diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index f4e44f9d9f30..e2bd8727d1c4 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,116 +1,148 @@ + + asterisk - path traversal + + + asterisk18 + 18.26.20 + + + asterisk20 + 20.11.0 + + + + +

cve@mitre.org reports:

+
+

An issue in the action_listcategories() function of Sangoma Asterisk + v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to + execute a path traversal.

+
+ + + + CVE-2024-53566 + https://nvd.nist.gov/vuln/detail/CVE-2024-53566 + + + 2024-12-02 + 2025-01-12 + + + redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors redis 7.0.07.4.2 redis72 7.2.7 valkey 8.0.2

Redis core team reports:

An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.The problem exists in Redis 7.0.0 or newer.

CVE-2024-51741 https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 2025-01-06 2025-01-10 redis,valkey -- Remote code execution valnerability redis 7.4.2 redis72 7.2.7 redis62 6.2.17 valkey 8.0.2

Redis core team reports:

An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.

CVE-2024-46981 https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c 2025-01-06 2025-01-10 Gitlab -- Vulnerabilities gitlab-ce gitlab-ee 17.7.017.7.1 17.6.017.6.3 11.0.017.5.5

Gitlab reports:

Possible access token exposure in GitLab logs

Cyclic reference of epics leads resource exhaustion

Unauthorized user can manipulate status of issues in public projects

Instance SAML does not respect external_provider configuration

 CVE-2025-0194 CVE-2024-6324 CVE-2024-12431 CVE-2024-13041 https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/ 2025-01-08 2025-01-08