CVE-2024-2874

CVE-2024-2874 affects GitLab CE/EE: all versions before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. Root cause: a runner registered with a crafted description can disrupt loading of targeted GitLab web resources, yielding a HIGH impact on availability (CVSS 3.1 base 6.5). Exploitation ...

CVE-2024-2874 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources...

Apache Tomcat 9.0.0.M1 < 9.0.0.M10 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.0.M10. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.0.m10security-9 advisory. - The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4,...

PT-2024-30854 · Jenkins +1 · Cas +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to a lack of validation for a parameter before making a request to it. This could allow unauthenticated users to perform a Server-Side Request Forgery SSRF attack. SSR...

GitLab CE/EE 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab CE/EE versions prior to 16.10.6, 16.11.3, an...

Apache Tomcat 8.0.0.RC1 < 8.0.37 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.0.37. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.5and8.0.37security-8 advisory. - The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4,...

GitLab < 16.10.6 / 16.11 < 16.11.3 / 17.0 < 17.0.1 (CVE-2024-2874)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potenti...

CVE-2021-47479 staging: rtl8712: fix use-after-free in rtl8712_dl_fw

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix use-after-free in rtl8712dlfw Syzbot reported use-after-free in rtl8712dlfw. The problem was in race condition between r871xudevremove -ndoopen callback. It's easy to see from crash log, that driver accesses...

DEBIAN-CVE-2021-47466

In the Linux kernel, the following vulnerability has been resolved: mm, slub: fix potential memoryleak in kmemcacheopen In error path, the randomseq of slub cache might be leaked. Fix this by using kmemcacherelease to release all the relevant resources...

CVE-2021-47466 mm, slub: fix potential memoryleak in kmem_cache_open()

In the Linux kernel, the following vulnerability has been resolved: mm, slub: fix potential memoryleak in kmemcacheopen In error path, the randomseq of slub cache might be leaked. Fix this by using kmemcacherelease to release all the relevant resources...

Important: bind and dhcp security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. The Dynamic Hos...

The vulnerabilities of Microsoft .NET software platforms and Microsoft Visual Studio development tools are caused by synchronization errors when using shared resources, allowing attackers to trigger service failures.

The vulnerabilities of Microsoft .NET software platforms and Microsoft Visual Studio development tools stem from synchronization errors when using shared resources. Exploiting these vulnerabilities can allow a malicious actor to cause service interruptions...

The vulnerability of GE HealthCare EchoPAC medical software lies in the incorrect granting of permissions for critical resources, allowing an intruder to gain unauthorized access to protected information, enhance their privileges, or execute arbitrary codes.

The vulnerability of GE HealthCare EchoPAC medical software is related to the incorrect granting of permissions for critical resources. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information, increase their privileges, or execute arbitrary code...

DEBIAN-CVE-2023-52730

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths If sdioaddfunc or sdioinitfunc fails, sdioremovefunc can not release the resources, because the sdio function is not presented in these two cases, it won't call ofnodeput...

CVE-2023-52792

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Do not try to cleanup after cxlregionsetuptargets fails Commit 5e42bcbc3fef "cxl/region: decrement -nrtargets on error in cxlregionattach" tried to avoid 'eiw' initialization errors when -nrtargets exceeded 16, by jus...

CVE-2023-52747 IB/hfi1: Restore allocated resources on failed copyout

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Restore allocated resources on failed copyout Fix a resource leak if an error occurs...

DEBIAN-CVE-2021-47361

In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcballocbus There are two bugs: 1 If idasimpleget fails then this code calls putdevicecarrier but we haven't yet called getdevicecarrier and probably that leads to a use after free. 2 After...

CVE-2021-47313

In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix potential memleak in cppccpufreqcpuinit It's a classic example of memleak, we allocate something, we fail and never free the resources. Make sure we free all resources on policy -init failures...

DEBIAN-CVE-2021-47283

In the Linux kernel, the following vulnerability has been resolved: net:sfc: fix non-freed irq in legacy irq mode SFC driver can be configured via modparam to work using MSI-X, MSI or legacy IRQ interrupts. In the last one, the interrupt was not properly released on module remove. It was not free...

CVE-2021-47410

CVE-2021-47410 concerns the Linux kernel where the AMDGPU/KFD stack emitted a warning trace due to the function svm_migrate_fini releasing device resources via devm_memunmap_pages and devm_release_mem_region after a patch that split amdgpu_device_fini into early/late phases. The root cause is the...