diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 31f64ee98d38..8fda2190e48a 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,217 +1,217 @@ git -- multiple vulnerabilities git git-cvs git-gui git-p4 git-svn 2.48.1

Git development team reports:

CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the user susceptible to crafted URLs (e.g. in recursive clones) that mislead the user into typing in passwords for trusted sites that would then be sent to untrusted sites instead.

CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to credential helpers which use line-reading functions that interpret said Carriage Returns as line endings, even though Git did not intend that.

 CVE-2024-50349 https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr CVE-2024-52006 https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp 2024-10-29 2025-01-14 - + keycloak -- Multiple security fixes - keycloak - 26.0.8 + keycloak + 26.0.8 - -

Keycloak reports:

-
-

This update includes 2 security fixes:

-
    -
  • CVE-2024-11734: Unrestricted admin use of system and environment variables
    • -
  • CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers
    • -
-
- + +

Keycloak reports:

+
+

This update includes 2 security fixes:

+
    +
  • CVE-2024-11734: Unrestricted admin use of system and environment variables
    • +
  • CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers
    • +
+
+ CVE-2024-11734 CVE-2024-11736 2025-01-13 2025-01-13 asterisk - path traversal asterisk18 18.26.20 asterisk20 20.11.0

cve@mitre.org reports:

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

 CVE-2024-53566 https://nvd.nist.gov/vuln/detail/CVE-2024-53566 2024-12-02 2025-01-12 redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors redis 7.0.07.4.2 redis72 7.2.7 valkey 8.0.2

Redis core team reports:

An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.The problem exists in Redis 7.0.0 or newer.

CVE-2024-51741 https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 2025-01-06 2025-01-10 redis,valkey -- Remote code execution valnerability redis 7.4.2 redis72 7.2.7 redis62 6.2.17 valkey 8.0.2

Redis core team reports:

An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.

CVE-2024-46981 https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c 2025-01-06 2025-01-10 Gitlab -- Vulnerabilities gitlab-ce gitlab-ee 17.7.017.7.1 17.6.017.6.3 11.0.017.5.5

Gitlab reports:

Possible access token exposure in GitLab logs

Cyclic reference of epics leads resource exhaustion

Unauthorized user can manipulate status of issues in public projects

Instance SAML does not respect external_provider configuration

 CVE-2025-0194 CVE-2024-6324 CVE-2024-12431 CVE-2024-13041 https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/ 2025-01-08 2025-01-08