Schwachstellen, die jetzt zählen.

wasmtime: Wasmtime: Denial of Service via unvalidated zero-length stream operations

wasmtime: Wasmtime: Denial of Service via canceled asynchronous function calls

wasmtime: Wasmtime: Denial of Service via host panic during memory reallocation

wasmtime: wasmtime: Denial of Service via thread.yield in start functions

wasmtime: wasmtime: Denial of Service via unhandled assertion in component function call

wasmtime: wasmtime: Denial of Service via assertion failure after runtime trap

wasmtime: Wasmtime: Denial of Service via recursive type drops

wasmtime: wasmtime: Denial of Service via mixed synchronous and asynchronous calls

wasmtime: Wasmtime: Denial of Service via component stream type mismatch

wasmtime: Wasmtime: Denial of Service via unbounded memory growth in resource handle tables

wasmtime: wasmtime: Undefined behavior via misaligned VMContext layout

wasmtime: wasmtime: Denial of Service via overlapping string transcoding in fused adapters

ImageMagick: ImageMagick: Denial of service via heap-based buffer overflow in -morph option

ImageMagick: ImageMagick: Denial of Service via stack overflow in TIFF decoder

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

keystonemiddleware: keystonemiddleware: application credential access_rules bypass via X-Service-Token header presence check

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST…

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.

Elastic Cloud Enterprise: Elastic Cloud Enterprise: Authentication bypass via symlink attack

Elastic Cloud Enterprise: Elastic Cloud Enterprise: Privilege escalation via insecure credential retention during certificate rotation

flat: flat: Denial of Service via unbounded numeric array keys

markdown: python-markdown: Denial of Service via inefficient inline link parsing

grafana: OAuth and OIDC tokens written unredacted to Grafana server logs

undertow: undertow: ChunkReader message length permits chunk-size overflow

github.com/oapi-codegen/oapi-codegen: oapi-codegen: Arbitrary code execution via crafted OpenAPI enum entries

github.com/oapi-codegen/oapi-codegen: oapi-codegen: Arbitrary code execution via crafted OpenAPI specification

open: open: Arbitrary code execution via crafted URLs

org.apache.camel/camel-a2a: Apache Camel A2A: Server-Side Request Forgery via inconsistent address validation

qpid-proton: qpid-proton: Denial of Service via misconfigured wildcard TLS certificate

qpid-proton: qpid-proton: Authentication bypass via misidentified AMQP frames

qpid-proton-c: qpid-proton-c: Denial of Service via stack overflow in pn_message_body()

qpid-proton: qpid-proton: improper certificate validation via retention of default system trust anchors