16646 matches found
SUSE CVE-2024-53863
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...
CVE-2024-42457
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...
kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation
A denial of service vulnerability was found in the Linux kernel. When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set, then entrySYSENTERcompat uses CLEARBRANCHHISTORY and calls the clearbhbloop before the TF flag is cleared. This causes the DB handler excdebugkernel to iss...
CVE-2024-53139: Use After Free
In the Linux kernel, the following vulnerability has been resolved: sctp: fix possible UAF in sctpv6available A lockdep report 1 with CONFIGPROVERCULIST=y hints that sctpv6available is calling devgetbyindexrcu and ipv6chkaddr without holding rcu. 1 ============================= WARNING: suspiciou...
UBUNTU-CVE-2024-53863
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...
gRPC: hpack table accounting errors can lead to denial of service
A flaw was found in the gRPC lib. This vulnerability allows hpack table accounting errors that could lead to unwanted disconnects between clients and servers in exceptional cases. This issue leads to Unbounded memory buffering in the HPACK parser and Unbounded CPU consumption in the HPACK parser...
FESTO CODESYS
GENERAL RECOMMENDATION As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside - Use...
Regular expression Denial of Service - ReDoS
Description A Regular Expression Denial of Service ReDoS vulnerability identified in the Transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issue...
Regular Expression Denial Of Service (ReDoS)
cross-spawn is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to improper input sanitization, which allows an attacker to craft a large string that increases CPU usage and crashes the program...
PT-2024-35455
Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.120.1 Description The issue concerns Synapse, an open-source Matrix homeserver, where multipart/form-data requests can transiently increase memory consumption beyond expected levels in certain configurations,...
Element Synapse security vulnerability
Element Synapse is an open source Matrix Home Server implementation from Element Open Source. A security vulnerability exists in Element Synapse that stems from the fact that multi-part/form data requests may, under certain configurations, temporarily increase memory consumption beyond expected...
CVE-2024-53900
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...
GHSA-Q849-WXRC-VQRP hull.js Code Injection Vulnerability
Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function... in the module that handles points format. Applications passing the 3rd parameter to the hull function without sanitising may be impacted. The vulnerability has been...
PT-2024-36004 · Unzip-Bot · Unzip-Bot
Name of the Vulnerable Software and Affected Versions: unzip-bot versions prior to 7.0.3a Description: The issue allows users to exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this using a crafted archive...
ROS-20241202-02
Vulnerability of drivers/virt/acrn components of the Linux operating system kernel is related to errors of post-release usage errors in the acrnvmmemsegunmap and acrnvmvmrammap functions in the drivers/virt/acrn/mm.c. Exploitation of the vulnerability could allow an attacker to escalate privilege...
Exploit for Cross-site Scripting in Wondercms
CVE-2023-41425 CVE-2023-41425 XSS to RCE, Wonder CMS 3.2.0 &l...
OESA-2024-2479 libsoup3 security update
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: GNOME libsoup before 3.6.1 has an infinite loop, and memory...
Regular Expression Denial Of Service (ReDoS)
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to improper input sanitization, allowing an attacker to increase CPU usage and crash the program...
PT-2024-27975 · Tellus +1 · Tellus +1
Name of the Vulnerable Software and Affected Versions: TELLUS versions 4.0.19.0 and earlier TELLUS Lite versions 4.0.19.0 and earlier Description: The issue is an Out-of-bounds read vulnerability. If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be...
CBL Mariner 2.0 Security Update: hvloader (CVE-2024-45157)
The version of hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45157 advisory. - An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorit...