CLSA-2022-1654537477 Fixed CVE-2021-3975 in libguestfs-27.module_el8.4.0+2048+3300d70f

CVE-2021-3975: Fix a use-after-free flaw which can be triggered during VM shutdown...

CVE-2022-23712

A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request...

PT-2022-3398 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions 8.0.0 through 8.2.0 Description: A Denial of Service flaw was discovered in Elasticsearch, related to insufficient exception handling. This issue can be exploited by an unauthenticated attacker to shut down an...

PYSEC-2022-42973

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

Authentication flaw

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

CVE-2022-30034

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

PT-2022-19979

Name of the Vulnerable Software and Affected Versions Flower versions prior to 1.2.0 Description The issue is related to an OAuth authentication bypass in Flower, a web UI for the Celery Python RPC framework. This allows an attacker to access the Flower API, enabling them to discover and invoke...

GHSA-4258-VCJW-WWXX furlongm openvpn-monitor command injection

furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal SIGTERM...

CVE-2022-28944

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network...

Remote code execution

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network...

AuraBalRewardPool charges a penalty to all users in the pool if the AuraLocker has been shut down

Lines of code Vulnerability details Impact Users are charged the penalty due to admin actions, and they have no way to avoid it Proof of Concept When claiming their rewards, users are charged a penalty if they take the reward directly, rather than by passing it into the auraLocker. Those are the...

多款EMCO Software产品安全漏洞

EMCO Software EMCO MSI Package Builder for Windows is a product of EMCO Software Iceland. EMCO Software EMCO MSI Package Builder for Windows is a software tool for creating Windows Installer packages. EMCO Software EMCO MSI Package Builder for Windows is a software tool for creating Windows...

GHSA-9R7G-325H-MXRM Improper Authentication in Apache Hadoop

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the 1 refreshNamenodes, 2 deleteBlockPool, and 3 shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service DataNode...

cockpit security, bug fix, and enhancement update

264.1-1.0.1 - Remove duplicate reference to server in cockpit Orabug: 33862832 - Update documentation links Orabug: 32795691 - Make documentation links point to Oracle Linux information Orabug: 30271413 Orabug: 32013095 - Fix rendering of hwinfo page on systems with some empty memory slots Orabug...

Improper Input Validation in Apache Karaf

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

GHSA-M6G3-XQ5Q-4HG9 Improper Input Validation in Apache Karaf

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service shutdown by sending a shutdown command to all listening high ports...

Improper Resource Shutdown or Release in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOWUPDATE before allowing the application to write more data. These waiting streams each...

CVE-2022-25762: Improper Resource Shutdown or Release

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling...

CVE-2021-33069

Improper resource shutdown or release in firmware for some IntelR SSD, IntelR SSD DC, IntelR OptaneTM SSD and IntelR OptaneTM SSD DC may allow a privileged user to potentially enable denial of service via local access...

CVE-2021-33069

Improper resource shutdown or release in firmware for some IntelR SSD, IntelR SSD DC, IntelR OptaneTM SSD and IntelR OptaneTM SSD DC may allow a privileged user to potentially enable denial of service via local access...