AZL-43146 CVE-2024-37298 affecting package telegraf for versions less than 1.29.4-7

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode on a struct that has a field of type struct... opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of...

AZL-43119 CVE-2024-36387 affecting package httpd for versions less than 2.4.61-1

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance...

AZL-43089 CVE-2024-36387 affecting package httpd for versions less than 2.4.61-1

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance...

CVE-2024-36995

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items...

CVE-2024-36991

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows...

CVE-2024-36985

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunkarchiver“ application...

CVE-2024-36985

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunkarchiver“ application...

R Language Vulnerable to Arbitrary Code Execution via Malicious RDS Files (v1.4.0–<4.4.0)

...

WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Subscriber+ Arbitrary Post/Page Duplication vulnerability

Subscriber+ Arbitrary Post/Page Duplication vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Uncanny Toolkit Pro for LearnDash versions 4.1.4.1...

WordPress Uncanny Automator Pro plugin < 5.3.0.1 - Cross Site Request Forgery (CSRF) Leading to License Settings Reset vulnerability

Cross Site Request Forgery CSRF Leading to License Settings Reset vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Uncanny Automator Pro versions 5.3.0.1...

WordPress Uncanny Automator Pro plugin < 5.3.0.1 - Unauthenticated License Settings Reset vulnerability

Unauthenticated License Settings Reset vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Uncanny Automator Pro versions 5.3.0.1...

WordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin Timetics versions = 1.0.21...

WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by justakazh Patchstack Alliance in WordPress Plugin Tutor LMS versions = 2.7.1...

WordPress H5P plugin < 1.15.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin H5P versions 1.15.8...

Astra Linux – Vulnerability in Firefox

A nested iframe, which triggers cross-site navigation, may send cookies with the SameSite=Strict or Lax attribute. This vulnerability affects Firefox 128 and Thunderbird 128...

Astra Linux – Vulnerability in Firefox

In violation of the specification, cookie prefixes such as Secure were ignored if they were not capitalized correctly. According to the specification, these prefixes should be checked using a case-insensitive comparison. This could result in the browser not correctly implementing the behaviors...

Astra Linux – Vulnerability in Firefox

The frame iterator could get stuck in a loop when encountering certain Wasm frames, leading to incorrect stack traces. This vulnerability affects Firefox 128 and Thunderbird 128...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 127 and Thunderbird 127. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions less than 128 and...

AZL-42880 CVE-2024-6104 affecting package cert-manager for versions less than 1.12.12-3

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

AZL-42943 CVE-2024-6104 affecting package packer for versions less than 1.9.5-2

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...