Threat database

A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved and later restored from disk to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive cookie data. The issue affects versions of the kimi-cli product from 0.40 onward. A patch is available to address this behavior.

Multiple security issues were fixed in the pgadmin4-9.17-1.1 package on the GA media of openSUSE Tumbleweed. These issues affect the SUSE product but specific details about the vulnerabilities are not provided in the input data.

An always-incorrect control flow implementation in firmware for some Intel Xeon processors may allow a local escalation of privilege by a system software adversary with a privileged user context. The attack requires high complexity and special internal knowledge, with no user interaction needed. The vulnerability can lead to high confidentiality and integrity impacts on the affected system.

A race condition in hardware logic affects some 3rd Gen Intel Xeon Scalable Processors, allowing unprivileged software to cause a denial of service. The vulnerability requires local access and an authenticated user with high attack complexity. It impacts system availability but does not affect confidentiality or integrity.

A security update for libpng16 addresses multiple issues by updating the version to 1.6.58. The update is provided by the SUSE Product Security Team. No specific details about the vulnerabilities fixed or affected versions are provided.

Multiple vulnerabilities have been identified and fixed in the libssh2_org library by the SUSE Product Security Team. These include out-of-bounds heap reads, integer overflows, heap buffer overflows, uninitialized pointer frees, double-free leading to arbitrary code execution, denial of service via integer underflow, and information disclosure. The flaws affect various functions such as sftp_symlink(), userauth_password(), and SSH negotiation components. The update addresses these critical security issues to prevent potential arbitrary code execution, denial of service, and information leaks.