CVE-2024-8382

mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-8381

mozilla: Type confusion when looking up a property name in a &quot;with&quot; block

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Enterprise Linux and 5 more

CVE-2024-44070

frr: improper input validation in bgp_attr_encap() in bgpd/bgp_attr.c

An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Frrouting Redhat

Products

Frrouting Enterprise Linux

CVE-2024-42005

python-django: Potential SQL injection in QuerySet.values() and values_list()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Discovery and 3 more

CVE-2024-41991

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Discovery and 3 more

CVE-2024-41990

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Rhui

CVE-2024-41989

python-django: Memory exhaustion in django.utils.numberformat.floatformat()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Discovery and 1 more

CVE-2024-40767

openstack-nova: Regression VMDK/qcow arbitrary file access

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2024-39614

python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

CVSS 3.1 · 7.5 High EPSS 28.6% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Openstack and 3 more

CVE-2024-39330

python-django: Potential directory-traversal in django.core.files.storage.Storage.save()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Openstack and 2 more

CVE-2024-39329

python-django: Username enumeration through timing difference for users with unusable passwords

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Openstack and 2 more

CVE-2024-38875

python-django: Potential denial-of-service in django.utils.html.urlize()

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Djangoproject Redhat

Products

Django Ansible Automation Platform Openstack and 2 more

CVE-2024-32498

OpenStack: malicious qcow2/vmdk images

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Cinder Glance Nova and 1 more

CVE-2024-32002

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

CVSS 3.1 · 9.1 Critical EPSS 29.2% KEV · Not listed

Vendors

Git Redhat

Products

Git Enterprise Linux Rhel Aus and 3 more

CVE-2024-30261

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Nodejs Redhat

Products

Fedora Undici Openshift Devspaces

CVE-2024-30260

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Nodejs Redhat

Products

Fedora Undici Openshift Devspaces

CVE-2024-25710

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Commons Compress Amq Broker Amq Streams and 7 more

CVE-2024-22019

nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Netapp Node.js Nodejs and 1 more

Products

Astra Control Center Node.js Node.js and 3 more

CVE-2023-5841

OpenEXR Heap Overflow in Scanline Deep Data Parsing

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed

Vendors

Openexr Redhat

Products

Openexr Enterprise Linux Rhel E4s and 1 more

CVE-2023-50230

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20938.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed

Vendors

Bluez Redhat

Products

Bluez Enterprise Linux