Threats Tagged 'cwe-755'

Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability.

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

CVE-2024-6594 is a high severity vulnerability in the WatchGuard Single Sign-On (SSO) Client for Windows version 12.0. It involves improper handling of exceptional conditions, causing the client to crash when processing malformed commands. This can be exploited by an attacker with network access to cause a denial of service (DoS) condition against the SSO service.

Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands.

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

This update includes the following RPMs: erlang27: * erlang27-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-asn1-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-common_test-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-compiler-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-crypto-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-debugger-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-dialyzer-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-diameter-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-edoc-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-eldap-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-erl_interface-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-erts-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-et-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-eunit-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-examples-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-ftp-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-gdb-tools-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-inets-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-jinterface-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-kernel-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-megaco-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-mnesia-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-observer-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-odbc-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-os_mon-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-parsetools-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-public_key-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-reltool-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-runtime_tools-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-sasl-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-snmp-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-ssh-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-ssl-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-stdlib-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-syntax_tools-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-tftp-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-tools-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-wx-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-xmerl-27.3.4.15-0.1.hum1 (aarch64, x86_64) * erlang27-27.3.4.15-0.1.hum1.src (src)

Valibot versions prior to 1.4.2 have an issue where validation errors involving attacker-controlled object keys such as toString, valueOf, or hasOwnProperty can cause a TypeError in the flatten() helper. This occurs because the flatten() function attempts to push errors onto inherited Object.prototype methods instead of error arrays, leading to application crashes during validation error handling. This vulnerability affects availability by causing request path crashes instead of returning structured validation errors. The issue is fixed in version 1.4.2.

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.