OPENSUSE-SU-2024:11526-1 libpainter0-0.9.15-2.2 on GA media

These are all security issues fixed in the libpainter0-0.9.15-2.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10018-1 tkman-2.2-157.2 on GA media

These are all security issues fixed in the tkman-2.2-157.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11178-1 libpodofo-devel-0.9.7-2.2 on GA media

These are all security issues fixed in the libpodofo-devel-0.9.7-2.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13727-1 ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12397-1 ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-32918

Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps...

CVE-2024-32918

Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps...

CVE-2024-32918

Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps...

CVE-2024-32918

CVE-2024-32918 describes a permission bypass that allows attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps. The vulnerability is referenced in multiple feeds as affecting Google Pixel/Android devices, with references to a Trusty/TEE subcomponent...

PT-2024-24972 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows attackers to bypass permissions and disable HDCP 2.2 encryption. This is achieved by not completing the HDCP Key Exchange initializatio...

GHSA-47F6-5GQ3-VX9C Composer has a command injection via malicious git branch name

Impact The status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches 2.2.24 for 2.2 LTS or 2.7.7 for mainline Workarounds Avoid installing dependencies via git by using...

WordPress Elements For Elementor Plugin <= 2.1 is vulnerable to Local File Inclusion

Software Elements For Elementor Type Plugin Vulnerable versions = 2.1 Fixed in 2.2 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5348 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 9e9484637a31 Credits stealthcopter Required privilege...

PT-2024-10556 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: Symfony HttpKernel component versions 2.2.X through 2.5.X Description: This issue affects applications with the ESI feature enabled and a proxy in front of the web application. The FragmentHandler considers requests to render fragments as...

PT-2024-24997 · WordPress · Debaat Wp Media Category Management

Name of the Vulnerable Software and Affected Versions: DeBAAT WP Media Category Management versions n/a through 2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

Zend Framework SQL injection vulnerability

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte...

CVE-2024-32587

CVE-2024-32587 affects EnvialoSimple EnvíaloSimple (WordPress plugin) with a Reflected XSS in the plugin’s web page generation. Affected range: EnvíaloSimple from n/a through 2.2; connected Red Hat/ENISA entries confirm the cross-site scripting issue. The Wordfence vulnerability record shows a PA...

PT-2024-25427 · Ibm · Websphere Mq

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.0.0 through 2.1.0 Checkmk versions prior to 2.2.0p26 Checkmk versions prior to 2.3.0b5 Description: The issue allows a local attacker to inject an argument to runmqsc, potentially due to an untrusted data vulnerability in t...

CVE-2023-51416

Cross-Site Request Forgery CSRF vulnerability in EnvialoSimple EnvíaloSimple.This issue affects EnvíaloSimple: from n/a through 2.2...

BIT-DJANGO-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

BIT-DJANGO-2021-33571

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. validateipv4address and...