Schwachstellen, die jetzt zählen.

node-server: node-server: Security middleware bypass via double path decoding in serveStatic

vite: Vite: Information disclosure via filesystem access control bypass

happy-dom: happy-dom: Cookie injection via improper cookie domain validation

happy-dom: happy-dom: Server-Side Request Forgery via default loading of external resources

server-renderer: Happy DOM: Information disclosure via Server-Side Request Forgery

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending…

github.com/labstack/echo: Echo: Arbitrary URI redirect via unvalidated forwarded scheme headers

github.com/labstack/echo: echo: Security control bypass via untrusted forwarded scheme headers

github.com/labstack/echo: Echo: Open redirect via improper URI sanitization

github.com/labstack/echo: Echo: Information disclosure via double URL decoding in static middleware

github.com/labstack/echo: Echo: Information disclosure via path normalization in static file handlers

Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector ) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.

nfs-ganesha: nfs-ganesha: NFSv4.1 cached-READ session-slot replay causes double-free and use-after-free read

github.com/labstack/echo: Echo: Rate limiting bypass via spoofed IP headers

github.com/labstack/echo: Echo: Reflected Cross-Site Scripting via unvalidated JSONP callback

github.com/labstack/echo: Echo: IP address spoofing via forwarded X-Real-IP header

github.com/labstack/echo: Echo: Information disclosure via URL path interpretation discrepancy

github.com/labstack/echo: Echo: CSRF protection bypass via MethodOverride safe method rewriting

Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

github.com/labstack/echo: Echo: IP address spoofing via improper X-Real-IP header validation

github.com/labstack/echo: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

github.com/labstack/echo: Echo: Request body limit bypass via BodyDump error handling

github.com/labstack/echo: echo: Denial of Service (DoS) via unclosed WebSocket proxy connections

github.com/coder/coder: coder: unauthorized session access via missing JWT audience validation

github.com/go-chi/chi: chi: Authentication bypass via SuppressNotFound middleware

github.com/labstack/echo: Echo: Denial of Service via unbounded request decompression

github.com/labstack/echo: echo: Denial of Service via memory exhaustion in BodyDump middleware

i18next-http-backend: i18next-http-backend: Information disclosure via query parameter injection

vue-i18n: core-base: vue-i18n: Cross-Site Scripting via improper iframe srcdoc sanitization

vue-i18n: vue-i18n: HTML injection via unescaped named interpolation parameters