Grafana API IDOR

Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5....

Grafana directory traversal for .cvs files

Today we are releasing Grafana 8.3.2 and 7.5.12. This patch release includes a moderate severity security fix for directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability i...

SUSE: Security Advisory (SUSE-SU-2024:0305-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:1100-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: cobbler / image-sync-formula / inter-server-sync / jose4j / etc (SUSE-SU-2024:1507-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:1507-1 advisory. cobbler: - Provide option to use pre-built GRUB bootloader - Prevent parallel executions of cobbler sync actions bsc1218764 image-sync-formula: - Updat...

SUSE: Security Advisory (SUSE-SU-2024:0937-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:1113-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:1260-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:1340-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:1532-1 Security update for SUSE Manager Server 4.3

This update fixes the following issues: release-notes-susemanager: - Update to SUSE Manager 4.3.12 Monitoring: Node exporter upgraded to 1.7.0 Automatic migration from Salt 3000 to the Salt Bundle New update-salt recurring state uyuni-proxy-systemd-services package has been added to proxy channel...

WordPress Althea WP Theme <= 1.0.13 is vulnerable to Broken Access Control

Software Althea WP Type Theme Vulnerable versions = 1.0.13 Fixed in 1.0.16 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33686 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89e5f642c59b Credits Dhabaleshwar Das Required privileg...

Apple iTunes < 12.13.1 Local Privilege Escalation Vulnerability (HT214091) - Windows

Apple iTunes is prone to a local privilege escalation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:itunes...

WordPress Asgaros Forum Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Asgaros Forum Type Plugin Vulnerable versions = 2.8.0 Fixed in 2.9.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32440 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4d6dad870cc9 Credits Ananda Dhakal...

WordPress Hello Elementor Theme <= 3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hello Elementor Type Theme Vulnerable versions = 3.0.0 Fixed in 3.0.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31289 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8b6c120716f6 Credits Dhabaleshwar Das...

WordPress AWP Classifieds Plugin <= 4.3.1 is vulnerable to Broken Access Control

Software AWP Classifieds Type Plugin Vulnerable versions = 4.3.1 Fixed in 4.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31350 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a2e0652e7562 Credits Abdi Pranata Required...

PT-2024-22172 · WordPress · Dsgvo All In One For Wp

Name of the Vulnerable Software and Affected Versions: DSGVO All in one for WP versions n/a through 4.3 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent. Recommendations:...

WordPress DSGVO All in one for WP Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software DSGVO All in one for WP Type Plugin Vulnerable versions = 4.3 Fixed in 4.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-27967 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e4ed76229824 Credits Joshua Chan...

PT-2024-13343 · WordPress · Ladiapp

Name of the Vulnerable Software and Affected Versions: LadiApp plugin for WordPress versions up to, and including, 4.3 Description: The issue is related to a missing capability check on the ladiflow save hook function, allowing authenticated attackers with subscriber-level access and above to...

BIT-MOODLE-2023-46858

Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...

SUSE: Security Advisory (SUSE-SU-2024:0770-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...