UBUNTU-CVE-2024-2408

The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817...

CVE-2024-2408

CVE-2024-2408 affects PHP’s openssl_private_decrypt with PKCS1 padding; requires OpenSSL 3.2+ (rsa_pkcs1_implicit_rejection) to mitigate the Marvin Attack. Several connected sources confirm patches exist in PHP Windows builds (8.1.29, 8.2.20, 8.3.8+) and OpenSSL backports across distributions. Re...

CVE-2024-2408 PHP is vulnerable to the Marvin Attack

The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817...

CVE-2024-2408 PHP is vulnerable to the Marvin Attack

The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817...

CVE-2024-2408 PHP is vulnerable to the Marvin Attack

The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817...

OESA-2024-1689 libva security update

Libva is an implementation for VA-API, which is an open-source library and API specification, provides access to graphics hardware acceleration capabilities for video processing. It consists of a main library and driver-specific acceleration backends for each supported hardware vendor. Security...

SUSE CVE-2021-27851

A security vulnerability that can lead to local privilege escalation has been found in 'guix-daemon'. It affects multi-user setups in which 'guix-daemon' runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build...

CVE-2024-36373

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

CVE-2024-36373

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

CVE-2024-36373

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

CVE-2024-36373

CVE-2024-36373 is a stored XSS vulnerability in JetBrains TeamCity identified as affecting the product before version 2024.03.2, arising from untrusted builds settings that fail to properly filter/escape user-supplied data. Public sources consistently describe an ability to inject script/HTML via...

CVE-2024-36373

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

CVE-2024-36373

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

CVE-2024-36373: Improper Neutralization of Input During Web Page Generation

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

PT-2024-3963

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.03.2 Description The issue is related to the lack of protection of the web page structure in the JetBrains TeamCity continuous integration and delivery CI/CD system. This can be exploited by a remote...

Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

GHSA-CW5R-JX8R-9F7X Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

PT-2024-35422

Name of the Vulnerable Software and Affected Versions Jenkins Report Info Plugin versions 1.2 and earlier Description The issue arises from the lack of path validation of the workspace directory while serving report files, leading to a path traversal vulnerability. This allows attackers with...

Path traversal vulnerability in report-info

report-info 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, report-info does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permission to retrieve Surefire...

openSUSE Security Advisory (openSUSE-SU-2024:0135-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...