PT-2024-31423 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server version 8.5 Description: The issue is a denial of service vulnerability that can be triggered by an unexpected specially crafted request under certain configurations. A remote attacker could exploit this to...

PT-2025-2762

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue arises when two clients of the same gpio call pinctrl select state for the same functionality, resulting in a NULL pointer issue while accessing desc-mux owner. This occurs because...

PT-2024-33163 · Domainmod · Domainmod

Name of the Vulnerable Software and Affected Versions: DomainMOD versions prior to 4.12.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript code via the "admin/domain-fields/edit.php" API endpoint and the cdfid parameter. This enables attackers to execute...

PT-2024-35557

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.65 Description A vulnerability in the Linux kernel has been resolved, related to the nvme-multipath feature. The issue occurs when a partition scan is performed within the controller's scan work context, whic...

CVE-2024-48909

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of...

GHSA-G8M5-722R-8WHQ Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

Impact Remote DOS attack can cause out of memory Description There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote which can be exploited by unauthorized users to cause remote denial-of-service DoS attack. By repeatedly sending crafted requests, attackers can trigger...

CVE-2024-48909 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of...

CVE-2024-48909 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of...

CVE-2024-47831

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Neither t...

CVE-2024-47831 Next.js image optimization has Denial of Service condition

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Neither t...

CVE-2024-47831

CVE-2024-47831 concerns Next.js image optimization DoS affecting Next.js branches 10.x–14.x prior to 14.2.7. The vulnerability allows high CPU usage under crafted image requests. Public details show remediation in Next.js 14.2.7. Workaround: ensure next.config.js sets either images.unoptimized, i...

CVE-2024-47831 Next.js image optimization has Denial of Service condition

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Neither t...

PT-2024-35669

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue occurs when concurrently installing the f2fs.ko module and mounting the f2fs file system, resulting in a null-ptr-deref in the f2fs submit page bio function. This happens becau...

PT-2024-7156 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise version 9.2.0 through 9.2.3 Splunk Cloud Platform versions prior to 9.2.2403.103 Splunk Cloud Platform versions 9.1.2312.200 through 9.1.2312.110 Splunk Cloud Platform version...

PT-2024-33263 · Unknown · Opencanary

Name of the Vulnerable Software and Affected Versions: OpenCanary versions prior to 0.9.4 Description: OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed...

PT-2024-13539 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions prior to 2024R1 Nagios XI versions prior to 5.11.3 2024R1 Description: The issue is related to the improper handling of API keys generation in Nagios XI, allowing attackers to possibly generate the same set of API keys for...

PT-2024-39967 · Newtype · Newtype Webeip

Name of the Vulnerable Software and Affected Versions: NewType WebEIP version 3.0 Description: The issue is related to improper validation of user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters. This results in a Reflected Cross-site...

PT-2024-7169 · Vercel · Next.Js

Name of the Vulnerable Software and Affected Versions: Next.js versions 10.x through 14.x before version 14.2.7 Description: The issue is related to the image optimization feature in Next.js, which contains a vulnerability allowing for a potential Denial of Service DoS condition that could lead t...

PT-2024-33057 · Wavelog · Wavelog

Name of the Vulnerable Software and Affected Versions: Wavelog version 1.8.5 Description: The issue is an SQL injection vulnerability in the Activated gridmap model.php file. This vulnerability can be exploited through the band, sat, propagation, or mode variables. Recommendations: For Wavelog...

PT-2024-7164

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6 Description The software potentially exposes sensitive HTTP parameters to the internal index if the REST Calls log...