diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index f202dc01a5e7..31f64ee98d38 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,178 +1,217 @@ + + git -- multiple vulnerabilities + + + git + git-cvs + git-gui + git-p4 + git-svn + 2.48.1 + + + + +

Git development team reports:

+
+

CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the + user susceptible to crafted URLs (e.g. in recursive clones) that + mislead the user into typing in passwords for trusted sites that + would then be sent to untrusted sites instead.

+

CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to + credential helpers which use line-reading functions that + interpret said Carriage Returns as line endings, even though Git + did not intend that.

+
+ + + + CVE-2024-50349 + https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr + CVE-2024-52006 + https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp + + + 2024-10-29 + 2025-01-14 + + + keycloak -- Multiple security fixes keycloak 26.0.8

Keycloak reports:

This update includes 2 security fixes:

  • CVE-2024-11734: Unrestricted admin use of system and environment variables
  • CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers
 CVE-2024-11734 CVE-2024-11736 2025-01-13 2025-01-13 asterisk - path traversal asterisk18 18.26.20 asterisk20 20.11.0

cve@mitre.org reports:

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

 CVE-2024-53566 https://nvd.nist.gov/vuln/detail/CVE-2024-53566 2024-12-02 2025-01-12 redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors redis 7.0.07.4.2 redis72 7.2.7 valkey 8.0.2

Redis core team reports:

An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.The problem exists in Redis 7.0.0 or newer.

CVE-2024-51741 https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 2025-01-06 2025-01-10 redis,valkey -- Remote code execution valnerability redis 7.4.2 redis72 7.2.7 redis62 6.2.17 valkey 8.0.2

Redis core team reports:

An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.

CVE-2024-46981 https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c 2025-01-06 2025-01-10 Gitlab -- Vulnerabilities gitlab-ce gitlab-ee 17.7.017.7.1 17.6.017.6.3 11.0.017.5.5

Gitlab reports:

Possible access token exposure in GitLab logs

Cyclic reference of epics leads resource exhaustion

Unauthorized user can manipulate status of issues in public projects

Instance SAML does not respect external_provider configuration

 CVE-2025-0194 CVE-2024-6324 CVE-2024-12431 CVE-2024-13041 https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/ 2025-01-08 2025-01-08