31333 matches found
binutils -- Multiple vulnerabilities
[email protected] reports PR/281070: A new version of devel/binutils has been released fixing CVE-2023-1972, CVE-2023-25585, CVE-2023-25586, and CVE-2023-25588...
PT-2024-28785 · Automad · Automad
Name of the Vulnerable Software and Affected Versions: Automad version 2.0.0-alpha.4 Description: A persistent stored cross-site scripting XSS vulnerability has been identified in Automad. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The...
Security update for libhtp (moderate)
openSUSE Security Update: Security update for libhtp Announcement ID: openSUSE-SU-2024:0150-2 Rating: moderate References: 1220403 Cross-References: CVE-2024-23837 Affected Products: openSUSE Backports SLE-15-SP6 An update that fixes one vulnerability is now available. Description: This update fo...
Cisco Unified Communications Manager DoS (cisco-sa-cucm-dos-kkHq43We)
According to its self-reported version, Cisco Unified Communications Manager running on the report host is affected by a denial of service DoS vulnerability. Due to improper processing of SIP messages, an unauthenticated, remote, attacker can cause the system to reload and thus stop responding...
BIT-VALKEY-2021-31294
Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command specifically, a SET command. NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this...
BIT-KEYDB-2021-32626 Lua scripts can overflow the heap-based Lua stack in Redis
Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote co...
BIT-KEYDB-2023-25155 Integer Overflow in several Redis commands can lead to denial of service.
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis...
CVE-2023-33976 affecting package tensorflow for versions less than 2.11.1-2
CVE-2023-33976 affecting package tensorflow for versions less than 2.11.1-2. A patched version of the package is available...
CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
Affected Packages The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are...
GHSA-6V96-M24V-F58J CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
Affected Packages The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are...
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability
Affected packages The vulnerability has been discovered in Code Snippet GeSHi plugin. All integrators that use GeSHi syntax highlighter on the backend side can be affected. Impact A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a...
CVE-2024-8003 Go-Tribe gotribe-admin Log routes.go InitRoutes deserialization
A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/app/routes/routes.go of the component Log Handler. The manipulation leads to deserialization. The patch is identified as...
LSN-0106-1 Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.CVE-2023-52620 In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work...
CVE-2023-42363 affecting package busybox for versions less than 1.35.0-11
CVE-2023-42363 affecting package busybox for versions less than 1.35.0-11. A patched version of the package is available...
CVE-2024-43851 soc: xilinx: rename cpu_number1 to dummy_cpu_number
In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: rename cpunumber1 to dummycpunumber The per cpu variable cpunumber1 is passed to xlnxeventhandler as argument "devid", but it is not used in this function. So drop the initialization of this variable and rename it to...
Medium: php8.2
Issue Overview: The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/138...
Medium: nodejs
Issue Overview: NOTE: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/ CVE-2024-27982 Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch, but did not clear them for undici.request. This...
CVE-2024-42071 affecting package kernel for versions less than 6.6.43.1-7
CVE-2024-42071 affecting package kernel for versions less than 6.6.43.1-7. A patched version of the package is available...