Jake Miller

The array implementation in Morgan Stanley Hobbes lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) read/write issue that leads to both local and remote code execution via RPC.

The issue is related to errors in the resource consumption control mechanism of the HTTP/2 protocol implementation in various software products. An attacker can exploit this by sending a stream of SETTINGS frames, potentially leading to a denial of service due to excessive CPU or memory consumption. The vulnerability can be exploited by continually sending data, causing affected components to consume large amounts of memory and potentially leading to an out-of-memory condition.

The issue is related to an HTTP request splitting vulnerability in Twisted Web. When a content-length and a chunked encoding header are present, the content-length takes precedence, and the remainder of the request body is interpreted as a pipelined request. This vulnerability is associated with insufficient input validation when processing HTTP headers, which could allow a remote attacker to cause a denial of service.

A SQL Injection issue in the RegistrationSharing module of SUSE Linux SMT enables remote attackers to execute arbitrary SQL statements.

A vulnerability allows remote attackers to read data from the server or cause a denial of service by referencing blocking elements.

The issue is related to insufficient authentication procedure using the HOST header in SUSE Linux Subscription Management Tool (SMT), allowing a remote attacker to spoof a server.