CVE-2024-39305 Envoy Proxy use after free when route hash policy is configured with cookie attributes

Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be...

CVE-2024-6425 Incorrect Provision of Specified Functionality vulnerability in MESbook

Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=&Password=&ConfirmPassword="...

PT-2024-37617 · Mesbook · Mesbook

Name of the Vulnerable Software and Affected Versions: MESbook version 20221021.03 Description: The issue allows an unauthenticated remote attacker to register user accounts without authentication. This can be done by accessing the "/account/Register/" route and providing parameters such as...

Libndp: buffer overflow in route information length field

...

PT-2024-5888 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.30.4 Envoy versions prior to 1.29.7 Envoy versions prior to 1.28.5 Envoy versions prior to 1.27.7 Description: The issue is related to a use-after-free error in the Envoy proxy server module. Exploitation of this iss...

kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flowoffloadadd fails, error path...

kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flowoffloadadd fails, error path...

SUSE-SU-2024:2205-1 Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005539 fixes several issues. The following security issues were fixed: - CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event bsc1218259. - CVE-2024-26852: Fixed use-after-free in ip6routempathnotify...

Malicious code in route-converter (npm)

--- -= Per source details. Do not edit below this line.=-...

SUSE-SU-2024:2202-1 Security update for the Linux Kernel (Live Patch 51 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122186 fixes several issues. The following security issues were fixed: - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets bsc1220537. - CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsyst...

BIT-OPENCART-2024-21515

This affects versions of the package opencart/opencart from 4.0.0-0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

MAL-2024-1663 Malicious code in @elza/auto-route-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0394416e392791c5f23be36b82f8800fa29bfd1381f8be67c7362338279c0d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @elza/auto-route-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0394416e392791c5f23be36b82f8800fa29bfd1381f8be67c7362338279c0d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37082 - mTLS bypass | Cloud Foundry

Severity CRITICAL Vendor CloudFoundry Foundation Versions Affected Routing Release 10.6.0 Description When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud...

Cross site scripting in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account...

GHSA-QX44-885H-7P56 Cross site scripting in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

CVE-2024-21515

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

CVE-2024-21515

CVE-2024-21515 affects opencart/opencart 4.0.0.0+. A reflected XSS in the filename parameter of the admin tool/log route could enable an attacker to trick an admin user into exposing a token, prompting login, and executing a payload after authentication. If the attacker has admin privileges, this...

SUSE CVE-2024-38589

In the Linux kernel, the following vulnerability has been resolved: netrom: fix possible dead-lock in nrrtioctl syzbot loves netrom, and found a possible deadlock in nrrtioctl 1 Make sure we always acquire nrnodelistlock before nrnodelocknrnode 1 WARNING: possible circular locking dependency...

Linux Kernel ICMPv6 Router Advertisement Race Condition Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Route Information options. The issue results from the lack of...