BIT-KEYDB-2023-25155 Integer Overflow in several Redis commands can lead to denial of service.

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis...

CVE-2023-33976 affecting package tensorflow for versions less than 2.11.1-2

CVE-2023-33976 affecting package tensorflow for versions less than 2.11.1-2. A patched version of the package is available...

CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

Affected Packages The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are...

GHSA-6V96-M24V-F58J CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

Affected Packages The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are...

Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability

Affected packages The vulnerability has been discovered in Code Snippet GeSHi plugin. All integrators that use GeSHi syntax highlighter on the backend side can be affected. Impact A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a...

CVE-2024-8003 Go-Tribe gotribe-admin Log routes.go InitRoutes deserialization

A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/app/routes/routes.go of the component Log Handler. The manipulation leads to deserialization. The patch is identified as...

LSN-0106-1 Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.CVE-2023-52620 In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work...

CVE-2023-42363 affecting package busybox for versions less than 1.35.0-11

CVE-2023-42363 affecting package busybox for versions less than 1.35.0-11. A patched version of the package is available...

CVE-2024-43851 soc: xilinx: rename cpu_number1 to dummy_cpu_number

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: rename cpunumber1 to dummycpunumber The per cpu variable cpunumber1 is passed to xlnxeventhandler as argument "devid", but it is not used in this function. So drop the initialization of this variable and rename it to...

Medium: nodejs

Issue Overview: NOTE: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/ CVE-2024-27982 Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch, but did not clear them for undici.request. This...

Medium: php8.2

Issue Overview: The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/138...

CVE-2024-42071 affecting package kernel for versions less than 6.6.43.1-7

CVE-2024-42071 affecting package kernel for versions less than 6.6.43.1-7. A patched version of the package is available...

CVE-2023-46838 affecting package kernel for versions less than 6.6.35.1-4

CVE-2023-46838 affecting package kernel for versions less than 6.6.35.1-4. A patched version of the package is available...

CVE-2024-0684 affecting package coreutils for versions less than 9.4-5

CVE-2024-0684 affecting package coreutils for versions less than 9.4-5. A patched version of the package is available...

CVE-2024-24857 affecting package kernel for versions less than 6.6.35.1-4

CVE-2024-24857 affecting package kernel for versions less than 6.6.35.1-4. A patched version of the package is available...

Command Injection in sequenceserver

Impact Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands Patches Fixed in 3.1.2 Workarounds No known workarounds...

CVE-2024-21634

A vulnerability was found in Amazon Ion, an implementation of Ion data notation. Ion-java may be affected by denial of service DoS due to issues while deserializing encoded data into IonValue. A maliciously crafted Ion data structure may be processed and cause a StackOverflowError, leaving the...

PT-2024-5695 · Microsoft · Kernel Streaming Wow Thunk Service Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel Streaming WOW Thunk Service Driver versions prior to the fixed version Description: The issue is related to a buffer overflow in the dynamic memory of the Kernel Streaming WOW Thunk Service Driver, which can be exploited to...

orc security update

0.4.28-4 - Add patch for CVE-2024-40897 - Resolves: RHEL-50710...

Command Injection in sequenceserver gem

Impact Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands Patches Fixed in 3.1.2 Workarounds No known workarounds...