CVE-2024-37309

CVE-2024-37309 affects CrateDB

CVE-2024-37309 Client initialized Session-Renegotiation DoS

CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint port 4200 permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of security parameter...

CVE-2024-37309 Client initialized Session-Renegotiation DoS

CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint port 4200 permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of security parameter...

(RHSA-2024:3780) Important: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.4.SP2)

An update for Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available RHBQ 3.8.4.SP2. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products: CVE-2022-34169 xalan:...

kernel: xhci: handle isoc Babble and Buffer Overrun events properly

A flaw was found in the Linux kernel related to the Extensible Host Controller Interface xHCI subsystem, specifically how it handles certain events. The issue arises when the xHCI driver improperly handles isochronous isoc Babble and Buffer Overrun events. The vulnerability occurs because the xHC...

WordPress Hash Form Plugin Remote Code Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Hash Form Plugin RCE', 'Description' = %q The Hash Form – Drag & Drop Form Builder plugin for WordPress suffers from a critical...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 7 (5.4.4-152)

This update provides stability and performance improvements. Vulnerability id: VSTOR-80766, VSTOR-81600, VSTOR-85345 Improvements in certificate eligibility checks...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 7 (6.0.1-96)

This update provides a stability improvement. Vulnerability id: VSTOR-85872 A stability fix for Backup Gateway...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 2 (6.1.1-39)

This update provides a stability improvement. Vulnerability id: VSTOR-85986 Enabled adding multiple devices to the boot sequence of Linux VMs...

Important: Red Hat Security Advisory: HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Release and security update.

HawtIO 4.0.0 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product Security has rated this update ...

CVE-2023-52882

In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other...

CVE-2021-47527

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...

kernel: gro: fix ownership transfer

A flaw was found in the Linux kernel's Generic Receive Offload GRO feature, where packets processed with a fragment list are not properly orphaned due to incorrect handling of socket references. This vulnerability can cause system instability or kernel bugs. The issue has been fixed by making sur...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 1 (6.1.1-36)

This update provides a stability improvement. Vulnerability id: VSTOR-86420 A stability fix for Backup Gateway...

AVideo WWBNIndex Plugin Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AVideo WWBNIndex Plugin Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated remote code execution RCE vulnerability ...

CVE-2023-52741

CVE-2023-52741 affects the Linux kernel CIFS implementation: a use-after-free in rdata->read_into_pages() can occur when the network is unstable during read operations. The issue is caused by improper return-condition sequencing, enabling UAF in readpages_fill_pages (and related paths such as ...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 (6.1.1-35)

In this release, Virtuozzo Hybrid Infrastructure enables virtual CPU and RAM overcommitment per node, as well as provides stability and performance improvements, and addresses issues found in previous releases. Vulnerability id: VSTOR-49565 Network errors occur when migrating a VM that was...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 6 (6.0.1-95)

This update provides a stability improvement. Vulnerability id: VSTOR-85582 Fixed an issue with ploop overflow that may lead to corruption of images larger than 2 TB...

GHSA-QVGG-R6RQ-VWFX datadog/dd-trace Circumvents open_basedir INI directive

datadog/dd-trace versions 0.30.0 prior to 0.30.2 are affected by a security and stability issue outlined in PR 579. This pull request ensures that the ddtrace.requestinithook remains bound by the openbasedir INI directive, effectively addressing potential vulnerabilities related to openbasedir...

datadog/dd-trace Circumvents open_basedir INI directive

datadog/dd-trace versions 0.30.0 prior to 0.30.2 are affected by a security and stability issue outlined in PR 579. This pull request ensures that the ddtrace.requestinithook remains bound by the openbasedir INI directive, effectively addressing potential vulnerabilities related to openbasedir...