Qnap QTS Out-of-bounds Write (CVE-2021-28816)

A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS...

CVE-2022-44640 affecting package samba for versions less than 4.18.3-1

CVE-2022-44640 affecting package samba for versions less than 4.18.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-45011 affecting package kernel for versions less than 6.6.51.1-1

CVE-2024-45011 affecting package kernel for versions less than 6.6.51.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-46728 affecting package kernel for versions less than 6.6.51.1-5

CVE-2024-46728 affecting package kernel for versions less than 6.6.51.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-47080 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

A vulnerability was found in the Linux kernel's ext4 filesystem within the ext4fillsuper function, where uninitialized access to ratelimitstate-lock can occur, where the sysfs interface is registered before properly initializing rs-lock, potentially allowing other processes to modify rs-interval ...

etcd-for-k8s1.28-3.5.15-1.1 on GA media (moderate)

etcd-for-k8s1.28-3.5.15-1.1 on GA media Announcement ID: openSUSE-SU-2024:14399-1 Rating: moderate Cross-References: CVE-2023-45288 CVSS scores: CVE-2023-45288 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...

USN-7014-3: nginx vulnerability

USN-7014-1 fixed a vulnerability in nginx. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: It was discovered that the nginx ngxhttpmp4 module incorrectly handled certain malformed mp4 files. In environments where the mp4 directive is in use, a remote...

Vulnerabilities fixed in Moxa systems

Moxa has fixed vulnerabilities in several network components. A malicious party could exploit the vulnerabilities to modify configurations and execute arbitrary code on the vulnerable system. Moxa has released updates to fix the vulnerabilities. See attached references for more information...

PT-2024-32025 · Jepaas · Jepaas

Name of the Vulnerable Software and Affected Versions: Jepaas version 7.2.8 Description: A SQL injection vulnerability was discovered in Jepaas via the orderSQL parameter at the "/homePortal/loadUserMsg" API endpoint. This issue allows for potential SQL injection attacks. Recommendations: For...

Medium: unbound

Issue Overview: NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-46781)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46781 advisory. - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforwa...

MozillaFirefox-131.0.2-1.1 on GA media (moderate)

MozillaFirefox-131.0.2-1.1 on GA media Announcement ID: openSUSE-SU-2024:14393-1 Rating: moderate Cross-References: CVE-2024-9680 CVSS scores: CVE-2024-9680 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-9680 SUSE : 7.3...

DEBIAN-CVE-2024-45397

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by...

DEBIAN-CVE-2024-25622

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes e.g., path level are expected to inherit t...

UBUNTU-CVE-2024-25622

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes e.g., path level are expected to inherit t...

Slackware: Security Advisory (SSA:2024-284-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for the Linux Kernel (SUSE-SU-2024:3585-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

trivy-0.56.1-1.1 on GA media (moderate)

trivy-0.56.1-1.1 on GA media Announcement ID: openSUSE-SU-2024:14392-1 Rating: moderate Cross-References: CVE-2024-34155 CVSS scores: CVE-2024-34155 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

Security Vulnerability fixed in Thunderbird 131.0.1, Thunderbird 128.3.1, Thunderbird 115.16.0 — Mozilla

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild...