AZL-54446 CVE-2024-45338 affecting package docker-compose for versions less than 2.27.0-3

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54512 CVE-2024-45338 affecting package cri-tools for versions less than 1.29.0-6

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54434 CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54519 CVE-2024-45338 affecting package sriov-network-device-plugin for versions less than 3.6.2-7

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-12601

The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large value...

Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references. Original Description A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the...

GO-2024-3282 Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager

Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager...

GHSA-R4PG-VG54-WXX4 cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

Virtuozzo Hybrid Infrastructure 6.3 (6.3.0-170)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover the compute service and our ecosystem of backup and disaster recovery solutions. Additionally, this release delivers stability and security improvements, and addresses issues found in previous releases...

CVE-2024-45797

CVE-2024-45797 affects LibHTP prior to 0.5.49, where unbounded processing of HTTP request/response headers can cause excessive CPU and memory usage, leading to DoS-like slowdowns. The issue is addressed in LibHTP 0.5.49. Public disclosures in Ubuntu USN-7814-1 and Debian DLA-4295-1, and related O...

CVE-2024-9506

A flaw was found in Vue.js. Within the parseHTML function of html-parser.ts, there is a regular expression regex to check for proper closing tags for HTML. However, due to an improperly written regex, when you pass a script containing long text, it will trigger a regular expression denial of...

New Perfctl Malware Targets Linux Servers for Cryptocurrency Mining and Proxyjacking

Misconfigured and vulnerable Linux servers are the target of an ongoing campaign that delivers a stealthy malware dubbed perfctl with the primary aim of running a cryptocurrency miner and proxyjacking software. "Perfctl is particularly elusive and persistent, employing several sophisticated...

OESA-2024-2118 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2024-2116 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2024-2117 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam

A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This...

CVE-2024-7113

CVE-2024-7113 affects AVEVA SuiteLink Server and related AVEVA products (SuiteLink, Historian, InTouch, Application Server, Communication Drivers Pack, Batch Management). The root issue is Allocation of Resources Without Limits or Throttling, causing the SuiteLink server to consume excessive syst...

PT-2024-5549 · Aveva · Aveva Suitelink Server +5

Name of the Vulnerable Software and Affected Versions: AVEVA SuiteLink Server affected versions not specified Description: The issue is related to unlimited resource allocation in the SuiteLink server of AVEVA software products, including Historian, InTouch, Application Server, Communication...

ruby: ReDoS vulnerability in URI

A flaw was found in the rubygem URI. The URI parser mishandles invalid URLs that have specific characters, which causes an increase in execution time parsing strings to URI objects. This may result in a regular expression denial of service ReDoS...