145512 matches found
resteasy-core: RESTeasy SourceProvider remote unauthenticated file read
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...
Important: Red Hat Security Advisory: resteasy security update
An update for resteasy is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.6.SP1 release and security update
An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...
jackson-databind: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV
PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation incomplete fix for CVE-2026-54512 CVE-2026-110879...
brotli: Out-of-Bounds Write in Google Brotli Decoder
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...
Important: Red Hat Security Advisory: brotli security update
An update for brotli is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...
flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...
Important: Red Hat Security Advisory: flatpak-builder security update
An update for flatpak-builder is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.74 bug fix and security update
Red Hat OpenShift Container Platform release 4.16.74 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...
brotli: Out-of-Bounds Write in Google Brotli Decoder
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...
Important: Red Hat Security Advisory: brotli security, bug fix, and enhancement update
An update for brotli is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
Critical: Red Hat Security Advisory: OpenShift Container Platform 4.19.53 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...
Critical: Red Hat Security Advisory: OpenShift Container Platform 4.21.40 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...
Critical: Red Hat Security Advisory: OpenShift Container Platform 4.20.44 bug fix and security update
Red Hat OpenShift Container Platform release 4.20.44 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: emacs security update
An update for emacs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
emacs: Emacs: arbitrary code execution in Flymake mode
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.59 bug fix and security update
Red Hat OpenShift Container Platform release 4.18.59 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.59 security and extras update
Red Hat OpenShift Container Platform release 4.18.59 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: python-tornado security update
An update for python-tornado is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...
tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...
urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...
Important: Red Hat Security Advisory: python-urllib3 security update
An update for python-urllib3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...
Important: Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
Important: Red Hat Security Advisory: LVMS 4.14 Bug Fix and Enhancement update
Updated container images that fix multiple bugs are now available for LVMS 4.14 After a successful LVMS upgrade, the latest lvms-operator SHA image should be running. This erratum implements the following changes: - Golang version bump to address CVE-2026-33818, CVE-2026-56860 and CVE-2026-56862...
dotnet: ASP.NET Core Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...
dotnet: .NET Denial of Service Vulnerability
A flaw was found in .NET. Due to inefficient algorithmic complexity, an unauthorized remote attacker can send specially crafted requests over the network to cause excessive resource consumption. This issue can result in a Denial of Service DoS, rendering the affected application unresponsive to...
dotnet: ASP.NET Core Tampering Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...
dotnet: .NET: Denial of Service via asymmetric resource consumption
A flaw was found in .NET. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted network requests that trigger asymmetric resource consumption, causing the system to expend disproportionate processing resources. Successful exploitation leads to a Denial of...
dotnet: .NET: Denial of Service via unthrottled resource allocation
A flaw was found in .NET. An unauthenticated remote attacker can exploit improper resource allocation and a lack of rate limiting over the network to exhaust system resources. This flaw leads to a Denial of Service DoS, causing the affected application or service to become unavailable to legitima...
dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...
dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...
dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...
Critical: Red Hat Security Advisory: .NET 9.0 security update
An update for .NET 9.0 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...
dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...
dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network...
dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...
dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits
MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...
dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...
dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network...
dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...
dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
dotnet: .NET Denial of Service Vulnerability
A flaw was found in .NET. Due to inefficient algorithmic complexity, an unauthenticated remote attacker can submit specially crafted requests over the network. Processing these requests leads to excessive resource consumption, resulting in a Denial of Service DoS...
dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network...
dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network...
dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...