RUSTSEC-2024-0408 Unsound usages of `std::slice::from_raw_parts`

The library breaks the safety assumptions when using unsafe API std::slice::fromrawparts. First, when using the API in iterator implementation TempFdArrayIterator.next, generic type could be any type, which would create and pass a misaligned pointer to the unsafe API. Second, when validating the...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/thunderbird-flatpak container image

An updated rhel9/thunderbird-flatpak container image is now available in the Red Hat container registry. Mozilla Thunderbird is a standalone mail and newsgroup client. Flatpak is a system for running graphical applications as containers. Installing an application as a Flatpak rather than as an...

firefox: thunderbird: Unhandled Exception in Add-on Signature Verification

The Mozilla Foundation's Security Advisory: The application can fail to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw is triggered by an invalid or unsupported extension manifest and could cause runtime errors that disrupt the...

CVE-2024-49413

Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications...

CVE-2024-49413

Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications...

CVE-2024-49413

CVE-2024-49413 concerns Samsung SmartSwitch (PC) prior to the SMR December 2024 Release 1. The issue is an improper verification of cryptographic signatures when installing applications, enabling local attackers to install malicious software via SmartSwitch. Multiple sources corroborate: PT-Secur...

CVE-2024-49413

Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications...

CVE-2024-49413

Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications...

CVE-2024-53986 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

CVE-2024-53988

CVE-2024-53988 affects Rails HTML Sanitizer 1.6.0 when used with Rails 7.1+. A misconfiguration that allows the HTML5 sanitizer to permit the tags “math”, “mtext”, “table” and “style” together with either “mglyph” or “malignmark” can enable a cross‑site scripting (XSS) vulnerability in Rails appl...

CVE-2024-53990

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

CVE-2024-53775

Cross-Site Request Forgery CSRF vulnerability in benmoreassynt DancePress TRWA dancepress-trwa allows Cross Site Request Forgery.This issue affects DancePress TRWA: from n/a through = 3.1.11...

CVE-2024-53775

CVE-2024-53775 is a Cross-Site Request Forgery (CSRF) vulnerability in DancePress (TRWA) for WordPress. The vulnerability affects DancePress (TRWA) versions up to and including 3.1.11. The connected sources (NVD, Red Hat, CVE lists, Patchstack) confirm the CSRF issue and affected version range; n...

CVE-2024-53775 WordPress DancePress (TRWA) plugin <= 3.1.11 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in TannerRitchie Web Applications/DancePress DancePress TRWA allows Cross Site Request Forgery.This issue affects DancePress TRWA: from n/a through 3.1.11...

8 Million Android Users Hit by SpyLoan Malware in Loan Apps on Google Play

Over a dozen malicious Android apps identified on the Google Play Store that have been collectively downloaded over 8 million times contain malware known as SpyLoan, according to new findings from McAfee Labs. "These PUP potentially unwanted programs applications use social engineering tactics to...

VMware Spring Security 安全漏洞

VMware Spring Security is a set of security frameworks from VMware, Inc. that provide illustrative security protection for Spring-based applications. A security vulnerability exists in VMware Spring Security that stems from the presence of a number of anomalies related to the language environment...

SUSE: Security Advisory (SUSE-SU-2024:4116-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of SAP NetWeaver Java Application Server web applications lies in insufficient limits on authentication attempts, which allows attackers to disclose sensitive information.

The vulnerability of SAP NetWeaver Java Application Server’s web applications is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the software for optimizing performance of cloud and local applications in Intel Granulate, related to deficiencies in access control, allows attackers to enhance their privileges.

The vulnerability of the software for optimizing performance of cloud and local applications in Intel Granulate is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...