14027 matches found
CVE-2024-21538
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string...
CVE-2024-21538
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string...
Exploit for Path Traversal in Lfprojects Mlflow
CVE-2024-2928 Arbitrary file read exploit for CVE-2024-2928 in...
The vulnerability of the stm32_usbphyc_pll_enable() function in the Linux operating system allows a hacker to compromise the confidentiality and accessibility of protected information.
The vulnerability of the stm32usbphycpllenable function in the drivers/phy/st/phy-stm32-usbphyc.c file of the Linux kernel is related to incorrect handling of the usage counter. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of protected...
Exploit for Out-of-bounds Write in Exim
CVE-2023-42115: Exploit and Payload Generator Scripts This r...
Exploit for SQL Injection in Fabianros Job_Portal
CVE-2024-7808 :skull: $$\colorred THIS \space EXPLOIT \spa...
Regular Expression Denial Of Service (ReDoS)
Useragent is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to ReDoS caused by the presence of regular expressions that can be exploited to cause high CPU usage, leading to denial of service...
AZL-52997 CVE-2024-50153 affecting package kernel for versions less than 6.6.64.2-1
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in targetallocdevice There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in targetallocdevice+0xbc4/0xbe0 targetcoremod ... kasanreport+0xb9/0xf0...
UBUNTU-CVE-2024-50142
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a "xfrm: Validate address prefix lengths in the xfrm selector." syzbot created an SA with...
NATS Server Configuration Advice for Use With Veeam Backup for Microsoft 365
Purpose This article provides advice for optimizing NATS Server configuration when used in conjunction with Veeam Backup for Microsoft 365. Solution When Veeam Backup for Microsoft 365 is deployed using the included NATS Server, the system variable 'GOMEMLIMIT ' is set to 30% of the total system...
ROS-20241107-02
A vulnerability in the x86/mmu components of the Linux operating system kernel is related to incorrect calculations in the kvmtdpmmutrysplithugepages, kvmtdpmmucleardirtyslot, and cleardirtyptmasked functions in the arch/x86/kvm/mmu/tdpmmu.c. Exploitation of the vulnerability could allow an...
spring-expression: Denial of service when processing a specially crafted Spring Expression Language expression
A flaw was found in the Spring framework package. A maliciously crafted Spring Expression Language SePL may trigger uncontrolled CPU usage, leading to a denial of service in the application consuming it. To be considered vulnerable, one application has to evaluate user-supplied SpEL expressions...
spring-expression: Denial of service when processing a specially crafted Spring Expression Language expression
A flaw was found in the Spring framework package. A maliciously crafted Spring Expression Language SePL may trigger uncontrolled CPU usage, leading to a denial of service in the application consuming it. To be considered vulnerable, one application has to evaluate user-supplied SpEL expressions...
Exploit for Code Injection in Ejs
THM Challenge: SSTI RCE...
CVE-2024-48050
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the bem Twig function. Note: This is only exploitable when the function is used outside of Drupal. If the Drupal Attribute class exists, the function uses it and it does escape...
apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader
A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed...
nimbus-jose-jwt: large JWE p2c header value causes Denial of Service
A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability...
K000148381: Node.js vulnerability CVE-2021-22883
Security Advisory Description Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the...