Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2024-32660

FreeRDP zgfx_decompress out of memory vulnerability

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32659

freerdp_image_copy out of bound read

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32658

FreeRDP ExtractRunLengthRegular* out of bound read

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32460

FreeRDP Out-Of-Bounds Read in interleaved_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32459

FreeRDP Out-Of-Bounds Read in ncrush_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32458

FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32040

FreeRDP vulnerable to integer underflow in nsc_rle_decode

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-32039

FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Freerdp Redhat
Products
Fedora Freerdp Enterprise Linux
CVE-2024-30251

Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Aio-libs Project Aiohttp Redhat
Products
Aiohttp Aiohttp Ansible Automation Platform and 1 more
CVE-2024-27306

aiohttp vulnerable to XSS on index pages for static file handling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Aiohttp Fedoraproject Redhat
Products
Aiohttp Fedora Ansible Automation Platform and 3 more
CVE-2024-26595

mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2024-26306

iperf3: vulnerable to marvin attack if the authentication option is used

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

CVSS 3.1 · 5.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Es Netapp Redhat
Products
Iperf3 Bootstrap Os Hci Compute Node and 1 more
CVE-2024-25111

SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

CVSS 3.1 · 8.6 High EPSS 65.3% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Bluexp Enterprise Linux and 5 more
CVE-2024-23829

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Aiohttp Fedoraproject Redhat
Products
Aiohttp Fedora Ansible Automation Platform and 3 more
CVE-2024-22211

FreeRDP integer Overflow leading to Heap Overflow

FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

CVSS 3.1 · 3.7 Low EPSS 1.1% KEV · Not listed
Vendors
Freerdp Redhat
Products
Freerdp Enterprise Linux
CVE-2024-21733

Apache Tomcat: Leaking of unrelated request bodies in default error page

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

CVSS 3.1 · 5.3 Medium EPSS 14.3% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Apache-camel-spring-boot Jboss Fuse
CVE-2023-47627

Request smuggling in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aiohttp Redhat
Products
Aiohttp Ansible Automation Platform Rhui and 2 more
CVE-2023-40589

FreeRDP Global-Buffer-Overflow in ncrush_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Freerdp and 1 more
Products
Debian Linux Fedora Freerdp and 1 more
CVE-2023-40569

Out-Of-Bounds Write in FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Freerdp and 1 more
Products
Debian Linux Fedora Freerdp and 1 more
CVE-2023-40567

Out-Of-Bounds Write in FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Freerdp and 1 more
Products
Debian Linux Fedora Freerdp and 1 more