in net/http

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

kernel security update

4.18.0-513.18.1.0.19.OL8 - netfilter: nftables: reject QUEUE/DROP verdict parameters Orabug: 36461932 CVE-2024-1086 4.18.0-513.18.19.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

CVE-2024-1992

Rejected reason: Rejected as duplicate of CVE-2024-2306...

CVE-2024-0450 Quoted zip-bomb protection for zipfile

An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython...

CVE-2024-2467

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...