Schwachstellen, die jetzt zählen.

node-forge: node-forge: Denial of Service via inefficient regular expression in PEM decoding

joi: joi: Denial of Service via inefficient regular expression in email validation

nomad: Nomad: Privilege escalation via symlink following during data migration

botan: Botan: Integer overflow when reporting block size in FFI can cause memory corruption

github.com/kubeflow/pipelines: Kubeflow Pipelines: Denial of Service via unbounded archive decompression

github.com/kubeflow/pipelines: Kubeflow Pipelines: Information disclosure via unauthorized log retrieval handler

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery…

ImageMagick: ImageMagick: Denial of Service via stack overflow in TIFF decoder

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST…

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.

Elastic Cloud Enterprise: Elastic Cloud Enterprise: Authentication bypass via symlink attack

markdown: python-markdown: Denial of Service via inefficient inline link parsing

github.com/oapi-codegen/oapi-codegen: oapi-codegen: Arbitrary code execution via crafted OpenAPI enum entries

github.com/oapi-codegen/oapi-codegen: oapi-codegen: Arbitrary code execution via crafted OpenAPI specification

open: open: Arbitrary code execution via crafted URLs

qpid-proton: qpid-proton: Authentication bypass via misidentified AMQP frames

qpid-proton-c: qpid-proton-c: Denial of Service via stack overflow in pn_message_body()

qpid-proton: qpid-proton: improper certificate validation via retention of default system trust anchors

Red Hat Enterprise Linux (crun, xfsprogs, glib-networking): Mehrere Schwachstellen

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).

nvm: nvm: Arbitrary code execution via crafted version strings

Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen

Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen

Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen

Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen

Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen

Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen

json-glib: json-glib: infinite loop in json_path_query() with negative JSONPath slice step

DSA-6596-1 wordpress - security update

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Red Hat Ansible Automation Platform (GitPython): Mehrere Schwachstellen

Red Hat Ansible Automation Platform (GitPython): Mehrere Schwachstellen