Schwachstellen, die jetzt zählen.

github.com/authorizerdev/authorizer: Authorizer: Account takeover via password reset poisoning

ingress-nginx: ingress-nginx: Denial of Service via mirror-target annotation

A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx. Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be…

pymodaq: pymodaq_data: pymodaq_gui: pymodaq_utils: PyMoDAQ: Arbitrary code execution via crafted files

PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions…

h5io: h5io: Arbitrary code execution via crafted HDF5 file

h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read.

gluonts: GluonTS: Arbitrary file write via path traversal in archive extraction

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue, users should upgrade to version 0.17.0 or later.

modsecurity: mod_security: ModSecurity: Security inspection bypass via multipart filename parameter discrepancy

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and…

modsecurity: modsecurity: Information disclosure via case-sensitive Content-Type matching

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can…

mod_security: modsecurity: ModSecurity: Weak TLS certificate validation via improper hostname verification

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host…

OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

modsecurity: ModSecurity: Security rule bypass via regular expression limit exhaustion

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request…

mariadb: MariaDB: Unauthorized table access via unencoded partition names

musl: musl: Arbitrary code execution via integer overflow in regcomp

musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.

mpv: mpv: Arbitrary code execution via newline injection in playlist URLs

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.

SDL3_mixer: SDL_mixer: Arbitrary code execution via crafted AIFF-C audio file

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

SDL3_mixer: SDL_mixer: Arbitrary code execution via crafted WAV file

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign D-Bus callers to replace another client's resolved transaction

aas-basyx-v2-full: aas-basyx-v2-full: Privilege escalation via cleartext administrative secret in ConfigMap

In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role. The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also…

io.quarkus/quarkus-vertx-http: quarkus-vertx-http: Authorization bypass in management interface via path concatenation flaw

org.apache.sling/org.apache.sling.engine: Apache Sling Engine: HTTP request smuggling via malformed query and form parsing

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

org.apache.sling/org.apache.sling.engine: Apache Sling Engine: Stored Cross-Site Scripting via header protection bypass

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4…

basyx: Eclipse BaSyx Helm Chart: Privilege escalation via plaintext credential storage in ConfigMap

In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap ` -basyx-keycloak-init-config`. By default this includes the bootstrap…

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

kernel: kernel: Memory corruption via integer overflow in Samsung Exynos NPU driver

github.com/kyverno/kyverno: Kyverno: Denial of Service via unbounded signature decompression

github.com/kyverno/kyverno: kyverno: Denial of Service via unbounded decompression of attestation layers