2939 matches found
firefox: use-after-free in workers
The Mozilla Foundation Security Advisory describes this flaw as: During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash...
firefox: use-after-free in workers
The Mozilla Foundation Security Advisory describes this flaw as: During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash...
Amazon Linux 2 : nginx (ALASNGINX1-2023-001)
The version of nginx installed on the remote host is prior to 1.22.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2023-001 advisory. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, a...
openSUSE 15 Security Update : modsecurity (openSUSE-SU-2023:0257-1)
The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0257-1 advisory. - DISPUTED Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports Trustwave has...
CVE-2023-41081
A vulnerability was found in Apache Tomcat Connectors modjk. Affected versions of this package are vulnerable to information exposure in the modjk component. This flaw allows an attacker to exploit the implicit mapping functionality, resulting in the unintended exposure of the status worker and...
CVE-2023-41081
Important: Authentication Bypass CVE-2023-41081 The modjk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, modjk would use an...
Apache Tomcat Security Vulnerability
Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements support for Servlets and JavaServer Page JSP. A security vulnerability exists in Apache Tomcat, which stems from the fact that modjk uses an implicit mapping when the...
olcne security update
istio 1.17.5-1 - Addresses CVE CVE-2023-35941, CVE-2023-35942, CVE-2023-35943, CVE-2023-35944. kubevirt 0.58.0-3 - Ensure that selinux build tags are set for all Go builds olcne 1.7.2-3 - Mofify kubevirt image tag to use virt-operator tag instead of kubevirt-version 1.7.2-2 - Update kubevirt imag...
PT-2023-5210 · Apache +5 · Apache Tomcat Connectors +5
Name of the Vulnerable Software and Affected Versions: Apache Tomcat Connectors versions 1.2.0 through 1.2.48 Description: The mod jk component of Apache Tomcat Connectors is affected by an issue where, in certain circumstances, such as when a configuration includes "JkOptions +ForwardDirectories...
Oracle Linux 7 : dovecot (ELSA-2020-1062)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1062 advisory. - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory...
PYSEC-2023-166
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted...
CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted...
CVE-2023-20897
Removed by vendor...
Internet Bug Bounty: CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE
Apache Airflow Spark Provider before 4.1.3 was affected by a deserialization vulnerability that allowed remote code execution RCE. Attackers could exploit this vulnerability by configuring a malicious Spark server address through the Airflow UI, which would then manipulate the PySpark clients...
GHSA-J55R-787P-M549 Shescape on Windows escaping may be bypassed in threaded context
Impact This may impact users that use Shescape on Windows in a threaded context e.g. using Worker threads. The vulnerability can result in Shescape escaping or quoting for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This...
Malicious code in securitytxt-worker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 81dbfb4e2051327cc68f17d9de11e7e30f12956c5d402360c453029a80a59221 The OpenSSF Package Analysis project identified 'securitytxt-worker' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
MAL-2023-1506 Malicious code in securitytxt-worker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 81dbfb4e2051327cc68f17d9de11e7e30f12956c5d402360c453029a80a59221 The OpenSSF Package Analysis project identified 'securitytxt-worker' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
GHSA-7VXC-Q7RV-QFJ8 SUCHMOKUO node-worker-threads-pool denial of service Vulnerability
An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service. This can be mitigated by manually creating a timeout. For example: ts const StaticPool = require"node-worker-threads-pool"; const staticPool = new...
