NIST Recommends Some Common-Sense Password Rules

NIST's second draft of its "SP 800-63-4"--its digital identify guidelines--finally contains some really good rules about passwords: The following requirements apply to passwords: 1. lVerifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require...

This Week in Spring - September 24th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in delightful Dallas, TX, at the amazing JConf.dev show. Then I'm off to Germany, and then back home to do some laundry before heading out to Denver, CO, for the amazing Dev2Next show, before then heading out to Belgium f...

CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...

SUSE: Security Advisory (SUSE-SU-2024:3358-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2024:3358-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3358-1 advisory. - Dropped support for libmfx to fix the following CVEs: libmfx: improper input validation...

SUSE-SU-2024:3358-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - Dropped support for libmfx to fix the following CVEs: libmfx: improper input validation CVE-2023-48368, bsc1226897 libmfx: improper buffer restrictions CVE-2023-45221, bsc1226898 libmfx: out-of-bounds read CVE-2023-22656, bsc1226899 libmfx:...

CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...

SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2024:3301-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3301-1 advisory. - CVE-2024-7055: Fixed a heap-based buffer overflow in pnmdec. bsc1229026 Tenable has extracted the...

SUSE-SU-2024:3301-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - CVE-2024-7055: Fixed a heap-based buffer overflow in pnmdec. bsc1229026...

[SECURITY] [DLA 3890-1] galera-4 new upstream version

------------------------------------------------------------------------- Debian LTS Advisory DLA-3890-1 [email protected] https://www.debian.org/lts/security/ Otto Kekäläinen September 17, 2024 https://wiki.debian.org/LTS -...

Debian dla-3890 : galera-4 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3890 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3890-1 [email protected] https://www.debian.org/lts/security/...

Directory traversal in the FileSelector widget

Date : 2024-09-17 CVE ID : CVE-2024-45604 Description Back end users can list files outside their file mounts or the document root in the FileSelector widget. However, it is not possible to edit these files or view their content. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Conta...

DLA-3890-1 galera-4 - new upstream version

Bulletin has no description...

RHSA-2024:2777 Red Hat Security Advisory: squid:4 security update

Bulletin has no description...

RHSA-2024:0397 Red Hat Security Advisory: squid:4 security update

Bulletin has no description...

RHSA-2022:6774 Red Hat Security Advisory: squid:4 security update

Bulletin has no description...

RHSA-2021:2025 Red Hat Security Advisory: squid:4 security update

Bulletin has no description...

RHSA-2017:1840 Red Hat Security Advisory: devtoolset-4-jackson-databind security update

Bulletin has no description...

RHSA-2008:0173 Red Hat Security Advisory: Red Hat Directory Server 7.1 Service Pack 4 security update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.16.0 release

Red Hat OpenShift Dev Spaces 3.16 has been released. All containers have been updated to include feature enhancements, bug fixes and CVE fixes. Following the Red Hat Product Security standards this update is rated as having a security impact of Important. The Common Vulnerability Scoring System...