Medium: xerces-j2

Issue Overview: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service CPU consumption via a crafted message to an XML service, which triggers hash table collisions. CVE-2012-0881 There's a vulnerability within the Apache Xerces Java XercesJ XML parser when...

CVE-2024-47182

Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3...

CVE-2024-47182

CVE-2024-47182 affects Dozzle prior to 8.5.3 where passwords are hashed with sha-256, enabling rainbow table attacks. Version 8.5.3 switches to bcrypt, addressing the vulnerability. Publicly referenced advisories (SUSE/openSUSE ecosystem) include this CVE in their security updates. Remediation: u...

CVE-2024-47182 Dozzle uses unsafe hash for passwords

Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3...

DEBIAN-CVE-2024-46834

In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 "bnxt: fix crashes when reducing ring count with active RSS contexts" proves that allowing indirection table to contain channels with...

CVE-2024-46834

In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 "bnxt: fix crashes when reducing ring count with active RSS contexts" proves that allowing indirection table to contain channels with...

AZL-50244 CVE-2024-46834 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 "bnxt: fix crashes when reducing ring count with active RSS contexts" proves that allowing indirection table to contain channels with...

CVE-2024-46838

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: don't BUGON if khugepaged yanks our page table Since khugepaged was changed to allow retracting page tables in file mappings without holding the mmap lock, these BUGONs are wrong - get rid of them. We could also remo...

CVE-2024-46838

CVE-2024-46838 affects the Linux kernel. The issue arises in userfaultfd when khugepaged yanks a page table, where previous BUG_ON() checks were incorrect after allowing retracting page tables in file mappings without the mmap lock. The fix removes these BUG_ON()s (and associated early block) to ...

OESA-2024-2200 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirectionstable data within RSS becomes controllable. Setting...

OESA-2024-2199 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirectionstable data within RSS becomes controllable. Setting...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a failure to check the maximum value of the channel ID when processing the indirection table...

Dozzle 安全漏洞

Dozzle is a small, lightweight application by the individual developer Amir Raminfar. A security vulnerability exists in Dozzle versions prior to 8.5.3 that stems from the use of sha-256 as a password hash, which makes it vulnerable to rainbow table attacks...

net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.

A flaw was found in net-snmp. A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference issue...

net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

A flaw was found in net-snmp. A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference issue...

net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access

A flaw was found in net-snmp. A malformed OID in a SET request to the SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access issue...

Exploit for SQL Injection in Woobewoo Product_Table

Wordpress WBW Product Table Pro = 1.9.4 - Unauthenticated Arb...

kernel: net/sched: Fix UAF when resolving a clash

A use-after-free vulnerability was found in the net/sshd tcfctflowtableprocessconn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability...

kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable()

An out-of-bounds access vulnerability was found in the Linux Kernel. This issue occurs during the creation of a new netfilter table. The absence of safeguards in the nftablesnewtable function against invalid nftables family pf values allows attackers to achieve unauthorized access. Exploitation...

kernel: x86/mm/pat: fix VM_PAT handling in COW mappings

CVE-2024-35877 pertains to a flaw in the Linux kernel's handling of Page Attribute Table PAT settings during Copy-On-Write COW operations. When a write operation triggers a COW event, the kernel may replace the original page table entries PTEs with anonymous folios. This replacement disrupts the...