Schwachstellen, die jetzt zählen.

jenkins: Jenkins: Arbitrary code execution via path traversal in agent names

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.

jenkins: jenkins: Arbitrary code execution via legacy agent launch command conversion

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

jenkins: Jenkins: Remote code execution via resolves-to attribute handling in XStream

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

kafka: kafka: Information disclosure via configuration validation endpoint

org.apache.kafka/kafka-streams: org.apache.kafka/kafka-clients: Apache Kafka: Denial of Service via memory exhaustion during deserialization

org.apache.kafka/kafka-clients: Apache Kafka: Denial of Service via uncontrolled memory allocation in flexible request headers

org.apache.kafka/kafka-clients: Apache kafka: Denial of Service via excessive memory allocation during request parsing

org.apache.kafka/kafka-clients: Apache Kafka: Authentication bypass via missing JWT signature verification

@openhop/server: @openhop/server: Arbitrary file deletion via path traversal in flow route parameters

axel: axel: Arbitrary file write via directory traversal in URL path

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Information disclosure via uninitialized buffer allocation in Intel Xe driver

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Use-after-free via race condition in FireWire split transaction handling

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Denial of Service via out-of-bounds write in tracing subsystem

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Privilege escalation via use-after-free in TCP socket options

llama-cpp: llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

expat: expat: Denial of Service via integer overflow during XML attribute parsing

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

expat: expat: Denial of Service via NULL pointer dereference in external entity parsing

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf: jackson-dataformat-protobuf: Denial of Service via integer overflow in map key parsing

com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

grafana: Azure Monitor data source could leak its Azure access token

konflux-ci: UI proxy skips backend TLS verification on non-OpenShift clusters, leaking a token that can impersonate anyone

rybakit/msgpack: rybakit/msgpack: Denial of Service via uncontrolled recursion

grafana: SSO secrets readable by low-privileged users when an experimental feature is enabled

com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf: jackson-dataformat-protobuf: Denial of Service via integer overflow during field parsing

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.