ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Microsoft Teams: Invite attendees to register Notice updated: MC1537353: (Updated) Microsoft Teams: Invite attendees to register2 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  2. gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, … Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  3. compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat … Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  4. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  5. When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short t… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  6. ### Summary Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  7. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented … Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  8. GitHub: Degraded availability for GPT-5.3 Codex and GPT-5.6 models in Copilot Service incident4 linked entries across history · in Admin tools Follow evidence and connection reasons
  9. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and othe… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  10. Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  11. In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  12. Traversal outside working tree enables arbitrary code execution Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  13. Refs and paths with reserved Windows device names access the devices Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  14. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by rest… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  15. undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already … Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  16. follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cooki… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  17. Impact: Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  18. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), … Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  19. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size com… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  20. axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested bracket… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  21. axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollu… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  22. axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed t… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  23. DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execu… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  24. fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no … Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  25. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value aga… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  26. kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a de… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  27. gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate he… Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  28. runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  29. A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  30. A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious im… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 20:36 UTC · 274 of 275 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.