Schwachstellen, die jetzt zählen.

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Information disclosure via predictable keyring index ordering

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: invalid trusted key instantiation via unhandled TPM unseal failure

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Denial of Service via NULL pointer dereference in asymmetric key restriction

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Denial of Service via uninitialized pointer dereference in ftrace

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: privilege escalation via use-after-free in coredump subsystem

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex)…

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

libaec: libaec: Denial of Service via out-of-bounds read in m_se_decode()

sleuthkit: sleuthkit: Denial of Service via crafted HFS+ image

libgphoto2: libgphoto2: Denial of service via oversized thumbnail processing

libgphoto2: libgphoto2: arbitrary code execution via buffer overflow in jl2005c camera driver

quickjs-ng: quickjs-ng: Denial of Service via memory leak in atomic store operations

quickjs-ng: quickjs-ng: Arbitrary code execution via integer overflow during proxy property enumeration

netpbm: netpbm: Denial of Service via out-of-bounds read in tgatoppm

netpbm: netpbm: Arbitrary code execution via integer overflow in jbigtopnm

netpbm: netpbm: Arbitrary code execution via crafted PICT file in picttoppm

netpbm: netpbm: Arbitrary code execution via crafted PICT file in picttoppm

netpbm: netpbm: Arbitrary code execution via integer overflow in winicontopam

arrow: arrow: Out-of-bounds read via improper validation of RunEndEncoded arrays

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Barracuda Networks Multiple Products OS Command Injection Vulnerability

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

qt6: Integer overflow vulnerability in XML parsing functionality of Qt5Compat impacts Qt

fastify: Fastify: Denial of Service via streaming response timeout handling

reply-from: reply-from: Unauthorized upstream access via path traversal

@fastify/secure-session: @fastify/secure-session: Session revocation bypass via improper signature validation

@fastify/cors: @fastify/cors: Denial of Service via CORS preflight requests

@fastify/http-proxy: @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

@fastify/http-proxy: @fastify/http-proxy: Information disclosure via encoded backslash path traversal

qt: qt: Denial of Service via memory corruption in QMqttClient