Oracle Linux 9 : linux-firmware (ELSA-2024-12578)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12578 advisory. 20240715-999.34.git4c8fb21e.el9 - Rebase to latest upstream Orabug: 36826157 Tenable has extracted the preceding description block directly from the Oracle Lin...

WordPress Element Pack Elementor Addons Plugin <= 5.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.7.6 Fixed in 5.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4360 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b1a260751a26 Credits Ngô Thiên ...

CVE-2024-7394 Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName()

Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName. A rogue administrator could inject malicious code. The Concrete CMS team gave this a CVSS v4.0 rank of 4.6 with vector...

AZL-48706 CVE-2024-42252 affecting package kernel for versions less than 6.6.64.2-9

In the Linux kernel, the following vulnerability has been resolved: closures: Change BUGON to WARNON If a BUGON can be hit in the wild, it shouldn't be a BUGON For reference, this has popped up once in the CI, and we'll need more info to debug it: 03240 ------------ cut here ------------ 03240...

RHEL 9 : httpd (RHSA-2024:5138)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5138 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Security issues via?backe...

AlmaLinux 9 : httpd (ALSA-2024:5138)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:5138 advisory. httpd: Security issues via?backend applications whose response headers are malicious or exploitable CVE-2024-38476 Tenable has extracted the preceding description...

RHEL 9 : python-setuptools (RHSA-2024:5137)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5137 advisory. The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of...

Oracle Linux 9 : qemu-kvm (ELSA-2024-12574)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12574 advisory. - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit DAT is set hilippe Mathieu-Daude Orabug: 36575206 CVE-2024-3447 Tenable has extracted the preceding...

RHEL 9 : OpenShift Container Platform 4.15.25 (RHSA-2024:4958)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4958 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

RHEL 9 : Red Hat OpenStack Platform 17.1.3 (RHSA-2024:5083)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5083 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service IaaS cloud...

RHEL 9 : kernel (RHSA-2024:5066)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5066 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: block: null pointer dereferenc...

RHEL 9 : kernel-rt (RHSA-2024:5067)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5067 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

RHEL 9 : httpd (RHSA-2024:5001)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5001 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Encoding problem...

RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.8.1 (RHSA-2024:5024)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5024 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...

CVE-2024-4353 Stored XSS in Generate Board Name Input Field

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concre...

CVE-2024-39777

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

AZL-47385 CVE-2024-6923 affecting package tensorflow for versions less than 2.16.1-9

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CVE-2024-39274

Mattermost server vulnerability CVE-2024-39274: Affected versions include Mattermost 9.9.x up to 9.9.0, 9.5.x up to 9.5.6, 9.7.x up to 9.7.5, and 9.8.x up to 9.8.1. The issue is improper validation of the channel from sync messages being a shared channel when shared channels are enabled, which ca...

freeradius security update

An update is available for freeradius. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRADIUS is a high-performance and highly configurable free Remote...

kernel security update

An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...