CVE-2024-39329

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password...

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

...

WordPress 4.2.x < 4.2.38 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability affecting the HTML API. - A Cross-Site Scripting XSS vulnerability affecting the Template Part block. - A path traversal issue...

PT-2024-6226

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.13 Django versions 5.0 through 5.0.6 Description The issue is related to derived classes of the django.core.files.storage.Storage base class that override the generate filename function without replicating the...

OPENSUSE-SU-2024:10139-1 cron-4.2-65.4 on GA media

These are all security issues fixed in the cron-4.2-65.4 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10862-1 inn-2.6.3-4.2 on GA media

These are all security issues fixed in the inn-2.6.3-4.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10701-1 cron-4.2-86.1 on GA media

These are all security issues fixed in the cron-4.2-86.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10108-1 obs-service-set_version-0.5.3-4.2 on GA media

These are all security issues fixed in the obs-service-setversion-0.5.3-4.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11376-1 sddm-0.19.0-4.2 on GA media

These are all security issues fixed in the sddm-0.19.0-4.2 package on the GA media of openSUSE Tumbleweed...

hidden-plugin-topicregex (>=0.0.3 <=0.0.4), thelounge-plugin-giphy (>=1.0.1 <=1.0.2) +3 more potentially affected by unknown CVE via thelounge (>=3.0.1 <=4.2.0)

thelounge NPM version =3.0.1, =0.0.3, =1.0.1, =1.0.2, =1.4.3, =1.4.2, =1.6.0 Source cves: unknown CVE Source advisory: OSV:GHSA-G49Q-JW42-6X85...

Fedora 40 : python-django (2024-5c7fb64c74)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5c7fb64c74 advisory. Security fix for CVE-2024-24680 and CVE-2024-27351 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 39 : python-django (2024-2ec03ca8cb)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2ec03ca8cb advisory. Security fix for CVE-2024-24680 and CVE-2024-27351 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Juniper Networks Paragon Active Assurance 安全漏洞

Juniper Networks Paragon Active Assurance is a programmable test and service assurance solution from Juniper Networks, Inc. Using software-based and traffic-generating test proxies, it can be easily used and delivered as a SaaS solution from the cloud or deployed locally in NFV environments. A...

WordPress GEO my WordPress Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software GEO my WordPress Type Plugin Vulnerable versions = 4.1 Fixed in 4.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-32097 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fbcae2de410d Credits thiennv Required...

Mageia: Security Advisory (MGASA-2024-0075)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Maximo Application Suite uses urllib3-2.0.3-py3-none-any.whl which is vulnerable to CVE-2023-45803

Summary BM Maximo Application Suite uses urllib3-2.0.3-py3-none-any.whl which is vulnerable to CVE-2023-45803. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2023-45803 DESCRIPTION: urllib3 could allow a remote authenticated attacke...

PYSEC-2024-47

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because ...

Debian dla-3761 : spip - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3761 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3761-1 [email protected] https://www.debian.org/lts/security/...

BIT-MOODLE-2023-35131 Moodle: xss risk on groups page

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14...

BIT-MONGODB-2021-32040 Large aggregation pipelines with a specific stage can crash mongod under default configuration

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS...