Oracle Linux 9 : .NET / 8.0 (ELSA-2024-5334)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-5334 advisory. 8.0.108-1.0.1 - Add support for Oracle Linux 8.0.108-1 - Update to .NET SDK 8.0.108 and Runtime 8.0.8 - Resolves: RHEL-52389 8.0.107-2 - Fix ownership of some...

Oracle Linux 9 : firefox (ELSA-2024-5322)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5322 advisory. 115.14.0-2.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 115.14.0 - Add debranding patches Mustafa Gezen - Add...

RHEL 9 : firefox (RHSA-2024:5328)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5328 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: Firefox:...

RHEL 9 : kernel-rt (RHSA-2024:5365)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5365 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

kernel security update

5.14.0-427.31.14.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

RHEL 9 : kernel (RHSA-2024:5257)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5257 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nftables: disallow...

Oracle Linux 9 : bind / and / bind-dyndb-ldap (ELSA-2024-5231)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5231 advisory. - Minor fix of reclimit test backport CVE-2024-1737 - Resolve CVE-2024-1975 - Resolve CVE-2024-1737 - Resolve CVE-2024-4076 - Prevent crashing at...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12582)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12582 advisory. - net/mlx5e: drop shorter ethernet frames Manjunath Patil Orabug: 36879156 CVE-2024-41090 CVE-2024-41091 Tenable has extracted the preceding...

AlmaLinux 9 : 389-ds-base (ALSA-2024:5192)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5192 advisory. 389-ds-base: Malformed userPassword hash may cause Denial of Service CVE-2024-5953 389-ds-base: unauthenticated user can trigger a DoS by sending a specif...

RHEL 9 : kernel-rt (RHSA-2024:5256)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5256 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

GHSA-Q5WX-M95R-4CGC Concrete CMS Stored Cross-site Scripting vulnerability

Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation...

Oracle Linux 9 : 389-ds-base (ELSA-2024-5192)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5192 advisory. 2.4.5-9 - Bump version to 2.4.5-9 - Resolves: RHEL-44323 - unauthenticated user can trigger a DoS by sending a specific extended search request -...

RHEL 9 : 389-ds-base (RHSA-2024:5192)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5192 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

389-ds-base security update

2.4.5-9 - Bump version to 2.4.5-9 - Resolves: RHEL-44323 - unauthenticated user can trigger a DoS by sending a specific extended search request - Resolves: RHEL-40945 - Malformed userPassword hash may cause Denial of Service - Resolves: RHEL-49457 - perf search result investigation for many large...

ventaporcatalogoecuador.com Cross Site Scripting vulnerability OBB-3954006

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-7399

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority...

CVE-2024-7512 Concrete CMS Stored XSS in Board instances

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.6 with vector:...

Oracle Linux 9 : httpd (ELSA-2024-5138)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-5138 advisory. - Resolves: RHEL-46047 - httpd: Security issues via backend applications whose response headers are malicious or exploitable CVE-2024-38476 Tenable has extracte...

WordPress Social Slider Feed Plugin <= 2.2.2 is vulnerable to Broken Access Control

Software Social Slider Feed Type Plugin Vulnerable versions = 2.2.2 Fixed in 2.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43215 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID eebbacd9eb23 Credits Joshua Chan Required...

WordPress affiliate-toolkit Plugin <= 3.5.5 is vulnerable to Sensitive Data Exposure

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.5.5 Fixed in 3.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6562 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5b7ee2241ccc Credits stealthcopter Required...