Schwachstellen, die jetzt zählen.

freeimage: FreeImage: Arbitrary code execution via heap-based buffer overflow in image decoder

markdown2: markdown2: Denial of Service via unclosed inline link destinations

Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen

langgraph-api: langgraph-api: unauthorized data access via improper namespace isolation

decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input

vite: Vite: Information disclosure via filesystem access control bypass

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending…

nfs-ganesha: nfs-ganesha: NFSv4.1 cached-READ session-slot replay causes double-free and use-after-free read

github.com/labstack/echo: Echo: Information disclosure via URL path interpretation discrepancy

github.com/labstack/echo: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

github.com/labstack/echo: echo: Denial of Service (DoS) via unclosed WebSocket proxy connections

github.com/labstack/echo: Echo: Denial of Service via unbounded request decompression

github.com/labstack/echo: echo: Denial of Service via memory exhaustion in BodyDump middleware

perl-mime-tools: perl-mime-tools: Denial of Service via memory exhaustion from excessive message parts

perl-MIME-tools: perl-MIME-tools: Denial of Service via memory exhaustion from crafted MIME headers

perl-MIME-tools: perl-MIME-tools: Denial of Service via memory exhaustion from deeply nested messages

perl-http-body: HTTP::Body: Denial of Service via unbounded buffering of chunked requests

perl-http-body: HTTP::Body: Denial of Service via quadratic regular expression backtracking

perl-http-body: perl-http-body: Denial of Service via unbounded multipart header block

perl-http-body: HTTP::Body: Denial of Service via malformed multipart request body

perl-http-body: HTTP::Body: Denial of Service via incomplete multipart uploads

perl-http-body: HTTP::Body: Denial of Service via unbounded form fields and multipart parts

re2js: re2js: Denial of service via repeated regular expression matching with lookbehinds

Red Hat Openshift Container Platform (ansible, aws-efs-csi-driver): Mehrere Schwachstellen

openshift-ansible: openshift-ansible: Installer container downloads and executes remote inventory script without integrity verification

grafana: Grafana: Information disclosure via legacy schema switch in contact points

jenkins: Jenkins: Root element check bypass via nested object deserialization

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.

jenkins: jenkins: Privilege escalation via Manage Old Data feature

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.

jenkins: Jenkins: Unauthorized persistent access via 'remember me' cookie generation

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.

jenkins: Jenkins: Unauthorized administrator account creation via setup wizard race condition

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

jenkins: Jenkins: Arbitrary file write via race condition in artifact extraction

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.